Why destroy documentation?

Whether it's strictly confidential documentation that you want to ensure doesn't fall into the wrong hands, archival material that has exceeded its legal retention period, or paper documentation accumulated during your business operations, the safest, and often simplest, way is to destroy it. Besides ensuring that there will be no data leaks or violations of the GDPR and other laws on personal and confidential data, freeing up space and saving time are just some of the benefits.

How to choose a company to destroy your paper documentation?

When you've decided to entrust document destruction to professionals, it's important to choose a company that you can be confident will do the job satisfactorily, putting the security of your data and documentation first.

When selecting a company to destroy your documentation, be sure to check the following:

Does the company hold a valid Waste Management Permit?
Does the company hold valid ISO 9001 and ISO 27001 security certificates for document destruction?
Does the company offer you the option to supervise the destruction of your documentation?
Does the company issue a Waste Accompanying Document (WAD) when collecting your documentation?
Does the company issue a Destruction Certificate compliant with the requirements of the Croatian State Archives after the destruction is completed?

Paper document destruction is a new and rapidly growing industry in this region, and many companies present themselves as specialists in this activity even though they lack the basic permits and certificates required to carry it out.

Since the GDPR has been in force for years and has been implemented quite successfully in the operations of most companies, it is important to keep in mind that (under the provisions of the GDPR) it is no longer enough to simply obtain a written confirmation that the documentation has been destroyed. You must actually make sure that the destruction has been carried out, that the company you hired for the destruction holds the permits and certificates listed above, and only then that you have been issued a valid Destruction Certificate for your documentation.

Only then have you destroyed your documentation in a correct and secure manner!

Now that we have explained why documentation needs to be destroyed and how to choose a company to carry out this service, it is important to set the most important guiding principle when choosing a company to destroy your documentation:

A company that provides the collection and destruction of paper documentation and archival material MUST hold a valid Waste Management Permit, and it is extremely important that it also holds valid ISO 9001 and ISO 27001 security certificates for document destruction.

ISO 9001 (PDF) ISO 27001 (PDF)

For those who want to know more

Below you will find a more detailed explanation from legal experts that supports the advice and guidance above.

Introduction

When it comes to the collection, secure destruction and disposal of paper documentation, the regulatory framework that must be taken into account when choosing the company to which this service is entrusted should be considered in more detail.

It is particularly important to distinguish between two interrelated phases:

the management of material which, at the moment it is discarded by the Controller, constitutes waste, to which the applicable waste management regulations apply
the confidentiality and protection of the content of the documentation until the moment of its destruction, including the protection of personal and other confidential data

Waste management

1.1. Generation of waste and waste management

According to Article 3, paragraph 1, point 48 of the Waste Management Act (Official Gazette 84/21, 142/23) (hereinafter: the Act), waste is any substance or object which the holder discards, intends to discard or is required to discard. Confidential documentation is therefore considered waste within the meaning of the Act from the moment the holder decides that the documentation will no longer be used and has designated it for destruction or handed it over for destruction.

Furthermore, Article 21 of the Act provides as follows:

(1) The producer of waste and the holder of waste shall ensure the treatment of waste by preparation for re-use, recycling or recovery in accordance with Articles 5 and 6 of this Act, and where this is not possible, shall ensure the disposal of waste in a safe manner in accordance with Article 5 of this Act.

(2) The producer of waste and the holder of waste shall fulfil the obligation referred to in paragraph 1 of this Article by treating their own waste themselves, by entrusting the treatment of waste to a person permitted to treat waste in accordance with this Act, or by shipping the waste out of the Republic of Croatia for recovery or disposal in accordance with Regulation (EC) No 1013/2006.

Waste recovery operations under Annex II include:

R 12 Exchange of waste for submission to any of the operations numbered R 1 to R 11

(If there is no other R code appropriate, this can include preliminary operations prior to recovery including pre-processing such as dismantling, sorting, crushing, compacting, pelletising, drying, shredding, conditioning, repackaging, separating, blending or mixing prior to submission to any of the operations numbered R1 to R11)

R 13 Storage of waste pending any of the operations numbered R 1 to R 12 (excluding temporary storage, pending collection, on the site where the waste is produced)

The secure destruction of documentation and documentary material is therefore not only a matter of physically destroying the documents, but also includes handling them appropriately as waste, in accordance with waste management regulations.

1.2. Contractor authorisations

Under Article 27 of the Act, a legal person or a natural person engaged in a trade is authorised to take possession of a shipment of waste only if they hold a waste management permit, operate a recycling yard, are entered in the Register of persons performing waste management activities as a waste collector or recoverer without a permit or as a waste dealer who may take possession of waste, are permitted to take possession of certain waste by a regulation governing special categories of waste, are a user of sewage sludge in agriculture and thereby authorised to take a shipment of sewage sludge in accordance with the ordinance governing the use of sludge in agriculture, or operate a cemetery or crematorium and are thereby authorised to take a shipment of pathological waste in accordance with the ordinance governing medical waste management.

