Difficulty: Hard

Average Score: 47%

A customer requests that a cloud provider physically destroys any drives storing their personal data. What must the provider do with the drives?

Rationale

The provider should destroy the drives only if dedicated hardware disposal is specified in the contract.

Physical destruction of drives containing personal data must adhere to the terms outlined in the customer's contract. If the contract specifies dedicated hardware disposal, the provider is obligated to carry out the destruction; otherwise, they may not be legally required to do so.

A (It should use cryptographic erasure to securely remove any personal data from the drives.) YOUR ANSWER

Cryptographic erasure involves encrypting data on the drives and then deleting the encryption keys, rendering the data inaccessible. However, this method does not involve physical destruction of the drives and may not meet the specific request for physical destruction of the hardware, thus failing to fulfill the customer's requirement.

B (It should use degaussing tools to securely remove any personal data from the drives.) YOUR ANSWER

Degaussing is a method that disrupts the magnetic fields on magnetic storage devices, effectively erasing data. While degaussing can securely erase information, it does not physically destroy the drives. Therefore, it does not comply with the customer's request for physical destruction of the drives.

D (It should destroy them only if the contract includes hardware disposal insurance.) YOUR ANSWER

While hardware disposal insurance may offer financial protection for the disposal process, it is not a prerequisite for the destruction of drives. The requirement for destruction should be based on the contract's specific terms regarding hardware disposal, not on the presence of insurance.

Conclusion

In order to comply with customer requests for the physical destruction of drives, cloud providers must follow the stipulations outlined in the contract. Only if the contract explicitly states dedicated hardware disposal will the provider be obligated to destroy the drives. This understanding is essential for both legal compliance and maintaining customer trust in data protection practices.

Related Questions

View all