As I was walking down the hall, I noticed a lot of old computer equipment sitting next to a pile of trash. My first thought was that some of the data that my state agency is charged with protecting under various statutes was about to become available to anyone who happened to pick through our trash.

A closer inspection revealed that there were no computer disks or other media in the pile. No data was about to leak out through our Dumpster. Other things could, though, and that detoured me from data security matters for a while as I pursued the question of proper disposal of hazardous waste.

As it turns out, our IT employees didn't really know what to do with old computer equipment, so they put it out for the maintenance people to pick up. The people in charge of the management of our building were clueless about how to handle hazardous materials. They told me our old equipment usually ended up in the parking lot waste bin or was taken home by members of the cleaning staff who thought they could refurbish it for their own use or resale.

That wasn't acceptable. I directed a member of my staff to discover what methods were available in our region for the proper disposal of computer equipment. He found out that a local computer supply store provided a disposal service in conjunction with Dell. There was only a small fee to cover the cost of boxing up the equipment. Armed with that new information, I wrote a procedure to cover hazmat disposal. Problem solved.

Ah, but what about those cases when we do have to dispose of disks and other media? I started thinking about all those computer, server and storage device disks that are collecting around here. The agency is in the middle of a desktop upgrade project, which means we're retiring hundreds of computers as well as a number of servers that are out of warranty. In the old days, you could call a nonprofit organization that would gladly take your old computers. These days, it's a little more complicated, since we aren't allowed to transfer hard disks that could contain people's personal information to any other party. Not too many organizations want your equipment sans the hard disks.