Customer drive/data handling procedures and Liability

[Pasotech]

So bit of a complicated question but here goes. I am a tch at a computer repair store, we sell new used and refurbished. It seems every policy we have in place to prevent a problem has been ignore in one instance and caused us a potentially big problem.

First thing customer 1 comes in wants a refurb laptop to replace her old one. Ok good replaced it and transfered few files to her new to her laptop. Job well done.
2 weeks later customer 1 returns with the laptop stating the drive is not big enough storage for her. No problem grab a bigger drive, clone her data to it and she pays the difference customer happy again congrats us.

Here is where things fall apart, whenever we pull a customer drive, failing or questionable drive its practise to recycle it. However someone thought that since it was a drive we just installed in a refurb that it would be a terrible waste to toss it so instead in a box of used drives WITHOUT WIPING IT.

Now that in itself is bad enough but here goes the worse problem. Months later customer 2 comes in and wants a laptop with failed drive repaired at lowest possible price. We offer a useable used drive with windows on it and they think thats great. Tech 1 grabs a drive out of the pile and installs it in the computer and starts the computer testing drive with our usb booted test tools, because we dont trust that the drive works till we test it. Only sensible.
Tech 1 then goes home for the day.
Tech 2 comes on sees the drive test is complete and shuts the computer down marking the drive as tested and working. But doesnt do anymore with it.
Next Day . Tech 1 comes back and sees the test is complete, powers computer up to start installing and low and behold it booted straight to windows. Tech 1 assumes that Tech 2 already did the reload. computer working good, loads customers data onto the computer and calls customer its ready to go. Customer 2 picks up laptop verifys that their stuff is on it and goes out the door happy. job well done again, or is it.

Turns out the drive was never clean installed as to protocol and because there was nothing on the desktop the assumption it was a clean install was made. Once the customer data was loaded onto it it was checked and yes there were files in documents pictures etc, lots of them. Data transfered appeared correct at first glance but then again customer 1 only had a few files.

Turns out the drive still had her data on it as well as customer 2 data, and the files happened to be legal documents and tax information. Customer 2 when realizing that some of the files weren't theirs doesnt just delete them, or better yet call us, they open the document, and promptly call the law office whose letterhead is on the letter saying they just got a laptop repaired which has this data on it that that must belong to them.

Law office convinces customer 2 to surrender the laptop to them and has now contacted us out of the blue with a rather stern nasty letter asking us to explain how this breech of information occured.

My question is are we actually liable for anything to do with abandoned drives or data and is this just a bad series of mistakes or is it an actual major legal **** up.

 

[Sky-Knight]

Yes, you are liable... because you screwed up... I suggest you get a lawyer on this... now.

 

[sapphirescales]

Hooooo boy. Document, document, document. When multiple technicians work on a computer, you MUST document EVERYTHING! This is one reason why our policy is to NEVER have more than one tech work on a computer.

As for if you're liable, I can't speak to your exact state as state laws differ. You MUST contact a lawyer IMMEDIATELY to protect yourself. I know that where I'm from, a computer repair shop accepts 100% liability for data breaches like this. I hope you have a good umbrella policy with your insurance.

And yeah, that employee that just assumed things without checking the documentation or at the VERY least checking the Documents, Pictures, etc. folders would be getting fired if he were working for me. I train my employees to NEVER assume, and if you don't know if something has been done, just do it again to make sure.

 

[Markverhyden]

When it comes to lawsuits anything goes. You might not have been technically liable, in terms of violating a specific statute. But that's irrelevant. When it comes to copying data one check I always do is get the info on the source and destination folders, rick click >properties.

But something does not sound right. Unless the laptops were the same model booting to an OS should have failed when the drive was put into the second machine.

 

[Pasotech]

This issue was basically caused by one **** up of policy from each staff.
#1 don't reuse a drive that has had customer data on it
#2 never put a drive in the used pile if it hasn't been secure wiped
#3 don't use a used drive to repair computer (customer specifically asked for used drive but still)
#4 don't assume that because something looks done that its done right.
#5 make sure to verify data transferred accurately and get the customer to verify data at pickup.

