Washington IT Asset Disposition (ITAD), Data Destruction, and Electronics Recycling Compliance

Washington governs IT asset retirement through one of the most distinctive duty surfaces in the United States, anchored in the My Health My Data Act — the first state statute extending consumer-health-data protections beyond HIPAA, and a biometric identifier statute that operates independently of any breach event.

RCW 19.255.010 imposes reasonable security and breach notice, RCW 19.215.020 requires reasonable steps to render personal financial information, personal health information, and government identification numbers “unreadable or undecipherable” upon disposal with a per-individual private remedy up to $200, the My Health My Data Act at RCW 19.373 imposes affirmative-consent and security-practice duties on consumer health data with Consumer Protection Act treble damages up to $25,000, the Washington biometric identifier statute at RCW 19.375 layers consent-and-destruction duties, the Electronic Product Recycling Act at RCW 70A.500 operates the E-Cycle Washington manufacturer-takeback program, and the Department of Ecology dangerous-waste rules at WAC 173-303 cover commercial streams, layered over a federal baseline of HIPAA, the FTC Safeguards Rule, GLBA, FAR 52.204-21, and DFARS 252.204-7012.

The Enterprise Compliance Reference below delivers the executive briefing for IT Asset Disposition, secure data destruction, and certified electronics recycling in Washington; the sections that follow expand every statute, regulator, and penalty band with cited authority.

Washington Enterprise Compliance Reference

Washington Compliance Reality

In Washington, retiring a Retired Electronic Asset is governed by a layered duty surface: a statutory disposal duty that operates on the asset itself, a breach-notification statute that operates on whatever data is inside the asset at the moment of custody transfer, a consumer-health-data statute that extends beyond HIPAA, a biometric-identifier statute, and a manufacturer-takeback program for covered electronic products. Compliance is not satisfied by sending hardware to a recycler.

It is satisfied by a documented chain of custody under which sensitive personal information was rendered unreadable or undecipherable before custody transfer, the resulting electronic waste was diverted from landfill through certified channels, and the entire sequence is reconstructable from records on demand.

Washington and Federal Compliance Interaction

Washington’s technology (Microsoft, Amazon), healthcare, and Joint Base Lewis-McChord defense industries pull HIPAA, GLBA, the FTC Safeguards Rule, FACTA, FAR 52.204-21, DFARS 252.204-7012, and CMMC 2.0 over most in-state enterprises, with MHMDA and RCW § 19.255 layered on top. A regulated enterprise must satisfy the stricter of (1) state law including RCW 19.255 breach notice, RCW 19.215 disposal, RCW 19.373 consumer health data, and RCW 19.375 biometric identifier rules; (2) federal sector rules including the HIPAA Security Rule, the FTC Safeguards Rule, GLBA, FAR 52.204-21, and DFARS 252.204-7012; and (3) customer or prime-contract clauses that reference any of the above.

The audit defensibility of an IT Asset Disposition program depends on the ability to map each asset class and each data category to the operative duty band and produce evidence of compliance at each step.

Washington Preemption Matrix (Federal Floor vs. State Posture)

The preemption matrix below states, for each federal regime that touches enterprise IT asset disposition in Washington, whether Washington law is preempted by, equal to, or exceeds the federal floor, and where it exceeds, the specific stricter element.

NIST SP 800-171 Revision 3 (May 2024 final) is the operative federal CUI sanitization baseline for federal-contractor environments, and CMMC 2.0 (32 CFR Part 170, effective December 16, 2024) is the operative DoD contractor framework that enforces the NIST 800-171 control set through assessment-based compliance levels. Federal contractors operating in Washington must satisfy CMMC 2.0 in addition to Washington state law.

Washington Data Security, Privacy, and Disposal Obligations

Washington Notice of Risk Act and Personal-Information Breach Notification

Under RCW 19.255.010, any person or business that conducts business in Washington and owns or licenses unencrypted personal information must disclose any breach of the security of the system to affected Washington residents in the most expedient time possible and within 30 days after discovery. When the breach affects more than 500 Washington residents, electronic notice must also be provided to the Washington Attorney General within the same 30-day window. The notice content requirements are codified at RCW 19.255.040, including categories of personal information acquired, the time of the breach, and contact information for the major credit bureaus.

