1

If I purchase used storage media from a company, what is my liability for the data that it may contain?

As a standard practice, all such media would be wiped. However, secure data destruction is not my business.

From an ethical standpoint, I would want make a "best effort" to ensure that all data is removed. However, from a legal perspective, where does the liability reside in the event of data being leaked?

Is there a "standard" disclaimer of liability for situations such as this that I can use, or is this a case "there be dragons, contact a lawyer"?

Improve this question
6
  • 1
    What does the sales agreement from the company say about the storage media and any existing data? That will be a contract that outlines liability.
    – BlueDogRanch
    Jan 4, 2019 at 19:55
  • If it contains data from anybody who is in the EU, then the EU's GDPR will probably be relevant.
    – phoog
    Jan 4, 2019 at 20:32
  • @phoog would it? I can become legally responsible for data I didn’t collect if I happen to find it on a lost flash drive?
    – Dale M ♦
    Jan 4, 2019 at 20:38
  • @DaleM the GDPR might be relevant without creating a legal responsibility on the part of the person finding the data. Perhaps the storage device is evidence of a breach of the GDPR. The purpose for which the found data are used might or might not be within the scope of the GDPR. But yes, I think it's generally true that if you find data on a lost flash drive you can become legally responsible for it, even if that won't necessarily be true in all circumstances.
    – phoog
    Jan 4, 2019 at 20:53
  • What country are you in? Data privacy rights vary a lot between the US and most of Europe.
    – David Thornley
    Jan 7, 2019 at 16:41

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .