Download the Tom's Hardware App from the App Store
The reference for current tech news
Yes No
Ads

Staples Selling PCs with Old User Data Still Intact

by - source: CBC News

It's the risk you take when returning products that feature some type of storage solution, whether its a USB stick, laptop or an Xbox 360.

CBC News reports that Staples (Business Depot) in Canada has violated privacy law by not fully wiping consumer data off laptops and storage devices that are returned by customers.

According to the report, Privacy Commissioner Jennifer Stoddart conducted an audit on 17 out of 300 Staples stores across the country, 15 of which had devices slated to be resold that weren't fully wiped. These devices included desktops, laptops, USB hard drives and memory cards that supposedly already endured a wipe and restore process before returning to the retail shelf.

But overall, the audit discovered that 54 of the 149 audited devices still contained banking information, tax records, social insurance numbers, health card numbers, passport numbers and additional information left behind by prior owners. Laptops were the biggest offenders, with 17 out of 20 still holding on to old user data.

Stoddart said that she didn't have the authority to impose sanctions, but did suggest that Staples re-evaluate the way it removes old data. "Until our recommendation on wiping customer data is fully implemented, personal information will continue to remain at risk and Staples will not meet its obligations under PIPEDA," Stoddart's report said.

Staples followed up with an official statement claiming to have cooperated fully with the privacy commissioner's office during the audit. "Further, Staples has implemented changes that exceed current industry practice to remove personal data from returned memory devices," the company said, adding that it was currently testing several ways of wiping data from returned storage devices.

But the office retailer also stated that overwriting the data, which was suggested by the privacy commissioner's office and one of the most reliable methods of eradicating old data, would not be an option, claiming that the process could damage some of the devices.

Stoddart's recent audit isn't he first time the privacy commissioner's office investigated user-data complaints relating to Staples. She called the latest findings "particularly disappointing" given that the same problem surfaced in 2004 and 2008, and that Staples committed to corrective action to resolve the privacy issue both times.

Sounds like Staples based in the U.S. may need to be audited too.

Share:
41
Comments
X
Submit

Comments
Add your comment
aoneone 06/23/2011 2:21 AM
Hide
-8+

Only a complete idiot would overlook the wonderful partition commands. ^^

Not to mention returning their devices to 'Staples' out of all the other places... Good Lord, I think I am getting dumber by the Kilobyte. ^^ Have a nice day! =)

dogman_1234 06/23/2011 2:32 AM
Show
eddieroolz 06/23/2011 2:34 AM
Hide
-3+

I heard Staples and that was enough.

But in all honesty, this is why I wipe the disk with 3 passes when I need to return something.

JOSHSKORN 06/23/2011 2:38 AM
Hide
-2+

Staples: Yeah, we've got that! Even data that has been left behind.

footfiremystic 06/23/2011 2:58 AM
Hide
-18+

Couldn't they have just pressed their "EASY" button?

christop 06/23/2011 3:08 AM
Hide
-0+

Not shocked here they have no computer skills at all just hire people off the street who think they know how to fix computers but know nothing at all. They can't even format a drive... damn..

RazberyBandit 06/23/2011 3:27 AM
Hide
-2+

In response, Staples would be wise to hire new, competent technicians (for a change) in order to clean this mess up.

house70 06/23/2011 3:56 AM
Hide
-8+

"But the office retailer also stated that overwriting the data, which was suggested by the privacy commissioner's office and one of the most reliable methods of eradicating old data, would not be an option, claiming that the process could damage some of the devices. "

WTF? The only thing damaged here is their (shoddy) reputation.
It would cost them some extra time to do that, but unless their wiping solution consists of putting the HDD in a microwave, there would be no damage. And please don't tell me Staples does not have the money to buy a Killdisk license.

Anonymous 06/23/2011 3:59 AM
Hide
-0+

In America this would be a quick class action lawsuit, and the problem would be solved industry wide. Sucks to be Canadian, where the "enforcers" cant even issue a citation.

stm1185 06/23/2011 4:05 AM
Hide
-3+

Why would you give the laptop back to staples with your data still on it?

nebun 06/23/2011 4:30 AM
Hide
-6+

stm1185 :
Why would you give the laptop back to staples with your data still on it?


people are dumb and very uneducated

maddad 06/23/2011 5:03 AM
Hide
-3+

So why is it Staples' fault if u are too dumb to remove your data before turning the computer in to them? That's like trading in a car and leaving your wallet in the old one just after cashing your paycheck. Thanks for the cash and credit cards!

