Electronic Device Transfer and Disposal Standard

Overview

University and personal electronic devices, such as computers, mobile devices, and removable storage media may contain University information. This document details mandatory actions intended to prevent the unauthorized disclosure of University information when a device is transferred to another user or removed from service.

Applicability

All personal or University-owned electronic devices that store University information shall conform to this standard, as mandated by the University Records Management Policy. The assigned users or owners of those devices are responsible for ensuring that this standard is followed before transferring or disposing of the device.

Policy

Data must be reviewed prior to surrendering a digital device for transfer, storage, or disposal in order to make sure that the next user or owner will have only the data they are permitted to have under the Information Classification and Protection Policy.

Device Transfer

When a computer, electronic device, or digital storage media is assigned to another user or to a custodian for storage prior to re-issue, the original user shall take responsibility for reviewing the device's file contents under a manager's supervision and determine if any files should be transferred to the new user based upon their job responsibilities.

All software that is licensed to the original user should be reviewed to make sure it may be legally transferred under the terms of the software's license.

The appropriate Information Technology department or Information Technology designated departmental technician shall facilitate and control the transfer of University computers and other electronic devices. The original user or the appropriate supervisor shall use the "Computer Setup" form to obtain Information Technology assistance with this process.

Device Disposal

When a computer, electronic device, or digital storage media has reached the end of its useful life, Information Technology, in cooperation with University departments or vendors, shall manage the process of proper disposal. Users shall not dispose of University computers or electronic devices directly. Disposal also includes any transfer out of University inventory, such as: gifting, donating, designating for personal use, decommissioning or surplussing any computer or data storage device. Devices disposed without wiping the entire data storage may require a data breach notification to be sent to affected indiividuals under the signature of the major area executive.

The assigned user or departmental technician shall use the "Computer Decommission" form to initiate the disposal of computers. Users may dispose of storage media by shredding; otherwise, they must submit the "Technology Move and Surplus Request" form.

The requesting individual shall erase any personal information prior to turning in the device for disposal. Information Technology shall manage the process of ensuring all University information is properly purged prior to final disposal.

Electronic devices may contain hazardous materials. Disposal of electronic devices shall comply with any University hazardous waste standards as well as all applicable laws. Any disposal fees that are assessed by the University's hazardous waste vendors shall be passed on to the initiating department.

Revision History