The parallel duty for state and local agencies is at RCW 42.56.590. Enforcement runs through the Consumer Protection Act (RCW 19.86) with civil penalties up to $7,500 per violation and private treble damages up to $25,000 plus attorneys’ fees under RCW 19.86.090.

RCW 19.215 Disposal of Personal Information

The Washington records-disposal duty at RCW 19.215.020 requires an entity to “take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information and personal identification numbers issued by government entities” when disposing of records. “Destroy personal information” is statutorily defined at RCW 19.215.010(2) as “shredding, erasing, or otherwise modifying personal information in records to make the personal information unreadable or undecipherable through any reasonable means.” The civil-penalty band is up to $200 per individual whose information was compromised, plus reasonable attorneys’ fees.

RCW 19.215.030 provides a federal-compliance safe harbor for entities operating in compliance with HIPAA, GLBA, or the FACTA Disposal Rule. A program that satisfies the safe harbor must still meet the outcome standard of rendering the information unreadable or undecipherable.

My Health My Data Act (D1 Statute Overlay)

The My Health My Data Act (RCW 19.373) took effect March 31, 2024 for regulated entities and June 30, 2024 for small businesses. The Act defines “consumer health data” broadly to cover any personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, extending the duty surface beyond what HIPAA covers. RCW 19.373.030 prohibits collecting or sharing consumer health data without affirmative consent for a specified purpose.

RCW 19.373.050 requires regulated entities to establish, implement, and maintain administrative, technical, and physical data-security practices appropriate to the volume and nature of the consumer health data processed. Enforcement is under the Consumer Protection Act (RCW 19.373.080), which authorizes private actions and Attorney General actions. The retirement of any hardware that has processed consumer health data must be reconstructable under the audit and security-practices duty.

RCW 19.375 Biometric Identifiers (D2 Statute Overlay)

The biometric-identifier chapter at RCW 19.375 defines “biometric identifier” as data generated from automatic measurements of an individual’s biological characteristics, including fingerprints, voiceprints, eye retinas, eye irises, and scans of hand or face geometry. RCW 19.375.020 prohibits enrolling a biometric identifier in a database for a commercial purpose without notice and consent, and restricts subsequent disclosure to third parties. Enforcement is under the Consumer Protection Act (RCW 19.375.030).

When biometric-template files are stored on a server or end-user device, the retirement of that asset is a regulated event under the chapter, and certified data destruction must reach those template files before custody transfer.

Washington Public-Sector IT Disposal Posture

Washington state agencies retire IT assets under Washington Technology Solutions (WaTech) policy. The operative controls include WaTech Security Policy SEC-04-02-S state-agency media sanitization and disposal; state surplus routed through Washington Department of Enterprise Services. Public-sector retirement requires permanent removal of data before transfer or surplus, documented chain of custody, records-retention-schedule alignment for any records-bearing media, and surplus-property routing through the state’s authorized disposal channel.

Private-sector enterprises that contract with the state, that operate in regulated public-sector adjacent industries (higher education, K-12, state-funded healthcare), or that subcontract to state agencies inherit these duties through contract flow-down. See Washington Technology Solutions (WaTech) policy guidance.

Washington Student User Privacy in Education Rights Act (SUPER Act) (Student-Data Privacy)

Washington’s student-data privacy statute at RCW 28A.604 regulates K-12 ed-tech operators that collect, store, or process covered student information. The statute imposes data-minimization, retention-limit, destruction-on-termination, and prohibition-on-secondary-use duties. School districts, charter schools, higher-education institutions in scope, and ed-tech service providers retiring devices that have held covered student records must verify data destruction under Washington’s outcome standard and retain the destruction certificate.

Data Destruction and Media Sanitization Expectations

The Washington disposal statute prescribes the outcome (unreadable or undecipherable) but is method-agnostic. The operative method baseline is NIST Special Publication 800-88 Revision 2 (operative September 26, 2025), which categorizes media sanitization as Clear (logical overwrite or device-resident factory reset), Purge (cryptographic erase, secure-erase command, or strong degaussing for legacy magnetic media), and Destroy (shredding, disintegration, pulverization, or incineration). Rev. 2 supersedes Rev. 1 as the operative federal civilian standard.

DoD 5220.22-M remains a historical three-pass overwrite reference; it is not the operative current standard for civilian or most enterprise audit contexts.

