Question 1

What federal laws govern e-waste disposal?

Accepted Answer

The primary federal framework is EPA RCRA (Resource Conservation and Recovery Act), which classifies certain electronic components as hazardous waste. However, there is no single comprehensive federal e-waste law. Instead, businesses must comply with RCRA plus state-specific e-waste laws (25+ states have them), industry regulations (HIPAA, GLBA, PCI-DSS), and local ordinances.

Question 2

Which states have e-waste recycling mandates?

Accepted Answer

Over 25 states have e-waste recycling legislation, including California (SB 20/50), New York (Electronic Equipment Recycling and Reuse Act), Illinois (Electronic Products Recycling and Reuse Act), Washington (E-Cycle), Texas (voluntary program), and Connecticut, Maine, Minnesota, Oregon, Wisconsin, and others. Requirements vary from manufacturer-funded collection to landfill bans to mandatory recycling.

Question 3

What certifications should I look for in an e-waste recycler?

Accepted Answer

R2 (Responsible Recycling Standard) and e-Stewards are the two recognized certifications. R2 covers environmental management, data security, and downstream vendor accountability. e-Stewards adds stricter rules on hazardous material export and prison labor. Both require third-party audits. ISO 14001 (environmental management) is a complementary certification. For data destruction specifically, look for NAID AAA certification.

Question 4

What is NIST 800-88 and why does it matter?

Accepted Answer

NIST Special Publication 800-88 Rev. 1 (Guidelines for Media Sanitization) is the federal standard for data destruction. It defines three levels: Clear (logical overwrite — for redeployment), Purge (degaussing or cryptographic erasure — for leaving the organization), and Destroy (physical shredding — for highest security). Most compliance frameworks reference NIST 800-88 as the data destruction standard.

Question 5

What is a Certificate of Destruction (COD)?

Accepted Answer

A COD is a document certifying that specific data-bearing devices were destroyed using a specified method on a specified date. It typically includes: device serial number, make/model, destruction method (per NIST 800-88), date and time, technician identification, and facility location. CODs are the primary evidence of compliant data destruction in regulatory audits.

Question 6

How does HIPAA apply to electronic equipment disposal?

Accepted Answer

HIPAA Security Rule (45 CFR 164.310(d)(2)) requires covered entities and business associates to implement policies for the disposal of electronic media containing ePHI. This means all hard drives, SSDs, mobile devices, and other storage media must undergo documented destruction before equipment leaves your control. HIPAA does not specify a method — but NIST 800-88 is the accepted standard.

Question 7

What about GLBA requirements for banks?

Accepted Answer

The Gramm-Leach-Bliley Act Safeguards Rule requires financial institutions to protect customer information throughout its lifecycle, including disposal. This means documented data destruction on all devices that contained customer financial information — workstations, servers, ATMs, POS terminals, and mobile devices. FFIEC examiners review IT disposition as part of bank examinations.

Question 8

Can I handle e-waste compliance in-house?

Accepted Answer

Technically yes, but the practical barriers are significant: you need NIST 800-88 compliant equipment, trained technicians, documentation systems, and downstream accountability for recycling. Most organizations find that outsourcing to a certified ITAD provider is more reliable, better documented, and often less expensive than building in-house capability.

Question 9

What happens if e-waste is disposed of improperly?

Accepted Answer

Dual liability: environmental penalties under EPA RCRA (up to $50,000 per day per violation) and state e-waste laws, plus data security liability if recoverable data is found on improperly disposed devices. Data breach costs average $4.88 million (IBM 2024). Criminal liability is possible for knowing violations of RCRA or state environmental laws.

Question 10

Does formatting a hard drive destroy the data?

Accepted Answer

No. Standard formatting only removes the file system index — the actual data remains on the drive and is recoverable with widely available forensic tools. Even a "full format" in most operating systems does not overwrite all data sectors. NIST 800-88 compliant methods (multi-pass overwrite, degaussing, or physical shredding) are required for actual data destruction.

Question 11

What about SSD data destruction?

Accepted Answer

SSDs require different destruction methods than traditional hard drives. Degaussing does not work on SSDs (they are not magnetic). Cryptographic erasure works on self-encrypting SSDs, but requires verification. Physical shredding is the most reliable method for SSDs. NIST 800-88 recommends Purge-level methods specific to the SSD technology or Destroy via shredding.

Question 12

How do I handle e-waste from remote employees?

Accepted Answer

Ship-back programs with pre-paid, tracked shipping containers. Employees pack devices and ship to your ITAD provider. Each device is tracked by serial number from ship-back through data destruction. Certificates of Destruction are issued per device. For high-security organizations, local pickup from employee homes is available in major metros.

Question 13

What does R2 certification actually require?

Accepted Answer

R2 requires: a documented environmental health and safety management system, data destruction per NIST 800-88, tracking of all materials through downstream vendors, no export of hazardous e-waste to developing countries, insurance and financial assurance, and regular third-party audits. R2 facilities must demonstrate compliance at every stage of the recycling chain.

Question 14

What is downstream accountability?

Accepted Answer

Downstream accountability means your recycler is responsible for verifying that every downstream vendor (shredders, smelters, refiners) also meets environmental and data security standards. R2 and e-Stewards require this. Without it, your e-waste could end up at an uncertified facility — and you're still liable for any resulting environmental damage or data exposure.

Question 15

How often should we dispose of old IT equipment?

Accepted Answer

Best practice: establish a regular disposition cycle (annually or semi-annually) rather than letting equipment accumulate. Stockpiled equipment creates physical security risk, takes up space, and depreciates in remarketing value. For regulated industries, prompt disposition reduces the window of exposure for data security incidents.

E-Waste Compliance & Data Security — FAQ