The data left behind when you leave a data service

The duty at the end

APP 11.2, as the OAIC puts it: “Where an entity holds personal information it no longer needs for a purpose that is permitted under the APPs, it must ensure that it takes reasonable steps to destroy or de-identify the personal information”, and the obligation “applies even where the entity does not physically possess the personal information, but has the right or power to deal with it”. That second sentence is the one that reaches a provider’s copy.

What de-identified means, from the Act (s 6, via the OAIC): information “is no longer about an identifiable individual or an individual who is reasonably identifiable”.

Two limits on the duty. It is subject to other law: depending on the type of entity and the type of personal information, there may be specific obligations under law or a court or tribunal order to retain, or to destroy or de-identify, the information, and agencies have specific retention obligations for Commonwealth records. And “destroyed” has a test: personal information is destroyed when it can no longer be retrieved; where it is not possible to irretrievably destroy information held in electronic form, reasonable steps include putting the information “beyond use”, which means not being able, and not attempting, to use or disclose it, giving no other entity access, surrounding it with appropriate technical, physical and organisational security including access controls with logs and audit trails, and committing to destroy it if or when that becomes possible.

What must be kept, and for how long

The keep periods are separate duties, and the OAIC puts both in one place: the duty to destroy or de-identify arises where the entity no longer needs the information for a purpose permitted under the APPs, and depending on the type of entity and the personal information involved, there may also be specific obligations under law or a court or tribunal order to retain, or to destroy or de-identify, the information. Four periods the law sets, with the clock where the law gives one:

For tax file numbers the TFN Rule adds methods. Where hard copy records go out through garbage or recycling collection, they should be destroyed through a process such as pulping, burning, pulverising, disintegrating or shredding; and where it is not possible to irretrievably destroy TFN information held in electronic format, reasonable steps to destroy it would include putting it “beyond use”.

What a service still holds after you leave

A provider still holds copies, and the National Archives’ advice to Australian Government agencies is the plain version of what that takes: “To ensure the digital information’s complete destruction, find and destroy all copies”, and where information is stored in the cloud, the agency “should ensure that the contract stipulates, under retention and disposal requirements, that all copies should be destroyed”.

The OAIC’s questions for the end of a contract with a provider are the same questions, asked of the entity: can the provider confirm that your information and any copies, including backups, have been destroyed at the conclusion of the contract, and can you retrieve the information? Have steps been taken to verify the irretrievable destruction of personal information stored on a third party’s hardware such as cloud storage, and are backups of personal information also destroyed, arranged in such a way that destruction of the backups is possible?

What deleting actually does

What “deleted” does, as the National Archives sets it out for Australian Government agencies: “Digital information deletion does not mean destruction”, because when digital information is deleted “it is only the pointer (the link) to that information (such as the file name and directory path) that is deleted”; “the actual data objects are gradually overwritten in time by new data”, and “until the data is completely overwritten, there remains a possibility that the information can be retrieved”.

The NAA calls the process of erasing or overwriting information stored on digital media sanitisation; the extent of sanitisation used depends on the information’s classification, and a destruction method is chosen based on a risk assessment of the information’s sensitivity and aligned with that classification. Sanitisation methods for destroying digital information include:

• Clearing: “the information is cleared from the media or overwritten and is hidden under layers of nonsensical data so it cannot be retrieved through disk or file recovery utilities”.
• Purging: “the information is randomised so that it is no longer readable and cannot be reconstructed from digital media using nonstandard systems operating outside the media’s usual working environment (known as a laboratory attack)”.
• Degaussing: “recorded data is erased through demagnetising magnetic media”, and the ASD’s Information Security Manual sets out that a degausser of insufficient magnetic field strength will not be effective.
• Destruction: “the most extreme form of sanitisation ensures the media is drastically altered and can never be reused by physically destroying carriers of digital information such as hard drives and discs”.

Why that matters in the ordinary case: deleting a file removes the pointer and leaves the data in place, so “deleted” is not the OAIC’s test of destruction, which is that the information can no longer be retrieved. What a provider can be asked to confirm instead is the OAIC’s end-of-contract standard: that the information and any copies, backups included, have been irretrievably destroyed, and that you can retrieve the information on the way out.