State agencies follow the WaTech Media Sanitization and Disposal Standard (SEC-04-02-S), which cross-references NIST 800-88 Clear / Purge / Destroy categories and requires documented procedures, accountability for media inventory, and proof of sanitization before disposal or reuse. The audit-defensible position for a regulated enterprise is alignment to NIST 800-88 Rev. 2 with method selection driven by media type, data sensitivity, and reuse intent.

Hard Drive Shredding

Washington-resident consumer-health data under MHMDA and PII under RCW 19.255 on fixed media must reach the NIST 800-88 Rev. 2 Destroy outcome through physical shredding before the chassis enters Washington’s RCW 70A.500 electronics-recycling EPR program. Hard drive shredding reduces magnetic and solid-state media to particles small enough that data reconstruction is forensically impossible, satisfying the RCW 19.215 outcome standard for personal financial and health information and government identification numbers.

Certified Data Wiping

Certified data wiping aligned to NIST 800-88 Clear or Purge is appropriate where the asset is being remarketed or redeployed and where the data sensitivity supports it. The certified-wipe outcome is verified per drive with a serialized record carrying the device identifier, the method, the operator, the date, and the verification result, which together feed the Certificate of Data Destruction.

Media Degaussing

Media degaussing is the appropriate Purge method for legacy magnetic media including tape, magnetic disk, and legacy enterprise storage. Solid-state media is not degaussable; for SSDs, NVMe drives, and modern flash media, the audit-defensible methods are cryptographic erase (Purge) or physical destruction (Destroy).

Certified Media Shredding

Certified media shredding covers non-drive media including optical disks, magnetic tape cartridges, USB drives, memory cards, smart cards, and any printed material containing personal information subject to RCW 19.215.020. The Certificate of Destruction is structured for direct delivery to a regulator, an internal auditor, or a customer counterparty without reformatting.

Washington E-Waste Recycling and Environmental Compliance

The Washington electronic-waste regime operates on two layers. The first is the Electronic Product Recycling Act (RCW 70A.500), which established the E-Cycle Washington manufacturer-takeback program. Covered electronic products include televisions, computers, monitors, laptops, tablets, e-readers, and portable DVD players. Manufacturers register with the Department of Ecology, pay registration fees, and participate through the standard plan operated by the Washington Materials Management & Financing Authority or through an approved independent plan. E-Cycle Washington is structured for residential and small-quantity-generator volumes; businesses with fewer than 50 employees may use the program for free. Larger enterprise streams route differently.

Enterprise / commercial equipment covered by the Washington e-waste program: NO. Washington E-Cycle Program (RCW 70A.500) is a manufacturer-funded consumer-takeback program scoped to households, small businesses under 50 employees, school districts, and small governments; enterprise bulk disposal must route through WAC 173-303 dangerous-waste channels. Washington is an EPA-authorized state administering its own RCRA Subtitle C hazardous-waste program through WAC 173-303; the state program operates at the federal floor unless explicitly more stringent.

The second layer is the Washington Dangerous Waste Regulations (WAC 173-303). Washington’s dangerous-waste program is broader than federal RCRA; the state designates additional waste streams as dangerous. Enterprise IT-asset retirement is treated under the generator-category framework: small quantity generators (SQGs, under 50 employees), medium quantity generators (MQGs), and large quantity generators (LQGs). The Interim Enforcement Policy for Conditional Exclusion for Electronic Wastes allows MQGs and LQGs to recycle e-waste without it counting toward generator category, provided the policy’s conditions are met. Cathode ray tubes are conditionally excluded under WAC 173-303-071(3)(oo).

Universal-waste streams are governed by WAC 173-303-573 (Standards for Universal Waste Management), which authorizes streamlined management of dangerous-waste batteries (including lithium-ion batteries common in laptops, mobile devices, and uninterruptible power supplies), mercury-containing equipment, and lamps. Universal waste does not count toward generator category and does not require a manifest, but accumulation is capped at one year on-site and the receiving facility must be authorized to accept universal waste.

The retirement of an enterprise IT-asset fleet typically generates both universal-waste streams (batteries, lamps) and dangerous-waste streams (CRT glass, circuit boards with leachable metals), which must be routed through certified electronics recycling with environmental disposition records and, where applicable, hazardous-waste manifests.

