To Dither or not to Dither

Dithering is not productive. If you have a decision to make, make it, clearly having given it due consideration first, but it cannot take forever. And seek empowerment for goodness sake. It is an overused word in business these days, but we have to be allowed to use our commonsense. Most issues concern finding the right balance between risk and reward, and with clear guidelines most of us are able to see the wood for the trees.

Now you may be thinking that poor old Hugh has been plagued by ditherers in recent days. Well yes and no, really. I usually am one way or another because I have a sales function to perform and the time between offering my wares and getting a yes or no is often a frustrating one. I don’t get why it takes so long sometimes because it is not...it really is not...rocket science.

However, the customer is always right. You take as long as you like. But actually what caused me to put finger to keyboard right now is the idea of risk and reward being at the crux of the matter with every business decision.

The risk can be the cost. This is going to cost me £100 and the reward is that pile in the corner of the office is going to disappear. Sustainability will have been supported and my data will have been dealt with, leaving me with the paperwork to prove it and a warm feeling of indescribable joy.

It’s often the cost that causes the dithering of course. Oh the boss won’t like that at all, having to pay £100 to get rid of 3 old PC’s, that broken kettle and those two old phone handsets. There is no budget for that and if head office finds out, heads will roll for sure. In my experience there is much more dithering over £100 than there ever is over £1,000.

£100 is a decent meal out for you and the other half, with wine. It’s a trip to the cinema and a take away after. No popcorn though, popcorn is ruinously expensive in my experience. It’s almost two thirds of two adult tickets to see the mighty Arsenal lose to Monaco. It’s a year’s subscription to Netflix. It is not a fortune.

Quite often we get asked to take away some broken desks, or chairs, or cupboards along with our usual. And we charge for it. No one seems to mind about that too much, because we are doing them a favour. It is obvious waste and there is no perceived value. But for some unknown reason just because something has a plug people dither.

Oh do you know what? I am always quite excited when I see that someone has a pile of non-WEEE rubbish that they would absolutely love us to take as well as their WEEE, because it means instant gratitude. They could have found someone else to get the real rubbish but it would have cost them in time and hassle as well as cost, so all of a sudden we are the good guys.

But suggest that the aforementioned broken kettle, clapped out PC and old phone handsets are rubbish as well and will be charged for accordingly and there is a sharp intake of breath. The boss won’t like that.

Well the boss won’t like being fined when your database gets stolen either. He won’t like it if he gets caught trying to slip business waste into the local council tip either. There are lots of things he won’t like that £100 prevents him from suffering these days. So surprise the boss. Tell him you have saved the company database from breach, tell him that you have operated within WEEE regulations and the data protection act and have the paperwork to prove it. And tell him that it only cost £100. He will be dead chuffed. Promise.

eReco – Your Get of Jail free card

Who is responsible for your data?

It’s a good question. Ultimately it is a business responsibility regulated by law under the data protection act and once the EU gets around to it the responsibility will sit firmly with the directors of the business. Even if they delegate it to someone else, they can be sued, fined, jailed or even decapitated if Genghis Khan gets his hands on them.

And that is in addition to fines levied against the business.

I think that focuses the mind quite nicely. Once this becomes law (and we are past the expected ratification date, so any day now Mr Farage!) apathy is going to get quite dangerous, and once the directors are firmly in the firing line things tend to get done.

But what things?

Obviously, here in eReco land, we are going to focus on disposing of redundant IT equipment because that is our wont. There are lots of other things to do but we aren’t directly involved in that so yah boo sucks, sort it out yourselves.

So, you have a computer to get rid of and it has a hard drive, what should you do?

In simple terms, you have two different legal responsibilities.

Firstly to dispose of the equipment according to WEEE regulations. Regardless of what you call it, or any residual value, this is waste and whatever you do, you need to think about waste transfer notes and how the item is going to get to a WEEE regulated recycling facility. If you do not get a WTN you are breaking the law and if your equipment does not go to a WEEE facility and ends up somewhere naughty, you have also broken the law. So, if you give it to someone to dispose of for you, make sure you get the right paperwork and be sure they are going to do things properly. If not, those directors are in the firing line.

Secondly, you are responsible for any data on any hard drive disposed of. There is no limit to that responsibility. You remain responsible. Even if eReco collect it from you, the data is still ultimately your responsibility. You would have to prove that you have engaged a data secure service provider and that their processes met your duty of care to protect your data.