CaedenV 06/23/2011 5:03 AM
Hide
-3+

you are aware that 2nd hand shops like the Good Will and St. Vincent DePaul do this all the time. Thankfully the company I work for uses some excellent wiping software before we put a fresh OS on them, and we still manage a small profit selling $75 computers to low income families :) And they get nice little P4 and PD systems too.

joe nate 06/23/2011 5:17 AM
Hide
-1+

house70 :
"But the office retailer also stated that overwriting the data, which was suggested by the privacy commissioner's office and one of the most reliable methods of eradicating old data, would not be an option, claiming that the process could damage some of the devices. "

WTF? The only thing damaged here is their (shoddy) reputation. It would cost them some extra time to do that, but unless their wiping solution consists of putting the HDD in a microwave, there would be no damage. And please don't tell me Staples does not have the money to buy a Killdisk license.



If you've ever been into a Staples, you'll notice they sell more than computers/harddrives. One thing comes to mind that would be a real pain in the butt to remove. The blackberry playbook requires you to install their software onto your computer and sync the device and then remove it via that to remove any files you've put on it - and that's not even writing over it. That's just deleting it.

The only thing I can think of "rewriting over the data" that could damage it is devices with flash memory, where flash memory have a limited number of writes. Many devices, like the tablet in example, in addition to SSDs and flash drives and flash memory for cameras would lose overall life expectancy to be written over (multiple times for better wiping).

Really, from a retail standpoint I can't see a win situation for them. If you have a return and wipe the data off some sort of flash memory, it reduces the life expectancy of that drive - which isn't new anymore, so to resell it you'd have to discount it.

Ever done a defrag on an SSD? I wouldn't suggest it. Putting it in a microwave does about the same thing to it. Doing a multiple-pass data wipe on a flash drive also really adds some wear and tear to it.

Graemewp 06/23/2011 5:35 AM
Hide
-2+

Makes me wonder how extensive these 'wiping' processes are. Do they zero the entire drive or is it just a shift-delete?

Zingam 06/23/2011 6:49 AM
Hide
-1+

Fire some low staff workers and everything's fine again!

Clonazepam 06/23/2011 7:42 AM
Hide
-0+

What do those retail pc's come with these days? They have a Recovery partition or Recovery discs? Both? Do some still allow only 1 copy of recovery discs to be made? They probably are just being cheap and dont want to pay the labor to kill the drive and do a fresh recovery... idk its been ages since ive even bothered to look at the retail pc's.

Anonymous 06/23/2011 7:53 AM
Hide
-2+

Why is it Staples responsibility to fix your screwup of leaving personal data on something you returned??

davedbo 06/23/2011 8:34 AM
Hide
-3+

I work at Staples (flexible hours while I'm at college), and I'm not surprised. I see managers return and resell hard drives without even hooking them up to a computer to check for data, other technicians have no idea how to even format a drive-- even though I made the store a CD pack with triple wipe software on it, all they need to do is boot to the disc and follow the steps or run the executable -.-

The problem could be resolved and the people in the stores could still have their jobs. Staples does not provide adequate tools, training or procedures to their technicians. Most stores are given a PC without admin rights, very minimal hardware specs and tons of Symantec bloat-ware. Stores, at least in my state, are not given OS discs, each customer is supposed to provide their own. This costs the store and the customer tons of money.

There is also very little to no management over their technology department. None of the management I have met has any technical background, most are cashiers that have been there for 10+ years. The procedures and operations aspects of their tech departments have been taken from their copy center, and it doesn't work.

But back to the article. There is no procedure for wiping hard drives. It takes too much time for the employees who know how (remember that terrible PC they have to work with). They constantly recycle computers, we're only supposed to accept PC's that boot into XP+, and remember the thing about no OS discs? We'd have to charge the customers $100+ to wipe their HDD and keep their OS on there. The data is supposed to be wiped at the depot it's sent to, but I have never been to the depot and don't know if that actually happens.

I have told management (General, district, corporate) this and they have done nothing.

