I'm curious if you have any direct examples of such a statutory requirement? I'm not doubting that such exist, but I've never seen this as a matter of general law.
Contract stipulations are a thing of their own, and those are a different kettle of fish.
But you're absolutely correct that if you have a contractual and/or statutory requirement, you must meet it. But for most of us not dealing with any contractual or statutory requirements, a secure erase for SSD or complete zero fill for an HDD is enough (more than enough, really).
As we all know nothing is clear or simple when the government is concerned. All by design of course. In my book it’s just give elected an out when something goes wrong.
Statutory requirements almost never list specific details, such as a number of steps of doing something. Instead they reference certain keywords or a particular standard. Which, of course, is less than descriptive. So let’s look at HIPAA and specifically data destruction.
HIPAA Faq 575 discusses this.
“ • For PHI on electronic media,
clearing (using software or hardware products to overwrite media with non-sensitive data),
purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or
destroying the media (disintegration, pulverization, melting, incinerating, or shredding).
The definitions of the three terms above helps define action. But other references are used which need to be included. The next references
NIST SP 800-88. NIST it THE standards create for the US Feds. And that doc is standard for data destruction. There are some other references being made such as to
https://disa.mil but a lot of that is behind private walls. Look through SP 800-88 and you’ll see where each term above is referenced with context of the type of media and available techniques. But most important of all it keeping logs.