If something went wrong and there was a data breach, you would still be in hot water, because the data remains yours, and you would need to prove to Genghis Khan, or our friendly neighbourhood ICO Chris Graham, that you acted responsibly.

Now all eReco customers will have no problem proving this. We provide Waste Transfer Notes, asset lists and certificates of data destruction, and if something goes wrong we have liability insurance up to £10,000,000. Our collections are secure, with security cleared personnel, and our facility down here in East Grinstead is also secure. This is certified and checked, without warning, by ADISA, and we are also approved by DIPCOG to work in the MoD/Government space.

All of which the truly responsible client will have checked out in advance. This is the important stuff you see...you need to show due diligence. And then do you know what actually keeps the MD out of choky? Yes that’s right, it’s the boring old paperwork!

Say your data ends up on eBay. This happens. A lot. So no pooh poohing me please. As General Melchet said in Blackadder 4, ‘did he pooh pooh you Blackadder?” I won’t have it. This is important stuff so no giggling at the back.

Once the data breach is crystal clear, you are in deep doggy doo’s. Genghis, however he finds out about it (and he will, because legally, if he doesn’t find out any other way, you have to tell him or face even graver consequences) will start asking some difficult questions. And the boring old paperwork which everyone takes for granted and does not give too much importance, becomes absolutely crucial.

First things first, Genghis would want to see what you asked us to collect. However you do it, by email or by filling in one of our forms, we keep a record of what you asked us to collect. This is important in a minute, so tuck it away at the back of your mind. Then we give you an estimate, and you accept this estimate, and we confirm a collection date.

On said date, we rock up and get the stuff. We bring with us a Waste Transfer note, which says we collected this sort of stuff from this address on said date.  Everyone signs and you get a copy. We also have consignment notes. This details the sort of materials being transported, whether they are hazardous or not, and gives full addresses and licenses for both parties. Not very interesting but all legal proof and approval for what we are doing.

Then we bring the stuff back here. We track it in, noting any serial numbers but also adding an identity number of our own, so that we always know where it is in our system. From this we produce an asset list. It should match the list you asked us to collect, of course. If you asked us to collect 10 PC’s we tell you that we have collected 10 PC’s and the serial numbers are XXXXXX. You now have a comprehensive audit trail of disposal from your request to us, through transportation by registered and licensed supplier to arrival at a registered, accredited and approved facility. In other words, you have proof of what you have done and Genghis loosens his grip on your throat, for the time being at any rate.

But before we move on, a reality check. I have said in previous blogs and always say to clients on the phone, tell us if you have more to collect than you have said. 

Partly this is because we want to charge you more. I am just like that, I like to get paid. Partly it is because I know what the vehicle can take in terms of weight and quantity of stuff, and we don’t want to overload it. But mostly because it is dangerous if you add something without telling us. Because the audit trail is potentially broken. In our case, we would pick it up when we compile our asset list, but legally PC XXX has magically left your care and arrived with us. You have not asked us to take it. What if you do not even know it is gone? Genghis might well slap you around a bit because of things like that.

However, let’s leave that side of things and get back to business. So we have your stuff and you have an audit trail which will be added to when we erase your hard drives and give you a certificate to prove we did it. At this point you are pretty much done. You can kneel before Genghis, carefully watching the scimitar in his hand and say ‘it was them, Guv’ if anything goes Pete Tong. We would end up in the dock together, because it’s still your data, but having employed a certified supplier and ticked all the paperwork boxes, it would take a very unreasonable Genghis to punish you, and our insurance would hopefully cough up.

Please note, this is all hypothetical, we have never had a problem and, touch wood, never will. We do things right. And going back to a well-worn theme of this blog, this is why we charge for our services. Even if we do agree a kit covers costs deal, which we do if you are recycling gold plated laptops, these costs are deducted before we share any revenue with anyone. Because we think this is the really important stuff. It’s the stuff that keeps your MD out of jail.

And you may think that is taking things a bit far. But take a look at the ICO’s hall of shame when you have a moment and imagine those breaches when director responsibility comes in. It is very tempting to look at IT equipment recycling as a cost, but I have always maintained that it is risk management.

Do it right, for your director’s sake.

It Really COULD be You!

Prepare to be petrified.

This is a Doctor Who moment, except I am not sure that we have a big enough sofa to hide behind.