Regulated Asset Types and Enterprise Scenarios

Servers and Storage Arrays

Server hardware and enterprise storage arrays contain operating-system data, application data, log files, configuration files with credentials, and database content. Certified server recycling covers the full asset including drive bays, controller cards, and embedded firmware storage. Where servers handled protected health information, financial-account information, biometric-template files, or covered defense information, every drive in the chassis must be sanitized to the Destroy category under NIST 800-88 Rev. 2 before custody transfer.

End-User Computing Assets

Laptops, desktops, and workstations carry the largest concentration of personal information by volume because they are the primary processing surface for end-user data. Certified laptop recycling and certified computer recycling route through the same chain-of-custody framework as server hardware, with the additional consideration that end-user devices frequently contain locally cached credentials and authentication tokens that must be sanitized to NIST 800-88 Clear or Purge before remarketing or to Destroy before recycling.

Mobile Devices

Mobile phones and tablets present a distinct disposition profile. Internal storage is flash-based and not degaussable; cryptographic erase (Purge) or physical destruction (Destroy) are the audit-defensible methods. Certified cell phone recycling includes verified erase of internal flash and handling of embedded SIM and eSIM material containing subscriber identifiers.

Equipment Destruction and Product-Recall Scenarios

For non-data enterprise hardware including prototypes, defective products, and regulated equipment that must be irrevocably destroyed rather than recycled, secure equipment destruction covers the chain from custody pickup to verified destruction. Product-recall scenarios (regulatory recall, voluntary recall, customer-driven recall) are handled through product recall management. Defective product destruction applies where retained inventory must be destroyed to prevent gray-market distribution. Classified equipment destruction applies where the asset itself is regulated content, including DoD-marked hardware subject to DFARS or items subject to export control.

Enforcement, Penalties, and Audit Risk

Washington enforcement operates across the Attorney General, the Department of Ecology, and federal regulators with concurrent jurisdiction. The audit-reconstruction-of-events standard is operative: the regulator’s question is not “did you intend compliance” but “can you produce, on demand, the documentation that demonstrates compliance at each step of asset retirement, data destruction, and downstream recycling.”

State Enforcement Actions (Recent)

In January 2025, Attorney General Bob Ferguson filed a Consumer Protection Act lawsuit against T-Mobile in King County Superior Court alleging inadequate cybersecurity controls and inadequate breach notice. The breach affected 2,025,634 Washingtonians; 183,406 Washington consumers had Social Security numbers exposed. CPA penalty exposure runs up to $7,500 per violation under RCW 19.86.140 with per-resident counting.

In a prior matter that established the Washington enforcement template, the Premera Blue Cross consent decree resolved in 2019 produced a $10 million payment ($5.4M to Washington, $4.6M to a 29-state coalition) for failure to secure protected health information for 6.4 million Washingtonians. The consent decree mandated specific data-security controls, annual security-practices reviews, and ongoing reporting to the Washington Attorney General. The Premera framework remains the operative reference for what a Washington enforcement remedy looks like for a regulated-data breach.

Statutory Penalty Schedule

State Sectoral Regulators and Audit Authority

In addition to the Washington Attorney General and the Washington environmental agency, state-level sectoral regulators hold audit and inquiry authority over IT-asset-disposition-relevant controls within their regulated populations. The Washington Department of Financial Institutions examines banks and credit unions for GLBA-aligned information-security-program controls.

The Washington Office of the Insurance Commissioner examines insurance licensees for the written information security program required by the NAIC Insurance Data Security Act or state-equivalent. The Washington Department of Health examines healthcare entities for HIPAA Security Rule compliance.

The Washington Student Achievement Council oversees FERPA-overlapping records and student-data-privacy duties at state institutions of higher education. The Washington Utilities and Transportation Commission examines investor-owned utilities for customer-data-protection controls. Each sectoral regulator can issue document requests, on-site examinations, or consent orders that probe the chain-of-custody, sanitization-certificate, and environmental-disposition records produced during IT asset retirement.

Documentation, Chain of Custody, and Audit-Ready Proof

Washington Attorney General Consumer Protection enforcement under MHMDA (private right of action under the Consumer Protection Act, RCW 19.86) and RCW 19.255 (breach notification) is built from documentary evidence, and a Retired Electronic Asset without serialized destruction records is directly monetizable for plaintiffs and the state.

