R33-26-202. Disposal of State-Owned Surplus Electronic Data Devices

  (1) For the purpose of this rule, Electronic Data Device means an electronic device capable of downloading, storing or transferring State-owned data. Electronic Data Devices include:

  (a) Computers;

  (b) Tablets (iPad, Surface Pro, Google Nexus, Samsung Galaxy, etc.);

  (c) Smart phones;

  (d) Personal Digital Assistants (PDAs);

  (e) Digital copiers and multifunction printers;

  (f) Flash drives and other portable data storage devices; and

  (g) Other similar devices.

  (2) The State has determined that the security risk of a potential data breach resulting from the improper disposal or sale of an electronic data device, as defined in this rule, outweigh the potential revenue that may be received by the State from the sale of an electronic data device deemed surplus property. Therefore, the State has adopted this Administrative Rule regarding the proper disposal of State-owned surplus electronic data devices:

  (a) Each State agency shall ensure that all surplus State-owned electronic data devices are disposed of in accordance with the following procedures.

  (b) Surplus State-owned electronic devices defined under this Rule may not be sold or gifted via on-line auction or any other means.

  (i) An exception for directors and other State officials may be granted by the Director of the Division of Purchasing after receiving documentation from:

  (A) the Executive Director of the Department of Technology Services certifying that all connectivity to sensitive, confidential, protected, and classified State data has been removed from the State-owned electronic data device and that the State-owned electronic data device no longer has access to the State's network; and

  (B) the State Surplus Property agency regarding the market value of the State-owned electronic data device.

  (c) Surplus State-owned electronic data devices must be disposed of through the vendor under contract with the State, unless a separate contractual agreement has been entered into with the manufacturer or supplier of the device for proper destruction and disposal.

  (d) The Division of Purchasing shall enter into a contract with a vendor for the destruction and proper disposal of all State-owned surplus electronic data devices.

  (e) Proper disposal includes:

  (i) Recycling components and parts after the State-owned electronic data device has been destroyed to the point that State-owned data cannot be retrieved;

  (ii) Disposal in a landfill approved for electronic waste after the State-owned electronic data device has been destroyed to the point that State-owned data cannot be retrieved; or

  (iii) Resale by the contractor of computers, digital copiers and multifunction printers that have had the hard drive destroyed.

  (f) State agencies shall request assistance from the Department of Technology Services (DTS) to destroy the hard drives of computers and other State-owned surplus electronic data devices purchased through DTS prior to the agency transferring the devices to the vendor under contract with the State.

  (g) State agencies shall contact the vendor under contract with the State to destroy and properly dispose of all other State-owned surplus electronic data communication devices.

  (3) Subject to Subsections (1) and (2), except as it relates to a vehicle or federal surplus property items, the transfer of surplus property items from one state agency directly another does not require approval by the division, the director of the division, or any other person.