Clearwater Education IT Disposal Guide: FERPA, Florida Law, and Retired Campus Hardware
Why Clearwater Campuses Can't Treat Old Hardware Like Surplus Furniture
If you're an IT director at the St. Petersburg College Clearwater campus, Keiser University's Clearwater campus, or Pinellas Technical College, you know how fast a refresh cycle piles up. Lab laptops rotate out. A registrar's workstation gets replaced. Someone finally clears the server closet. Every machine holds a drive, and it may hold transcripts, financial aid files, and disciplinary records.
Here's what catches people off guard: the data doesn't leave when the power cord does. A drive pulled from a retired desktop can be read by whoever ends up holding it. So the real question is whether you can show, a year from now, where each device went and what happened to its data.
What counts as a data-bearing device
Education IT disposal means securely retiring campus computers, drives, servers, and copiers, with data destruction, chain of custody tracking, and paperwork that shows student records never left your control. The list is longer than most budgets assume: phones, tablets, bookstore point-of-sale terminals, and security camera recorders all belong in the plan.
STS Electronic Recycling provides secure IT asset disposition for Clearwater colleges across Pinellas County, including Keiser University, Pinellas Technical College, and St. Petersburg College's Clearwater campus (about 14,000 students). We serve Clearwater from our 250,000 sq ft facility, and our Clearwater e-waste recycling program includes free pickup for qualifying business volumes.
What Does FERPA Actually Say About Disposal?
FERPA doesn't name a disposal method, but it does hold schools responsible for protecting student records, including the ones sitting on retired devices. The law covers personally identifiable information in education records at schools that receive federal funding. Once a student turns 18, or enrolls in college at any age, those rights belong to the student.
Where FERPA draws the line
What FERPA covers
Transcripts, grades, disciplinary files, financial aid details, and identifiers like names, addresses, and Social Security numbers, when they sit in education records. If a retired device holds any of that, it falls under the law's privacy protections.
What FERPA leaves open
The law doesn't name a destruction method. Nothing in it says "shred" or "wipe" or "degauss." Schools are expected to use reasonable methods to protect the data, and they're expected to be able to explain their choice.
According to the U.S. Department of Education's Privacy Technical Assistance Center, "FERPA is silent on specific technical requirements governing data destruction". Its best practices guide points readers toward NIST SP 800-88 for media sanitization.
The exposure isn't a missing rule
It's an improper disclosure. If a drive leaves your control with student records still readable, that can count as releasing personal information without consent. FERPA enforcement runs through funding, since the Department can withhold payments under its programs. Your documentation is your best protection.
When a vendor handles your devices
The Department's guidance also covers records, or the devices holding them, that move to an outside party. When a school shares personal information from education records under an applicable exception, it's expected to keep direct control over how that party maintains and uses the data, including its eventual destruction. In plain terms, your vendor works under your rules.
That's why a written scope matters. Spell out what gets collected, how it's tracked, how the data is destroyed, and what proof you'll receive. A vendor who resists putting that in writing is telling you something.
Florida and Federal Rules That Sit Next to FERPA
FERPA is rarely the only rule on your desk. Three others tend to come up, and your counsel should confirm which ones apply to you.
Florida's disposal requirement
Under the Florida Information Protection Act, section 501.171 of the Florida Statutes, covered entities, governmental entities, and their vendors must take reasonable measures to dispose of customer records containing personal information. The point is to leave that information unreadable. Whether your institution is treated as public or private under the statute is a question for your general counsel.
Financial aid data and GLBA
Schools that take part in Title IV federal student aid are generally treated as financial institutions under the FTC Safeguards Rule. That rule calls for secure disposal of customer information no later than two years after it was last used, with exceptions for legitimate business needs and legal retention requirements. A retired financial aid workstation is squarely in scope.
Retention comes first
Before anything gets destroyed, check it against your retention schedule. Your records officer owns that answer. Destroy too early and you have a records problem. Hold too long and you have an exposure problem, and IBM's 2025 Cost of a Data Breach Report puts the average U.S. breach at $10.22 million.
Clearwater's college sector, including Keiser University, Pinellas Technical College, and St. Petersburg College's Clearwater campus, needs secure, fully documented IT disposal. None of these rules ask for perfection, only reasonable methods you can show on paper. That's easier with one documented process instead of ten departments doing it their own way.
How a Campus Refresh Cycle Should Actually Run
STS work with colleges typically schedules pickups around academic calendars, with serial-level paperwork for every batch. The schools that handle this well treat disposal as a scheduled process with owners, dates, and paper trails.
Build it around the academic calendar
When should a campus run a lab refresh? In the gaps: summer, winter break, and the quiet weeks between terms. Finals week pickups fight for loading docks and staff attention, and things get skipped. Public colleges typically run retired equipment through formal surplus approval, often at board level, so build in that lead time.
Tag, scan, then release
STS Electronic Recycling documents every retired device by serial number from pickup to final processing, and drives that need destruction follow NIST SP 800-88 guidance. Tag each asset before it leaves your building, and that list becomes the backbone of your audit file when a reviewer asks where a device went.
