WEEE threatens "data loss explosion"

New regulations are still largely misunderstood, according to experts

The Waste Electronic and Electrical Equipment (WEEE) directive comes into full effect this weekend, despite fears that many firms remain unaware of their obligations under the new law and that it could inadvertently lead to an increase in corporate data breaches.

Experts warned that the new regulations, which require IT producers to provide free environmentally-friendly IT disposal for customers but also impose some legal obligations on all business users of IT, remained largely misunderstood and as a result many firms were in danger of failing to meet their compliance requirements.

"Awareness of WEEE amongst IT managers is very low," said Derek Morgan, head of strategy at IT recycling firm CKS Group. "They hear it is based on producer responsibility and switch off, but that is very misleading, because a big chunk of WEEE imposes obligations on them for dealing with historic WEEE." Under the new law, businesses have a responsibility to keep an audit trail for disposal of all their IT kit and arrange and pay for environmentally-friendly dispose of " historic WEEE" that was bought prior to 13th August 2005 and is not being replaced with new kit.

Jean Cox-Kearns, take back and recycling manager for Dell in Europe, agreed that outside of the largest firms many organisations remained unaware of their obligations. But she argued that this situation was being replicated across Europe. "WEEE has been in Ireland for two years now but I recently attended event where a lot of delegates from the midmarket were unaware they could arrange free IT disposal," she said.

However, Mike Davis of analyst Ovum argued that many could get away with non-compliance for the foreseeable future. "The Environment Agency isn't ready to police WEEE." he said. "If IT chiefs take a risk based approach they may unfortunately decide that they are likely to get away with non-compliance for quite a while."

Experts also warned the WEEE directive could increase the risk of data loss unless firms tighten up their data cleansing processes when disposing of IT kit. "The legislation encourages disposal firms to pick out machines for reuse, but there is no obligation on them to wipe any data held on the kit," explained Morgan. "There is a high likelihood of an explosion in data loss as businesses assume wrongly that WEEE requires the producers to wipe data for them."

Cox-Kearns agreed that the risk of data loss now represented the biggest concern around WEEE. "The government is encouraging re-use, which is great, but that means that any IT kit entering the waste stream has to have its data destroyed first or there is real risk the data could be compromised once it enters the waste stream," she advised.

Nigel Montgomery of analysts AMR Research advised that the new law provided the perfect opportunity for firms to address their data destruction processes. "The big guys are ready but a lot of firms in the midmarket really need to look at their whole returns process," he said.

Flawed data destruction processes remain common at many firms, despite the increased risk of reputational damage and prosecution under the Data Protection Act (DPA) that they bring. "Until we get a really high profile DPA prosecution IT managers will not take this issue as seriously as they should," warned Davis.

However, there was some good news with experts agreeing that while the Environment Agency may struggle to police the new legislation it has defied its critics and managed to get the majority of producers and disposal firms WEEE accredited ahead of deadline. "Credit where it's due," said Morgan. "We've seen good progress in getting producers and recyclers officially approved, some of the recyclers only got their accreditation with days to go, but it has done a pretty good job turning the applications round so quickly."

"There are over 3,200 producers now registered and all the big players are on board," added Cox-Kearns. "If there is a gap it is with the smaller players and the Environment Agency is now contacting them."