There are 5 rules in order to make sure this doesnt happen and it still happened. We have lists of notes to say what was done and what still has to be done, but we have all been guilty of forgetting a step on this one. We have never had a data issue before, and this has to be the one that ended up at a lawyers.

 

[Pasotech]

Windows 10 the miracle that is it can be plugged into most any laptop and it will boot. Infact as in this case, because the laptop had a bios key it even activated itself so there was no indication it was a fresh install. Lucky Us

When it comes to lawsuits anything goes. You might not have been technically liable, in terms of violating a specific statute. But that's irrelevant. When it comes to copying data one check I always do is get the info on the source and destination folders, rick click >properties.

But something does not sound right. Unless the laptops were the same model booting to an OS should have failed when the drive was put into the second machine.

 

[Porthos]

But something does not sound right. Unless the laptops were the same model booting to an OS should have failed when the drive was put into the second machine.

Not Win 10. It will auto adjust drivers and boot. One of the advantages of the OS.

 

[Markverhyden]

Windows 10 the miracle that is it can be plugged into most any laptop and it will boot. Infact as in this case, because the laptop had a bios key it even activated itself so there was no indication it was a fresh install. Lucky Us

Not Win 10. It will auto adjust drivers and boot. One of the advantages of the OS.

Wow!!! I knew they were trying to make it easy but I'd not expected that easy.

 

[nerd2u]

Here's an idea stop working for cheap customers destroy all drives problem solved.

You either need new customers or new techs doesn't sound like any level of policy will help.

As someone who worked digital forensics for many years a **** up like this would see you fired on the spot.

Sent from my SM-G870W using Tapatalk

 

[GTP]

I'd lawyer up. it's about to get ugly...

Sent from my house, where no one is around, and I may take off my cloths and put on stockings and suspenders. If I wanted to. And not that I did or would. And not that I have a collection of stockings or suspenders or skirts or bras or panties or lipstick or anything like that… Ya'know what? Never mind what I just typed…just move on to the next post or get back to Pinterest or Snapchat or whatever the hell it was that you were doing before reading this hopeless abomination of a signature line. Thank you. Goodbye.

 

[HFultzjr]

One word.....................LAWYER!
Then review your policies and procedures to keep this and other things from happening.
Sounds like the key issue is COMMUNICATION and DOCUMENTATION.

 

[DataMedics]

I'd start by contacting Customer 1 back, explain the whole series of mistakes that lead to this, and just hope you can smooth things over before any legal action is started. That'd be your safest and least expensive bet. Maybe they'll be understanding and let you off the hook. But, the minute they threaten any legal action, time to lawyer up.

Given that all we do here is work with people's data, we actually carry $1Mil professional liability insurance for this sort of thing.

But, as others have mentioned, you've got to document and track everything. We use chain of custody even inside our office and the only time we drop the tracking is after a drive has been confirmed as wiped. So even drives we use as temporary clones of people's data stay in a bin with their job number on it until it's been wiped and verified.

And, if a drive is ever going to leave our office, such as if we sell a donor HDD to another lab, we re-verify that it was fully wiped before it goes to the shipping desk.

When we mail out people's recovered data, we only allow one box to be getting packaged at a time (to prevent wrong label going on the wrong box) and there must be two people verifying that the address matches the case number being put in the box.

Despite all of this, we had a similar scare a few years ago (fortunately it turned out to not have been our fault at all). The customer found a user account of a total stranger in their recovered data. However, we went back and checked and sure enough, there the data was on their original drive and encrypted with their password no less. Seems the laptop had either been a store return or a prior computer tech had accidentally copied some data to it then deleted it. We just happened to find it since we were recovering data.

 

[MichaelBits]

Ouch, that's going to leave a mark....


I do a few things differently that none of this could even of occurred.

First, we never use used HDD's for customers computers, all computers sold by us have a new hard drive, even low end "used" ones we didn't refurbish will get a new HDD.
Hard drives are cheap, no reason to risk installing a used drive instead of a new one.

Second, we store all customer hard drives for 3 months. This is a "just in case" factor. Such as, some data was missed in a transfer, we can pull the drive from storage and retrieve the missing data.

Lastly, once the 3 months is up, they are wiped and recycled.

 

[Archon Prime]

Yikes... you guys need to make sure you have all work documented for your machines, especially when you have multiple techs working on stuff.