As the doors to the basement were unlocked, I was amazed not only by the size of the edifice underneath prime London real estate, but more so by the sheer volume of dusty redundant IT equipment. This was a major investment bank relocating to Canary Wharf and the brief to the team was "get rid of everything in here".

It was the late 90s when IT budgets were vast, and manufacturers tweaked performance and design in equal measure to trigger refresh rates, which mean that hardware giants ruled the IT world. The attitude towards redundant equipment was lax, to say the least, mainly as the focus was on the production environment and keeping up with change. Internally, no one really considered what happened to old equipment as a genuine business process and, much like emptying the bins, we knew someone took our stuff away, but what happened to it was unknown and certainly not verified.

90s TECHNOLOGY PICTURE
Over the next decade into the 'Noughties', while regulatory requirements increased, attitudes to redundant equipment generally did not improve. The Waste Electrical and Electronic Equipment Directive was introduced in 2003 and the Data Protection Act in 1998, and, while both should have motivated businesses to consider how they deal with redundant equipment in more detail, the increasing need to protect the production environment meant that focus and budget were needed elsewhere.

At this stage, an industry began to emerge that facilitated the removal of electrical 'waste', often using 'WEEE Compliance' as justification for their role. For those in the genuine waste industry, this was just another waste stream, but for those in technology they saw growing demand from the emerging economies for equipment and saw opportunity to rehome redundant equipment overseas.

At face value, this was a healthy industry, based on the premise of acquiring and, in many instances, exporting old equipment to find a new life, ideally in a data centre or on a desk; but sadly, without the right controls in place, some ended in landfill.

An environment where the customer was unaware of the risks and the industry was able to operate freely is attractive and, with few barriers to entry, the ITAD (IT Asset Disposal or Disposition) market space flourished, based on offers to buy and sell redundant equipment, doing 'something' to the data and recycling anything they couldn't sell. All of this, to a customer base which still didn't really see their redundant equipment as anything other than an inconvenience and were not motivated to take control.

As we entered the second decade, independent studies from both the ICO and the University of South Wales found swathes of personal and corporate data across large samples of equipment offered for resale. The seminal article from Peter Warren, titled 'Ghosts in the Machine', described how he found data relating to one of The Beatles on an old hard drive at a street market. It made a great headline in a national newspaper and, rightly so, brought focus from many businesses worried that it could be them in the next headline.

The ITAD industry was quickly maturing and some excellent innovative companies were leading the way, including developers of data sanitisation products. However, it was over-congested, hugely competitive, and full of companies making the same type of claims. Who to trust with your data was a difficult decision for many companies to make without genuine due diligence being undertaken, which led to fear and concerns and encouraged a 'destroy' approach to old equipment.

It was this business problem that ADISA sought to solve when launching in 2010 via the introduction of a certification scheme, which was aimed at ITADs and assessed the controls which they put in place to deal with risk permeating the disposal process.

Over the last decade, industry maturity, longevity and a greater professionalism have seen what was viewed by many as a clandestine process raise its profile to be a necessary, but, all too often, undervalued service industry. The narrative for this industry does not stop here and, in a complex, changing business environment, ITAD has far more value to offer than before.

ITAD AS A VALUE-ADD PROCESS
We've all experienced some 'once in a lifetime' challenges across society, from Brexit through to COVID, and the greatest of all: climate change.

Throughout these challenging environments, the previously undervalued ITAD process has consistently shown value, from the supply of refurbished technology for home workers through to helping bridge the digital divide from donations into schemes like 'Digital Access for All'. And this while protecting customer data from risks that the customer may not even have been aware.

Today, the ITAD sector is a professional value-add industry, but organisations releasing assets are still not fully in control. We see a lack of due diligence, a complex downstream supply chain and a lack of understanding of what standards should be applied or followed. The reason for this is still very much the same: as threats increase and become more sophisticated, the protection of the production environment requires even more focus, set against an increasingly heavy compliance burden, leaving ITAD low down the 'to-do' list.

There is some good news. After three years of work, ADISA Standard 8.0 has officially been approved as a UK GDPR Certification Scheme, meaning that those in the sector who are certified can verify compliance to the law as confirmed by the regulator themselves.

WHY IS THIS IMPORTANT?
Technology is evolving and how to deal securely with risk to the physical asset and sanitise media is more complex now than ever before. If businesses are to maximise the potential of redundant equipment, the very minimum is that they should be assured that their data is being processed in a compliant and secure manner.

The work carried out by UKAS and the ICO to accredit ADISA and Standard 8.0 addresses the compliance question, which leaves the professional ITAD sector free to add the significant value that it offers to promote sustainability by extending the product lifecycle before recycling material for recovery and reuse.