Three legislations you need to comply with when dealing with IT equipment at the end of its life
It is said that one man’s junk is another man’s treasure. Never is this truer than in the technology space, in which one organisation’s outdated equipment can be just what a smaller organisation needs for its day-to-day administration. Or, some companies even donate or sell equipment to their staff. Donating equipment rather than discarding it is also a great contributor to the circular economy, extending the life of goods rather than sending them straight to landfill when their current usefulness has expired.
However, while tech donations are to be encouraged, they do open donors up to a certain amount of regulatory risk. “This should not discourage you from donating,” says Malcolm Whitehouse, compliance manager of AST Recycling. Rather, you should be aware of the regulations governing the donation of office equipment and understand the measures you need to take to ensure compliance.
There are three pieces of legislation you need to comply with when dealing with IT equipment at the end of its life:
1. The National Environmental Management: Waste Act
This act specifically governs how companies can be fined and held liable for devices up until their end of life. If, for example, a company donates 100 laptops to a charity or school, at which they will still have three years of useful life, then the company that donated those devices still technically owns them. If the receiving organisation dumps or gives them away, and those devices are traced via their serial numbers, the donating company could be fined up to R10 million or the responsible party could be sent to prison for 10 years.
If a compliant e-waste recycling company such as AST Recycling manages the donation on your behalf, it can supply you with a chain of custody certificate, which absolves your company of any further responsibility for those devices. The next steps in the chain of custody are governed by the next relevant piece of legislation, discussed in point 2.
2. The Consumer Protection Act
Section 59 or the Consumer Protection Act says that if you donate a device to an individual or organisation, you are still liable for the support and maintenance of that device, and you are still required by law to ensure the responsible recycling of that device. This is not something that many companies or organisations know.
Once an e-waste recycling company issues a chain of custody certificate, it becomes liable for making sure the equipment is properly disposed of at its end of life. AST Recycling has a fully functional system for tracking where devices are located, with a unique tracking number for each device. They will collect the devices from the recipient organisation, and ensure that all their components are responsibly recycled, effectively closing the loop.
3. The Protection of Personal Information (POPI) Act
If a device that contains sensitive information is donated without having undergone a proper data sanitisation, there’s a risk that the data could be recovered. Under the POPI Act, the original owner is liable for a fine of between R1 million and R10 million and between one and 10 years in jail plus damages, if proper care was not taken in the responsible recycling or refurbishment and sanitisation of the device.
AST Recycling offers a solution that makes use of globally accepted software designed to sanitise data or data storage media, and then provides a certificate of sanitisation, confirming that any data previously saved on those drives is unrecoverable. This leads to zero risk of any data breach from your data storage media.
While tech donations are to be encouraged, they do open donors up to a certain amount of regulatory risk. “This should not discourage you from donating. Rather, you should be aware of the regulations governing the donation of office equipment and understand the measures you need to take to ensure compliance,” says Whitehouse.
