02 · Compliance
Old machines keep everything that was ever saved on them. Four separate rules say what has to happen to that data, and all four put the responsibility on the business that owned it, not on whoever hauled the equipment away.
Factory reset
holding data
A reset clears the index, not the actual blocks. On SSDs there is usually still recoverable data left behind.
NIST SP 800-88 purge
holding data
Every block gets overwritten, or the encryption key is destroyed. Then we verify it and log the serial.
The four rules
815 ILCS 530/40Illinois PIPA
Every business in Illinois, at any size
Personal information must be made “unreadable, unusable, and undecipherable” before disposal.
740 ILCS 14/15(a)Illinois BIPA
Anyone operating fingerprint timeclocks or biometric access control
Biometric data destroyed within three years of the person’s last interaction, or when its purpose ends.
16 CFR 682FTC Disposal Rule
Any employer running background checks. No size threshold
Reasonable measures to prevent unauthorized access to consumer report information during disposal.
16 CFR 314FTC Safeguards Rule
Auto dealers, tax preparers, mortgage brokers, title and insurance offices
Secure disposal of customer information, with retired drives named explicitly.
All four shown. Pick a business type to see which apply to you.
A plain-language summary, not legal advice. Confirm your own obligations with your counsel.
Why BIPA is different
Three of the four rules only ask for “reasonable measures” and leave it to a regulator to decide later what a violation costs. BIPA writes the number into the law itself, per person. The fingerprint timeclock in the breakroom is the device people forget most often when they clear out an office.
A 2024 amendment stopped the damages stacking per scan, so repeated scans of the same person count once. It is still counted per person.
Exposure, by headcount
Negligent · $1,000 each
$60,000
Intentional or reckless · $5,000 each
$300,000
Statutory liquidated damages under 740 ILCS 14/20, or actual damages if greater, plus the claimant’s legal fees. Arithmetic from the statute, not a prediction and not legal advice.
Responsibility
It doesn’t pass to whoever hauled the equipment away, no matter how many hands it goes through after that. What closes it out is a certificate naming every drive.
Who we collect from
Fingerprint timeclocks, payroll and plant-floor machines.
Deal-desk and F&I machines hold credit applications.
Years of client financial records on replaced machines.
Workstations and imaging machines carrying ePHI. BAA signed before anything leaves.
Background-check records and aging donated fleets.
One line per drive, with the serial, how it was destroyed and where it ended up. That’s your answer if anyone ever asks.
No minimum · Free collection when the equipment carries resale value · Reply within one business day