Pine Technical College
Policy and Procedure

Policy Number: 707 Date: 12/20/2002 Revision Date:
Division/Department: ITS Author: Ken Ries
Subject: Disposal and Transfer of Computer Data Storage Media

Authorities:
MnSCU Office of General Counsel Memorandum , December 18, 2002

Minnesota Government Data Practices Act

Purpose:
To assure that protected data will not be inadvertently passed on to unauthorized persons, while relying on readily available methods and software to further allow use by another party.

Policy:
Computer equipment and/or storage media may not be transferred from one user to another user, sold, donated, discarded, or otherwise transferred unless the following procedure is followed prior to the transfer:

Procedure:
Shredding:
The following media must be destroyed by shredding to 1/32” pieces. No transfer to a second user allowed. An approved disposal vendor who guarantees shredding of media data may be used. A list of approved software and disposal vendors will be maintained at http://www.its.mnscu.edu:

    · Floppy Disks

    · Back Up Tapes

    · CDROM Disks

    · CDRW Disks

    · ZIP Disks

Computer media provided for quasi-public use, such as in student labs or libraries, may be transferred to other uses without scrubbing.

Transferring a hard drive or computer containing a hard drive to any other user:
1. The equipment is “scrubbed” with approved, multi-pass “wipe” utilities in accordance with this standard. Reformatting or defragging programs do not constitute “scrubbing” and are not sufficient to meet these standards.

2. A single pass “scrub” is required before transfer when the hard drive or computer is being transferred internally for use by other MnSCU employees. The entire drive must be written with zeroes or nulls.

3. A triple “scrub” pass is required before transfer if:

    a. The hard drive or computer will be disposed of externally, such as through surplus equipment, other sale or donation, or other disposition outside MnSCU.

    b. An administrative official determines that the hard drive or computer to be disposed of requires that additional precautions be taken because of the presence of a substantial amount of protected or sensitive data, such as equipment used primarily for institutional research, or personnel, student or legal data.

4. “Scrubbing” may be done through contract with an approved disposal vendor if the vendor guarantees the results, and that the vendor will protect any data on the hard drive or computer in accordance with the Minnesota Government Data Practices Act. A list of approved software and disposal vendors will be maintained at www.its.mnscu.edu.

5. Hard drives or computers provided for quasi-public use, such as in student labs or libraries, may be transferred to other uses without scrubbing. Users of such systems should be advised that there is no guarantee of privacy for information they access or enter in such systems.

Responsibilities:
All employees are responsible to ensure all data storage medium described above is submitted to the Information Technology Systems department for proper disposal.

ITS staff is responsible for ensuring that all data storage media is disposed of in accordance with this policy.

Dissemination:
All employees of Pine Technical College, contractors, temporary employees, and other individuals that have access to data storage media covered by this policy.

Reviewed by Leadership Team: 12/20/02
Reviewed by Faculty Senate: 1/15/03
Reviewed and Approved by Leadership Team: 1/13/03

Approved: ______________________________________Date: 1/13/03
Robert L. Musgrove, Ph.D., President