In addition, under paragraph 2 of the same Article, a person entered in the Records as a waste carrier is not, by virtue of that entry alone, considered authorised to take possession of a shipment of waste.

Furthermore, Article 29, paragraph 1 of the Act provides that a legal person may start and carry out waste recovery and disposal activities only after obtaining a waste management permit for the activity for which the permit is issued.

Under Article 30 of the Act, the waste management permit specifies:

the person permitted to carry out waste recovery or disposal activities
the waste management location
the types and quantities of waste in accordance with the Waste Catalogue
the waste management activity and operation with the associated technological processes
the manner in which the waste management operation is carried out, including the technical and all other essential conditions for work at the location for each individual operation
safety and preventive measures
monitoring and management measures
the obligation to handle waste generated or remaining after the waste management operation is carried out
the period of validity of the waste management permit
measures after closure or cessation of the operations for which the permit was issued, including the removal of all waste from the waste management location

Accordingly, when contracting a confidential document destruction service, it is not enough to establish that the contractor formally provides a document destruction service. It must be verified that the contractor, in accordance with the applicable waste management regulations, is authorised to take possession of the documentation in question and that its authorisation covers the specific type of waste and the specific waste management operations it will apply when collecting and/or recovering it.

1.3. The Waste Accompanying Document as a mandatory element of waste shipment traceability

Article 24, paragraph 1 of the Act provides that a holder of waste handing over a shipment of waste must hand over to the person taking over the waste, together with the shipment, a completed written or electronic Waste Accompanying Document (WAD) containing information on the waste and on the persons involved in managing that waste.

Article 24, paragraph 3 states that the person transporting the waste must carry a completed and certified accompanying document with the shipment, and paragraph 4 provides that certification of the accompanying document in the e-ONTO system constitutes confirmation of the handover or takeover of the waste shipment.

In addition, the Ordinance on Waste Management regulates the content of the accompanying document, which under Article 7 contains information on the waste shipment, the waste stream, the sender, the carrier, the recipient, the broker or dealer and the final waste processor.

Furthermore, Article 8 of the Ordinance prescribes the information on the participants' authorisations to take possession of waste, transport it, or act as brokers or dealers in waste management.

Therefore, when contracting a document destruction service, full documentary traceability of the waste must be ensured throughout the entire process.

Confidentiality and protection of the content of documentation

When selecting a Processor for the destruction of documentary material and other paper documentation that contains or may contain personal data, it is important to ensure that both the Controller and the selected Processor operate in accordance with the applicable regulations of the Republic of Croatia and the European Union, in particular the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR).

Under Article 28(1) of the GDPR, the Controller may entrust the processing of personal data only to a Processor providing sufficient guarantees to implement appropriate technical and organisational measures that ensure lawful processing and the protection of the rights of data subjects. At the same time, Article 32 of the GDPR sets out the obligation to implement appropriate security measures to protect personal data throughout the entire processing, ultimately including their destruction.

The Croatian Personal Data Protection Agency (AZOP) states the following on its official website:

The General Regulation allows the controller to entrust the processor with carrying out only certain precisely agreed tasks on behalf of and for the account of the controller. The mutual rights and obligations between the controller and the processor must be regulated in detail by a contract or other legal act (Article 28 of the General Regulation).

We emphasise that the processor must guarantee the protection and confidentiality of the processing of personal data and implement appropriate protective measures in order to ensure, and be able to demonstrate, that the processing is carried out in accordance with the General Regulation.
Source: azop.hr

Particularly relevant to this situation is Recital 146 of the GDPR, which emphasises the principle of full and effective compensation for damage and a broad interpretation of the liability of the Controller and the Processor, which is also laid down in Article 82, which states the following:

(…)

2. Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

(…)

4. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.

(…)

It follows from these provisions that liability for the lawfulness of the processing of personal data is not limited to the Processor alone; the Controller is also liable for damage resulting from the selection of a Processor that does not operate in accordance with the conditions prescribed by law or does not act in accordance with the provisions of the GDPR.

Subcontractors

We particularly emphasise that the authorisation to handle waste cannot be viewed solely as an attribute of one company involved in the entire waste management chain.

Article 24, paragraph 5 of the Waste Management Act provides that the sender, the recipient and, where applicable, the broker must exchange all information needed to complete the Waste Accompanying Document, including information on the authorisation to take over the waste, the method of waste treatment and the destination for waste treatment. Furthermore, Article 21, paragraph 2 of the Act provides that waste treatment is entrusted to a person who is permitted to treat waste under the Act.