A scenario we hear often: a department clears a storage room over spring break and boxes up twenty old desktops. Nobody logs serial numbers. Months later, someone asks where one machine went, and the answer is a shrug.
Plan for more than one building
Campuses rarely have one loading dock, and our secure fleet serves Clearwater and Pinellas County with scheduled pickups along US 19, Gulf to Bay Boulevard, and McMullen Booth Road. Equipment sits in classrooms, labs, administrative offices, and storage rooms across several buildings.
Decide who consolidates it, where it's staged, and who signs for it. A locked staging room with a sign-in sheet beats a hallway of boxes.
Sanitize, destroy, or both
NIST 800-88 sorts media sanitization into three levels. Clear overwrites the data with standard tools. Purge uses stronger methods, such as cryptographic erase, so recovery isn't feasible even with lab techniques. Destroy physically wrecks the media so it can't store data again. Which level fits depends on the device and where it's going next.
A laptop headed for a student loaner pool may only need a verified wipe. A failed drive that can't be wiped, or a drive that held financial aid records, is often a candidate for shredding. Match the method to the risk, and write down the decision.
What Devices Do Campuses Forget to Wipe?
The devices that cause trouble are the ones nobody counts as computers. Here's the short list worth sweeping for:
- Multifunction printers and copiers with internal hard drives
- Lab imaging servers and classroom media carts
- Loaner laptops and tablets returned by students
- USB drives and external disks in front office drawers
- Network switches and access points that store configuration data
For drives that need to be destroyed, not just erased, our Clearwater data destruction service follows NIST 800-88 guidance and produces a documented record for each job.
How Do You Choose a Disposal Partner in Clearwater?
Choose a Clearwater IT disposal partner that documents chain of custody, reports by serial number, and shows how each drive was destroyed. STS Electronic Recycling provides all three for colleges. Price matters, but a cheap pickup with no paperwork leaves you holding the risk. Here's what we'd ask any vendor before handing over retired campus equipment.
- Can they document chain of custody from your loading dock to final processing?
- Will you receive a certificate of destruction that lists serial numbers, not just a pallet count?
- Do they show the sanitization method used for each drive, and does it follow NIST 800-88?
- Do they name their downstream processors? R2v3 requires downstream tracking of materials, so ask for the current certificate and its scope.
- For data destruction, can they show a current third party certificate and say which locations it covers?
- Can they work around your calendar and handle several buildings in one pickup?
Those questions apply to any provider, including us. If you want to see how a program built for Clearwater and Pinellas County colleges is laid out, start with our Clearwater education IT disposal program, and see the broader school and university electronics recycling and ITAD overview for how we work with campuses across the country.
If you donate or resell
What about donating laptops? Plenty of colleges send working ones back to students and the community, a good use of equipment as long as the data is gone first. Require a documented wipe for every device, keep the report, and send anything that fails verification to destruction.
Writing it into the bid
Wondering how this works at a public college? IT disposition often runs through procurement. Put your documentation requirements in the bid itself: itemized serial number reporting, a named method for each data-bearing device, and chain of custody from pickup to final processing. Then you're not negotiating them after the trucks have left.
What Happens After the Pickup?
After pickup, you should hold paperwork that answers an auditor's first question: where did each device go?
What a solid audit file holds
A signed chain of custody log, an asset report with serial numbers, a certificate of destruction for every data-bearing device, and a note of the method used. Store it with your records, and keep it for as long as your retention schedule says.
College IT directors typically expect serial-level certificates of destruction for audit reviews, which is why every job should end with one. That file lets you show reasonable methods under FERPA, and it makes the next refresh cycle faster.
Where to start this month
You don't need a full program to make progress. Walk the storage rooms and count what's sitting there. Name one office to own IT asset disposition. Then pick the next academic break as your first scheduled pickup.
Searching for IT equipment recycling near Clearwater? STS serves colleges across Pinellas County, from Dunedin and Largo to Safety Harbor. Write down what paperwork you need back, then call 470-226-5361.
Quick answers
How long should we keep disposal records?
Your retention schedule decides. Ask your records officer where disposal documentation falls, and put the answer in writing.
Do we need to destroy a drive that's already been wiped?
Not always. A verified wipe that follows NIST 800-88 can be enough when the device is being reused. Drives that fail verification, or that held your most sensitive records, are better destroyed.
Who should own disposal on campus?
One office. IT usually runs it, with the business office and the records officer signing off. Split ownership is how devices go missing.
Where Your Equipment Is Processed
STS Electronic Recycling, Inc. is headquartered in Jacksonville, Texas, and has served schools, businesses, healthcare systems, and government agencies across all 50 states since 2011.
Equipment collected in Clearwater is staged locally and transported to one of our two R2v3 certified processing facilities in Jacksonville, Texas and Houston, Texas, where all data destruction and material recovery takes place.
Ready to Plan Your Education IT Disposal?
STS Electronic Recycling provides secure, chain-of-custody electronics recycling services for Clearwater schools and colleges. Ask about a free pickup and talk through your next refresh cycle.
