Holiday Legal Data Destruction Guide

Why Holiday Law Practices Can't Treat Old Drives as Scrap

If you run a practice in Holiday, you already guard client files like they're your own. Then the office laptop gets replaced, the leased copier goes back to the dealer, and a drive holding years of privileged material leaves with a shipping label on it. Sound familiar?

That's the gap this guide closes. Holiday is a census-designated place along U.S. Highway 19, right at the Pinellas County line, and it has no city government of its own. County services come through Pasco County. Small offices often don't have a dedicated IT department, and that's usually where disposal habits slip.

Healthcare is the biggest commercial sector in the area, with AdventHealth North Pinellas, Morton Plant North Bay Hospital, and HCA Florida Trinity Hospital all serving West Pasco and the Pinellas border. If your clients include providers, patients, or families working through medical claims, your drives may hold health details next to legal ones. That's a reason to be careful, not a reason to panic.

Who this guide is for

Solo practitioners, small firms, in house counsel at Holiday area businesses, and the office managers who actually handle the hardware. Here's what's ahead: what Florida ethics guidance expects, how to match a destruction method to the media, how to document custody, what to do when something slips, and a vendor checklist you can use today.

A quick note: this guide is educational, not legal advice. For questions about your specific duties, talk with your own ethics counsel or The Florida Bar.

What the Florida Bar Expects When Devices Leave Your Office

Opinion 10-2 in plain English

The Florida Bar's Professional Ethics Committee tackled this head on in Ethics Opinion 10-2. It's an advisory opinion, so it isn't binding. It's still the clearest picture we have of how the Bar thinks about disposal. The anchor is Rule 4-1.6, the confidentiality rule: if a device can store client information, you need reasonable steps to protect that information until the device is sanitized.

And "device" covers more than you'd guess. The opinion names computers, printers, copiers, scanners, cellular phones, flash drives, memory sticks, and fax machines. That leased copier in your front office? It counts.

What this means for a solo or small practice

You don't need an enterprise security program to meet the spirit of Opinion 10-2. You need a short written policy, a device list, and one person who owns disposal. Keep it to a page. If a paralegal or office manager handles it, write their name on the page.

The goal isn't paperwork for its own sake. It's making sure the answer to "who wiped that copier?" is never "I assumed someone did."

Confidentiality reaches the people around you

The duty doesn't stop with the lawyer. Staff, contractors, and vendors who touch your equipment are part of the chain, which is why Opinion 10-2 pairs confidentiality with supervision of nonlawyers.

If your IT help is a friend of the firm who stops by on weekends, put your disposal expectations in writing for them too. A short email counts, as long as it names the devices and says what happens to them.

Clear, Purge, or Destroy: Matching the Method to the Media

NIST Special Publication 800-88 Rev. 2, published in September 2025, is the reference most vendors and auditors point to. It replaced the 2014 Rev. 1. One thing to say plainly: it's a guideline, not a certification, so be skeptical of any "NIST certified" claim you run into.

Rev. 2 moves the focus from device by device recipes to running a media sanitization program. For the actual techniques, it points readers to current standards such as IEEE 2883, so your policy should name the standard you're following rather than just saying "wiped."

Three methods, three jobs

Why deleting a file isn't destroying it

When you delete a file or reformat a drive, the data often stays put until something overwrites it. The Bar's opinion makes the same point about copiers: a scanned document is stored on the machine's drive, and it usually remains there until it's overwritten or deleted.

That's why "we emptied the recycle bin" won't satisfy a reasonable steps standard, and why a documented method matters.

When a drive can't be wiped

Some drives fail before anyone gets a chance to wipe them. On others, parts of the storage sit out of reach of wiping software. When a drive is dead, damaged, or unreadable, wiping isn't an option, and destruction is the clean answer.

Older backup media belongs in this conversation too. Tapes and external drives in a desk drawer count as storage media, so list them during your inventory and treat them like everything else.

Questions to answer before you choose

• Will the device be reused inside your firm, or leave your control?
• What's the media: spinning drive, solid state drive, phone, or tape?
• Is the data encrypted, and who holds the keys?
• Do you need a serial number record for each device?

