Q&A: You Should Shred That

International Fraud Awareness Week is officially upon us. To mark the occasion, Shred-it commissioned a survey to gauge the American consumer’s ability to protect their personally identifiable information and properly respond when identity thieves strike.

The results were not encouraging. Analysts found consumers are keenly aware of the scourge of information fraud and identity theft — and tend not to trust dealerships and other businesses to protect them — but their own bad habits are failing to keep them safe. To learn what dealers can do to attain and maintain a high level of compliance and educate car buyers, Auto Dealer Today reached out to Ann Nickolas, vice president of national accounts at Shred-it.

ADT: Dealerships produce a massive amount of paper filled with highly valuable information. In your experience, are dealers getting better about securing those documents?

Nickolas: Car dealerships handle enormous amounts of confidential customer information on a daily basis, from driver’s license numbers to insurance papers to Social Security numbers and more. Because of this, dealerships have become attractive targets for information thieves, with identity theft tied to auto loans and leases increasing 43% in the last year.

The conversation around how to adequately protect customer information needs to be continuous. Although dealerships are getting better about securing sensitive information, there are always ways to improve data protection. This means that employee training must go beyond the initial onboarding phase and, instead, employees both old and new should be continuously reminded of the privacy and data risks and how to safely handle themselves and the documents they manage regularly.

ADT: Do you recommend dealers come up with a process for securing and destroying paper that includes strict time intervals?

Nickolas: It’s critical to establish a process and timeline that all employees within the dealership can follow when it comes to the handling, storage, and disposal of physical documents. Doing so eliminates the guessing game and ensures that all staff are on the same page regarding safety and security expectations.

Implementing a “shred it all” policy, in which all workplace documents are securely disposed of and destroyed when they are no longer needed, is the best way to reduce uncertainty and error. Further, putting a document management process in place will help employees determine the appropriate lifespan for documents and thus, when they are expected to shred and dispose of them.

ADT: Should dealers endeavor to digitize and destroy their paper deal jackets the moment they’re closed? If not, how long should they hold onto them?

Nickolas: Physical records do not need to be immediately digitized and destroyed so long as they’re properly stored when being saved. Documents that dealerships wish to keep for their records must be securely locked away in filing cabinets and shielded from visual or physical access. Documents that they wish to discard, however, must be completely shredded before being thrown away. This applies to both physical documents and devices like cellphones, laptops, and hard drives. For example, if your device-disposal process includes erasing, reformatting, wiping, or degaussing, you are still vulnerable. As long as documents and devices are still intact when thrown out, all private information can be retrieved. Only physical destruction is 100% effective.

ADT: Shred-it’s study indicated consumers tend not to trust businesses to protect their data, but most are not doing a great job themselves. Considering the level of awareness about ID theft is at an all-time high, how can we account for this disconnect?

Nickolas: It’s equally important to educate consumers on data security best practices as it is to raise awareness among businesses. In order to bridge the knowledge gap, conversations around data security need to be continuous. Consumers and businesses alike need to be mindful of how they handle both their physical and digital information.

More than half of consumers, for example, admit to reusing passwords and PINs across multiple accounts. Furthermore, nearly 30% of consumers admit to storing paper documents containing sensitive, personal information in a box, desk drawer, or unlocked cabinet at home or work. In short, it’s clear that the need to raise awareness among consumers around how to securely handle their personal information is widely needed.

At the same time, consumers still expect businesses to protect their data and are becoming less willing to forgive those who fail to do so. Despite the disconnect, businesses have an obligation to strengthen their security policies to ensure customer information is protected.

However, it is still important for both consumers and businesses to consider how they’re storing and discarding sensitive information both at home and at work — keeping in mind that items as seemingly innocent as paper receipts could put important information at risk of theft if not handled properly. When it comes to digital protection, making an effort to vary passwords across personal and business accounts and profiles or being cautious of phishing emails and potential scams is equally critical.

ADT: Would you recommend dealers take it upon themselves to offer advice to customers about protecting one’s data or outline the steps the dealership will take to protect the customer’s data, perhaps during the financing process?

Nickolas: It’s certainly important that dealerships instill confidence in their customers when it comes to how they intend to handle their personal information. This means dealerships should be fully transparent regarding their document retention processes and the internal security policies they uphold to protect customer information.

It’s important for dealerships to prove their commitment to data security through maintaining a clean and organized workspace as well. A cluttered space signals disorganization and sloppy business practices to potential customers, which could be very damaging to sales. Keeping your dealership organized is critical to improving business reputation and attracting — and maintaining — customers.

When dealerships prove and communicate these habits and best practices to consumers, they’ll not only help them understand how their information will be protected, but how they themselves can apply those same tactics when managing their personal documents and accounts.