Your company has just made a sizable capital expenditure to provide all employees with the latest and greatest in computer technology. You are very proud of this investment and expect extra efficiencies and extra dollars to your bottom line. You were telling a friend of these events and your expectations and she made an inquiry on behalf of a local charity on whose board she sits.  “Our after school kids would make great use of your old computer equipment.”  Seems like a no brainer – no need to store the equipment; no need to dispose of it.  Maybe even some tax benefits.  Think again.

You have a duty to protect from disclosure personal and private information of your employees and any such information of other persons which your company may garner in its work activities. This type of information may exist on the hard and software of your computers.  This information does not only include medical information (the famous Health Information Portability and Accountability Act (“HIPAA”), but other private information relating to bank accounts (direct deposit on your payroll data?) and social security numbers. The disclosure of this information could subject your company to fines imposed by government agencies as well as potential civil liability, including the cost to defend those lawsuits.

Before making the decision to donate your equipment to any charity (and also before you dispose of the equipment) you should take certain precautions.  Remove all data on all equipment before it leaves your office. Drives should be removed and disabled or destroyed.  Keep logs of any such activity. Establish a policy for such activities. Vendors for such services exist, but what guarantees and/or certifications do they provide to assure destruction of the data?

You cannot ignore your duty to ensure that sensitive data is secure once a computer is removed from service, stored, disposed of or given away. Your charitable action, although altruistic, may prove costly in ways you could not imagine. Establishment of appropriate policies and procedures - especially in the context of your industry regulations - should allow you to avoid the potential liabilities existent with retired computer equipment.