Building a Chain of Custody You Can Defend

Chain of custody sounds formal, but it's really a paper trail that answers four questions: what was the device, who had it, where did it go, and what happened to it?

Start with a one page device inventory

Open a spreadsheet and list every device that could hold client data: laptops, desktops, servers, external drives, copiers, scanners, phones, and tablets. For each one, note the make, serial number, who uses it, and where client data lives on it. Update the list when you buy or retire anything.

That list is also the first thing a vendor needs to quote your job, so it saves time on pickup day.

What a useful record includes

Serial numbers, asset tags, the date and time of pickup, who handled the equipment, the method used, and a signed certificate of destruction. That last piece matters most when someone asks questions months later. A certificate that says "ten hard drives" proves far less than one that lists ten serial numbers.

That's why serialized documentation, like the certificates of destruction STS provides for Holiday businesses, is worth asking for.

Supervision isn't optional

Opinion 10-2 speaks to supervising nonlawyers, and in a small office that usually means an office manager or an outside vendor. Your policy should say who checks the work and who signs off. For leased copiers, the opinion points toward getting the vendor's agreement to sanitize the device when it's sold or turned back.

Store the paperwork with your other firm records, so you can find it fast if a client or the Bar ever asks. How long you keep it should follow your firm's retention policy, and your counsel can confirm the right window for your practice.

When Something Slips: Florida's 30 Day Clock

Say a drive goes missing, or a copier shows up at a resale shop with files still on it. Now what? Florida's Information Protection Act, section 501.171 of the Florida Statutes, sets the clock.

Notice to affected individuals is due as expeditiously as practicable, and no later than 30 days after a breach is determined, with limited extensions. A breach affecting 500 or more people in Florida also means notice to the Department of Legal Affairs. Whether the statute reaches your situation is a question for your counsel.

What to document right away

If you suspect a problem, write down what you know while it's fresh: which device, when it left your control, who handled it, and what data it may have held. Keep every piece of vendor paperwork.

Resist the urge to guess in writing about what was exposed. Early guesses have a way of being wrong. Get the facts down, then call counsel.

Build your response plan before you need it

Write down who gets called first, who talks to clients, and who contacts counsel. Keep the device inventory and your certificates somewhere you can reach quickly, including off site.

A plan you've read once beats a plan you're writing at 9 p.m. on the day you learn about a problem. Walk through it with your staff once a year, even if it only takes fifteen minutes.

Choosing a Destruction Partner Serving Holiday

Plenty of vendors will haul away old equipment. Fewer can show you what happened to it. STS Electronic Recycling serves Holiday from our 200,000 sq ft facility, and our data destruction for Holiday law firms is built around chain-of-custody documentation, so your records hold up when someone asks for them.

Whatever vendor you pick, put these questions to them in writing.

• Can they show serialized documentation for every drive, phone, and copier they handle?
• Do they name the NIST SP 800-88 Rev. 2 method (Clear, Purge, or Destroy) used on each device?
• Will they show a current R2v3 certificate and its scope, plus a current NAID AAA certificate for destruction work, and tell you which facility holds each?
• Who handles your equipment between your door and final destruction?
• Is there a written confidentiality agreement, and will they sign a certificate you can file?

What to have ready on pickup day

Bring your device inventory, a named point of contact, and your own labeling scheme. Decide ahead of time whether anything needs to be kept, such as a drive tied to a pending matter or a litigation hold.

Once a device is destroyed, that decision can't be reversed. Check with the attorney handling the matter before anything goes on the truck.

On site or off site

Some firms like to watch a drive being destroyed. Others prefer a locked pickup and serialized paperwork. Both can work. What matters is that the method fits your risk tolerance and that someone you trust verifies the result.

Ask your vendor which options they offer, such as witnessed destruction at your office, and what documentation comes with each. If you'd like to see how we support the legal sector more broadly, our page on electronics recycling and IT asset disposition for law firms explains the process.