By the nature of their work, many state agencies create and maintain data on the public whose privacy must be protected. There are several laws enacted to ensure this protection. Principal among them are the Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes-Oxley Act, both of which apply to state government operations.

Just as an entity would not send a file cabinet full of records to another entity for disposal, neither must electronic records leave an entity’s control. Agencies must ensure they are in full compliance with Georgia's Enterprise IT Policies, Standards, and Guidelines on electronic media disposal, information risk management, and others.

Electronics contain heavy metals as well as other components that are known to be hazardous. Consequently, electronic components that are not in commerce (i.e. a CPU being sold as a CPU) are subject to environmental disposal regulations. 

All electronic components that have been designated as scrap must be transferred to the an authorized disposal site for destruction. Under no circumstance should state entities dispose of electronic components as refuse (trash, landfills, etc.) or by any other means than a DOAS-contracted supplier.

Only the entity head or the senior IT official – such as Chief Information Officer (CIO) – may certify that all data and programs have been removed from electronic equipment that will leave the entity’s control for purposes other than destruction. Surplus will maintain the authorization as part of the entity’s eligibility file.

Electronic devices are not suited for the Retail/Fixed Price Sale method. Cellular devices, laptops, tablets, and other electronic devices must be disposed of through other methods.

1. Custodian entity enters the Transaction Request in Asset Works, selects ELC under the Method.
2. Entity manager approves transaction.
3. Surplus “receives” the request.
   1. Transfer to another state entity:
      1. Agencies may transfer equipment to other state entities without removing the data storage devices.
      2. All data must be removed from any storage device.
      3. Transfer requests in Asset works must be approved by the entity head or CIO. This approval is the entities’ certification that all data has been removed. Other documents from the entity head or CIO authorizing the transaction may be attached to Transaction Request.
      4. All entity asset identification tags must be removed prior to transfer.
   2. Direct Negotiated Sale (DNS): Agencies may request a DNS of electronic equipment to authorized surplus donees (municipal government and eligible nonprofit entities).
      1. All data storage devices must be removed prior to transfer and must be sent to the authorized supplier for final disposition
      2. The state will not release electronic equipment that contains a data storage device to these customers.
      3. DNS requests in Asset works must be approved by the entity head or CIO. This approval is the entities’ certification that all data has been removed. Other documents from the entity head or CIO authorizing the transaction may be attached to Transaction Request.
      4. These devices must be transferred to the Surplus authorized disposal site for destruction.
      5. All entity asset identification tags must be removed prior to transfer.
   3. Vendor Return:
      1. Many procurement contracts for electronic equipment include an option for vendor disposal of the item at the end of life cycle as part of the acquisition cost. These agreements assist state agencies in identifying and managing total cost of ownership of these assets.
      2. Requests for disposal authorization under these agreements will be classified as a Vendor Return as outlined by the GA Procurement Manual and authorized by Surplus.
      3. Agencies are required to ensure that all data has been removed from storage devices and asset identification tags have been removed prior to its return.
   4. Public Sales:
      1. Electronic equipment may be sold to the public; however, all data storage devices must be removed prior to transfer.
         1. The state will not under any circumstance release electronic equipment that contains a data storage device to the public.
      2. Public sales requests in Asset works must be approved by the entity head or CIO. This approval is the entities’ certification that all data has been removed. Other documents from the entity head or CIO authorizing the transaction may be attached to Transaction Request.
      3. All entity asset identification tags must be removed prior to transfer.
      4. Additionally, this equipment may not be cannibalized other than removal of the hard drive(s). Items must be listed completely (full description) and accurately to the piece. Like items must be consolidated.
   5. Destruction (ELC/AD):
      1. Agencies may designate electronic equipment as scrap and request destruction authorization. Transaction request must show the actual piece count for the property by item description.
      2. Data storage devices and identification tags need not be removed for destruction; however, this material must be sent directly to or picked up by the Surplus vendor for destruction.
      3. All data storage devices that have been removed must be sent to the authorized vendor for final disposal.
      4. Affidavit of Disposal is not required if ELC # is provided.

Surplus has an agency contract for the disposal of all electronic equipment. The contract requires that all disposals conform to US Environmental Protection Agency (EPA) regulations and that all data storage devices are destroyed in a way data is unrecoverable. Essentially, all electronics are de-manufactured (shredded) to their base components (plastic, metal, glass, etc.) that are then recycled. Use of the DOAS contract is mandatory.

Entities may choose to deliver their electronics to the supplier or have them picked up.

Under the current agreement, the supplier will pick up all e-scrap with a minimum of 10 pieces (CPU, monitor, printer, keyboard, copier). Entities are not required to remove hard drives if this option is selected. Pick-up will occur within 15 business days from the date the entity is contacted by the supplier.

Entities may choose to deliver electronics to the supplier’s location at their own expense. All disposals must still be pre-authorized by Surplus and appointed with the supplier. Whether picked up or delivered, there is no charge to the entity. Contact Surplus for supplier location and directions.