I try not to scare people. In normal circumstances, I don’t think it is a great business tactic. So since starting this blog I have not overstated the risks. The ICO does not fine everyone. There is not a queue of master criminals waiting for the chance to steal your data. Because that is not the point.

In fact, as I have tried to explain, data security rules and regulations are really more about risk management, and the relatively short list of people who have been named, shamed and fined are the ones who got caught red handed, with their pants down, their hands in the till and the egg streaming down their faces.

But in the space of just two days, three things have happened, which I will relate to you in the order in which they happened to me.

Firstly, the lads were repairing an old fax machine. It was a successful operation and in coughing and spluttering back to life, the faithful old friend spewed out the last ten facsimile’s it had been asked to send; in full, perfectly legible, for anyone to read.

I am not going to reveal what the ten messages revealed but what would they be on your machine? I would guess some innocuous confirmation stuff and a little bit of confidential data, maybe a legal contract? Nothing too serious but still confidential, and in the wrong hands, or in the ICO’s span of attention, you could be in an expensive bit of trouble. Maximum fine will be £500,000 or 5% of global turnover.

Secondly, one of those large printers. The sort that serves a lot of Dilbert’s on the busy floor of a large business, so it has a memory to queue print jobs. I had never thought of that before I joined eReco but a memory is a memory, and this printer had a shed load of stuff.

Part of our process is listing what it does have and reporting back, if we think it might be important to someone, so we have to have a little look. Loads of business documents were on there. Plus some rather funny limerick’s and some fairly rude suggestions about Shirley in accounts. In this case it was not the content we found that rang alarm bells, but what we might have found. It was a risk I certainly would not have considered a few months ago. Again, if there had been something naughty and it had all gone Pete Tong, maximum fine will £500,000 or 5% of global turnover.

Thirdly, something I really can’t go into any detail about, because it is very likely to be sub judice before too long. But I will tell you that we found a document thrown into a toner collection bag. If you knew what the document was, you would not believe me. It would start to sound like the plot to one of those detective dramas where they are trailing money around the world in quantities too vast for anyone who queries the price of a sausage roll in Gregg’s to comprehend.

Which brings me back to apathy and ignorance, two growing themes for my daily wittering.

In the first two cases, no harm no foul. Perhaps unwittingly but certainly sensibly, the two companies involved had done the right thing by engaging a professional ITAD company (Us, eReco, pay attention!) to securely collect and process their redundant kit. Memory wiped and gone forever, £5 per unit, thanks very much for the business guys. Saving your ass is free.

In the third example, a company more than big enough to have a proper data security process and with extra regulations piled on it a mile high, allowed a highly sensitive document to be thrown out with the toner cartridges. No secure collection. If it was not for the eagle eyes of our team, who are all security checked and well aware of the seriousness of the situation, that document could have ended up anywhere.

Mistakes like that should never happen. Never. Ever. Chris Graham (the ICO to people who have not been concentrating...affectionately known as Genghis Khan in this blog) beheads people for this. It gets people on the evening news. It does brand damage. Executives depart the building. Share prices plummet. John Humphreys barks at people.

I hope this has been a cautionary tale. It is still sending shivers down my spine. Don’t be a disaster waiting to happen. Let the professionals (Us obviously, by preference) help you identify the risks and deal with them professionally.

The Price of Everything and the Cost of Nothing

One episode of QI focused on the many interesting things inside an average mobile phone. Including a tiny speck of gold, no less. It was an interesting discussion, with some good jokes, but it is typical of the sort of chitchat that gives recycling real problems.

It left me with the impression that anyone recycling old mobile handsets could very well end up with a considerable amount of money, some of it at my expense. So, although I don’t have the audience of Stephen Fry and Alan Davies, let me share something with you to achieve some balance.

EReco has gained a reputation in the printer world for extracting the most value out of second hand equipment. We are quite good at it, and our client base reflects that, I am pleased to say. The office printer is a much used and abused device. Despite all the guff about paperless offices, most of us still churn out lots of printing and big organisations often refresh their assets accordingly. So hot off the press, having just done several pricing exercises, here are some facts.

Modern printers have memory so they have to be wiped. Not a problem, we can do that, but unfortunately that tends to corrupt the software in the case of printers. It can be replaced but the cost is not always worthwhile. And here’s why.

The market value for a used printer is not high. Because everyone knows they get a lot of use from their first owner, even in tip top condition, with software undamaged, £50 is about it. At the other end of the scale, if it is completely knackered and we have to reduce it to its constituent parts, we will get around £5. If there is gold in them thar hills, there ain’t much!

