UGN Security Forums UGN Security: UGN Archives Tech News Toys 'R' Us to bin rogue PC

Retailer failed to delete owner's personal data from hard drive of used machine

Toys 'R' Us has said it will bin a second- hand PC that it sold with the original owner's personal data still on the hard drive.

The PC had been returned by its original purchaser, John Green, because it kept crashing. But after the store had repaired and sold on the machine, its new owner was concerned to discover Green's address and credit card details on it, as well as pictures of his two children.

Most companies have procedures in place to wipe hard drives in case they are reused but, increasingly, these procedures appear to be overlooked. Toys 'R' Us is the latest retailer to resell digital equipment without first cleaning the hard drive.

In June Phil Clayton approached vnunet.com after he discovered pictures of someone else's children, along with web documents and emails, on a replacement hard drive installed on his PC by Mastercare, the after-sales repair and customer support company owned by the Dixons Group.

When contacted by vnunet.com, Toys 'R' Us said it very much regretted what had happened.

"It was an unfortunate incident. When we take PCs back we do clean the hard drive to get rid of data, so we can resell at a reduced price, but this one seems to have been missed," said a spokesman.

"Because of the problems we will not be reselling this PC again."

People concerned about privacy are warned to take steps to protect their data. Despite the bad publicity generated by this latest incident, current data protection legislation had not been violated, according to a leading lawyer.

Jon Fell, a partner with law firm Masons, explained: "The Data Protection Act does not cover domestic personal data on home PCs. Neither is there a law that covers overall right to privacy in this country.

"And unless there was a specific contract signed with the company to destroy the data, which, if not followed, could be breach of contract, the duty of care remains with the owner."

Consumers returning PCs or hard drives can wipe personal data simply by reformatting the hard drive around seven times. Professional forensic software programs could recover data after this, but are unlikely to be used unless someone is suspected of a criminal offence.

source: vnunet

Made me think of this,