The packet has six components: a serialized asset inventory, a chain-of-custody log running from internal pickup to certified destruction, a Certificate of Data Destruction per device with method and verification, a Certificate of Recycling with environmental disposition, a hazardous-waste manifest where applicable, and the underlying contracted-service safeguard terms with the certified destruction provider.

RCW 19.215.020 provides a third-party-disposal safe harbor when the provider is in the business of disposal and complies with the outcome standard, but the safe harbor does not transfer the documentation duty back to the provider; the originating enterprise must retain the documentation packet.

How All Green Recycling Operationalizes Washington Compliance

IT Asset Disposition

All Green Recycling operates certified IT asset disposition structured around the Washington statutory duty surface. Asset pickup is scheduled with a documented chain of custody, secured transport through IT equipment packaging and transportation, certified data destruction or sanitization at the receiving facility, environmental disposition, and audit-ready reporting. Where remarketing is in scope, asset remarketing recovers residual value while preserving the data-destruction chain of custody.

Secure Data Destruction

All Green Recycling’s secure data destruction service line is structured to satisfy the RCW 19.215 outcome standard and align to NIST SP 800-88 Rev. 2. Method selection is driven by media type and data sensitivity, with documented verification per device and a serialized Certificate of Destruction.

Certified Electronics Recycling

Certified electronics recycling diverts retired electronic assets from landfill through downstream channels that satisfy WAC 173-303 dangerous-waste rules and the WAC 173-303-573 universal-waste rule for batteries, lamps, and mercury-containing equipment. R2v3, NAID AAA, and e-Stewards frameworks are used as reference frameworks for downstream-handler accountability; environmental disposition records are produced per engagement.

Secure Equipment Destruction

For regulated hardware that must be destroyed rather than recycled, secure equipment destruction covers product-recall management, defective-product destruction, and classified-equipment destruction. The chain-of-custody record is structured for direct delivery to a regulator, an OEM, or a prime contractor.

Reverse Logistics and Chain-of-Custody Tracking

Reverse logistics covers multi-site enterprise pickups, manufacturer return programs, and customer-driven returns where the asset must be tracked from origin to disposition with serialized records at each handover.

Audit-Ready Reporting

Every engagement produces a uniform documentation package delivered through IT asset reporting: serialized asset list, chain-of-custody log, Certificate of Data Destruction, Certificate of Recycling, environmental disposition record, hazardous-waste manifest where applicable, and HIPAA / GLBA / FTC Safeguards documentation entries where the federal overlay applies. The documentation package is structured for direct delivery to compliance, legal, audit, and regulator teams without reformatting.

Frequently Asked Questions

The questions below are the questions enterprise compliance, security, audit, and procurement leaders ask during vendor evaluations, RFP reviews, and breach-response planning when a Retired Electronic Asset is moving through IT Asset Disposition in Washington. Answers are statute-anchored, declaration-first, and scoped to the operational decisions a Chief Compliance Officer, Chief Information Security Officer, IT Director, in-house counsel, or procurement lead actually makes.

Washington Compliance as Risk Management

Washington IT asset retirement is a layered risk-management discipline, not a recycling transaction. Compliant retirement is the ability to prove, under scrutiny, that data was rendered unreadable or indecipherable before custody transfer, that regulated records were disposed of in accordance with state law, and that downstream processing did not create environmental liability.

Consumer Protection Act civil penalties, MHMDA per-violation exposure, RCW 19.215 per-record exposure, RCW 19.375 biometric exposure, Department of Ecology enforcement on dangerous-waste and improper recycling, HIPAA and FTC Safeguards Rule overlays, and audit-driven counterparty review converge on the same set of records: serialized destruction logs, chain-of-custody continuity, environmental disposition evidence, hazardous-waste manifests where applicable, and contracted-service safeguard terms. Enterprises that operationalize that record set carry defensible compliance posture across regulator inquiry, audit cycle, and incident response.

Washington compliance is best treated as a continuous control posture rather than a periodic disposal event. All Green Recycling, LLC operationalizes that posture through IT asset disposition, secure data destruction, certified electronics recycling, secure equipment destruction, reverse logistics, and audit-ready reporting. Compliance, security, and procurement teams that need a Washington-specific audit walkthrough or an RFP-ready compliance package reach the All Green Recycling response desk at (800) 780-0347.