Before we get to that stage, we have to collect the thing and wipe the data. That costs more than the lowest scrap value, hence why we charge for collection and data erasure. However, if we can sell your old stuff, we share the profits after deducting our costs.

But don’t get excited, recycling will not make you rich either, I promise. That is not the point. The idea is to do it responsibly for the lowest cost. I am not going to give you any Green lectures because there are enough people doing that. All you need to know is that a WEEE recycler like us will not put anything into a landfill unless they really have to (and that is not much but there are still a few things that have to be buried). We work really hard at extending the lifecycle of everything we get our hot little hands on, because that is the best option for the environment.

But you should not be worrying about a few quid to do something for the environment. On two levels that is not the thing to worry about. Firstly, you have done your bit and secondly, the cost of not doing it properly far outweighs the negative cost.

Because...let’s say you get rid of some old printers to a bloke who is prepared to collect them for nothing. He says all the right things and he has a nice smile. So you say yes. But he doesn’t wipe the memory and some clever ne’er do well uses the information and you get caught. Which is exactly what happened to the now defunct NHS Surrey Trust and my local hospital. Except in their case it was PC’s and not printers.

Patient records ended up in the public domain and they were fined a lot of money. £200k. Two hundred thousand pounds. And it costs £5 to wipe a hard disk. And you get the paperwork to prove you have followed all the regulations. And all of these problems are caused by people not wanting to pay to get rid of something they think has value.

The old cliché about there being no such thing as a free lunch still holds true.

Apathy, Fear, Suspicion and the SME

Most people work hard and have busy days. Managers and business owners have a lot of things to think about, a lot of rules and regulations to consider, and it all takes time. That is why recycling and the idea of sustainable business is not as high on the agenda as we would like it to be.

EReco sits in a sector fraught with risks, regulations and rules, but the biggest feeling I get from the majority of SME’s I talk to is a strange mixture of apathy, fear and suspicion.

Let me take those three emotional responses in reverse order.

People are suspicious of someone taking away their old IT equipment purely because they suspect that they are missing out on something. It’s not so bad with old wires, keyboards and the like, because they did not cost a lot in the first place and they have been well used and abused, and possibly don't fit the replacement kit which in any case come with new wires etc, but when it comes to desktops, laptops, servers and stuff, the cost kicks in. Remember, this is the man who has just paid to replace this stuff. He knows what it cost him down to the last penny. And even if that pile in the corner is all now redundant, he has this nagging voice in his head that tells him he is giving away money. It makes him reluctant to let go.

Fear is there too. He is no fool. He knows about hard drives, or at least he thinks he does. He does not think there is anything bad on the old machines, he may even have checked, and he does not think any criminal mastermind would be that interested in his old files anyway, but there is a nagging doubt there. He is not really sure what he should do, so he does nothing much at all, except deleting everything he can see.

Which brings me to apathy. Because this is not one of life’s bigger decisions. Not in the great scheme of things. This is redundant kit. If you have bought replacements and you have put the old stuff in a dark corner somewhere whilst your mild fears and suspicions fester, you cannot really be bothered to chase the solution too far. There is no problem hanging on to IT rubbish. It is not decomposing. So unless you need the storage space back, keeping it is relatively risk-free. It is actually easier to do nothing at all.

I absolutely guarantee that if you root around in any business premises you will find a bit of redundant kit somewhere. Damn it, most family homes are the same. I have a Virgin Media box they just left with me when I upgraded to TiVo. It has been at the bottom of my wardrobe for two years for heaven’s sake. And I could just drop that down the dump, for free.

There are thousands of tons of WEEE we could be recycling right now sitting there doing nothing other than take up space. And that is quite important, don’t you think? The idea that our electrical goods can be broken down at worst and reused to make something else is an incredibly good one, but far too often the good message gets lost in the reality of the situation, and that causes fear, suspicion and apathy.

So if you are a slightly nervous, suspicious sort of person who hasn’t summoned the energy to do the right thing with that pile of rubbish in the storeroom, it’s time to buck up. Call me (there are other IT recycling businesses out there, if you really must, but hey, we’ve come this far together, give a guy a break!) and I will sort it for you. It doesn’t hurt, you might get a few quid ahead at the end of the process and you will be doing something good for once.

Come on, you know it makes sense.