Accordingly, every entity that actually performs a regulated activity in the specific waste management chain must be checked, and it must be established whether an appropriate legal authorisation exists for that activity.

For example, if the contractor:

takes over the documentation,
organises or carries out its transport,
carries out the destruction of the documentation,
takes over the waste generated after destruction,
stores the resulting waste,
hands it over to another processor, or
organises its further recovery

then for each individual phase it must be established who actually performs the activity in question and on the basis of which legal authorisation, permit or other appropriate registration they perform it.

It is therefore not sufficient to state that “the subcontractor holds a valid Waste Management Permit” if the contracted contractor itself performs an activity for which, under the Act, an appropriate authorisation is required. In the case of a company that directly provides the collection, transport and destruction of paper documentation, it must therefore be established that the company itself meets all legal requirements and holds the appropriate authorisation for the activities it actually performs, regardless of having engaged a subcontractor for certain phases of the process.

We particularly emphasise that the permit or other authorisation of one company cannot automatically be considered the authorisation of another company, nor is it transferred to it simply by contracting or engaging a subcontractor.

If the controller contracts a specific service with company A, and company A directly takes possession of the waste or performs a specific waste treatment activity, it must be checked whether company A itself is authorised for that specific activity under the Waste Management Act. It is not sufficient to check the authorisation of company B, to which company A may later hand over the waste generated after treatment.

The Waste Management Act distinguishes between different roles and entities involved in waste management, including the waste holder, the waste carrier, the broker and the persons who treat waste, with different conditions and forms of authorisation prescribed for individual activities.

We particularly emphasise that entry in the Records of waste carriers under Article 47 of the Waste Management Act does not in itself constitute authorisation to take possession of waste. The Act expressly provides that a person entered in the Records as a waste carrier is not, on the basis of that entry, considered authorised to take possession of a shipment of waste.

Accordingly, when engaging a subcontractor, its legal status and the scope of its authorisation must be checked specifically in relation to the activity it will actually perform, rather than merely establishing the existence of a general entry in the relevant records or a permit that relates to another person, another activity or another waste management operation.

From the perspective of personal data protection, an additional question of compliance with the applicable data protection regulations arises when the company entrusted with the documentation for its collection, transport, destruction or other processing engages another company.

Article 28(1) of the GDPR provides that the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR and ensures the protection of the rights of the data subject. Furthermore, Article 28(2) of the GDPR expressly provides that the processor shall not engage another processor without prior specific or general written authorisation of the controller.

Where another processor is engaged, Article 28(4) of the GDPR provides that the same data protection obligations as set out in the contract or other legal act between the controller and the first processor must be imposed on that other processor by way of a contract or other legal act. This includes the obligation to implement appropriate technical and organisational measures to protect personal data.

Accordingly, with confidential documentation containing personal data, particular care must be taken that processing is entrusted only to entities providing appropriate guarantees for the protection of personal data, and that additional sub-processors are engaged in accordance with the conditions laid down in Article 28 of the GDPR.

Therefore, from the perspective of control over processing and protection of the confidentiality of documentation, it is justified to limit the involvement of additional subcontractors to cases where their engagement is necessary to perform the contracted service. If a subcontractor is nevertheless engaged, its role and the scope of the processing activities must be clearly defined in advance, the controller's authorisation must be obtained where required, and it must be checked whether the subcontractor meets the appropriate organisational, technical, security and regulatory conditions for performing the specific activity.

Conclusion and recommendations

The legal framework for waste management is based primarily on the appropriate permits, registrations and other prescribed authorisations.

Certificates such as:

ISO 9001: quality management system,
ISO/IEC 27001: information security management system,

can be very important evidence of the service provider's organisation and security, and may be required by a contract, a tender or the controller's internal rules, but they should not be presented as a universal legal substitute for a waste management permit.

In other words, a certificate cannot replace a legal permit or authorisation where one is required for a specific activity involving waste.

4.1. Recommendation to the controller

To reduce regulatory, security and reputational risk, the following should be requested from the contractor before contracting the service:

proof of the company's registration and identity,
proof of an appropriate waste management permit,
a check of the types of waste and the operations covered by the permit,
a sample or template of the Waste Accompanying Document,
a sample Annex VII form with information on the final waste processor,
contractual provisions on confidentiality and personal data protection,
appropriate evidence of the security of the entire process,
appropriate evidence of the level of destruction according to the European standard DIN 66399,
where needed, management system and information security certificates

In our view, when contracting a paper document destruction service, it is not enough to establish only that the contractor has a paper shredding machine or that it hands over the paper for recycling after destruction.

The entire legal framework and the operational chain of handling must be checked.

When destroying confidential documentation, the most important thing for the controller is to ensure the traceability, lawfulness and control of the entire process, not just the physical act of destroying the documentation.

Regulatory framework for document destruction