So if you recycle your PC through me, I'll boot it up, fill out the paperwork, take it to the back, come back out with your HDD and tell you to shred it through a local service or keep it in case you need the data.

davedbo 06/23/2011 8:37 AM
Hide
-0+

clonazepam :
What do those retail pc's come with these days? They have a Recovery partition or Recovery discs? Both? Do some still allow only 1 copy of recovery discs to be made? They probably are just being cheap and dont want to pay the labor to kill the drive and do a fresh recovery... idk its been ages since ive even bothered to look at the retail pc's.



It depends on the brand. Most come with a recovery partition. Dell is the only one I have seen come with recovery discs, and they just started doing that again.

Buy a new HP laptop and get 7-9 DVD's ready to burn the recovery media.

davedbo 06/23/2011 8:39 AM
Hide
-0+

Caidyin :
Why is it Staples responsibility to fix your screwup of leaving personal data on something you returned??



Because most people shop at Staples because they don't know how to do it themselves. Also, it is the retailers responsibility to protect the customers data. You would get mad if their PIN network dumped all your credit/debit card system information to others, no?

dioxholster 06/23/2011 10:17 AM
Hide
-0+

please be kind rewind.

neiroatopelcc 06/23/2011 10:24 AM
Hide
-0+

aoneone :
Only a complete idiot would overlook the wonderful partition commands.


Deleting or altering the partition tables will not remove any actual data, and a format will only remove a bit of data from the root directory of any partition. Any other data will remain intact and readable by any free or trial version data recovery software.

At the very least, you'd have to do a read/write test on your harddrive before returning a computer if your data needs to be removed.

twile 06/23/2011 2:14 PM
Hide
-0+

Maybe I'm crazy here, but don't most flash storage devices have thousands or tens of thousands of write cycles at the least? Sometimes hundreds of thousands? Zeroing an entire drive would use up one of those writes, which is a small fraction of a percent of the storage device's lifespan. And somehow I imagine that most machines stocked in Staples don't use SSDs.

Really, their argument is just weak. Even if it's true and it would damage some devices, that doesn't mean you have to do it to those devices. "Oh no, we can't fully wipe the data on some of our devices, we better not try at all on any of them" = wtf argument

SteelCity1981 06/23/2011 3:41 PM
Hide
-0+

So what is going to happen vendors be required to put a return reminder icon on their computers now and when people click on it, it sends them to the restore software on their pc?

drwho1 06/23/2011 3:58 PM
Hide
-0+

On 2 occasions I have sold 2 of my PC's to someone else, but I have (a) re-partitioned the disk (b)Full formatted twice, and (c)re installed its original OS.

Nothing left behind.

More recently I simply threw away an old hard drive, but I did again, (a) + (b)
except that I stop the formatting making the disk unreadable then open the physical drive and destroy the physical disk before I threw the poor bastard on the garbage.

again Nothing left behind.

freggo 06/23/2011 4:00 PM
Hide
-0+

maddad :
So why is it Staples' fault if u are too dumb to remove your data before turning the computer in to them? That's like trading in a car and leaving your wallet in the old one just after cashing your paycheck. Thanks for the cash and credit cards!



Windows does not have an easy way to 'really' delete data; a fact that most people are simply not aware off !

Leaps-from-Shadows 06/23/2011 4:37 PM
Hide
-0+

This article definitely doesn't surprise me. Companies going for the quick and easy solution that also saves labor hours is pretty typical.

Prescott_666 06/23/2011 5:20 PM
Hide
-0+

"On 2 occasions I have sold 2 of my PC's to someone else, but I have (a) re-partitioned the disk (b)Full formatted twice, and (c)re installed its original OS.
Nothing left behind."

Wrong! As aoneone said above

"Deleting or altering the partition tables will not remove any actual data, and a format will only remove a bit of data from the root directory of any partition. Any other data will remain intact and readable by any free or trial version data recovery software. "

But you can use Derick's Boot and Nuke (DBAN) or several other wiping utilities to overwrite the entire surface of the disk. Once should be enough unless you think whoever gets it is going to send it to a lab and spend tens of thousands of dollars to recover your data, but multiple passes don't cost anything except time, so knock yourself out.

g00fysmiley 06/23/2011 5:21 PM
Hide
-0+

perhaps its a brilliant move on staples part... that way when people buy stuff there they are to afraid to return it knowing all the info put into the device might get out

HolyCrusader 06/23/2011 5:46 PM
Hide
-0+

I use Parted Magic for my disk-wiping needs.


Ads

Best offers

Newsletters


OK
Ads