Disposal (CPP-017)

Definition and scope

Disposal refers to the process of removing or decommissioning Information objects from a TDA when its preservation is no longer needed or possible, or the Object has fulfilled its short-term preservation requirements. The latter requires appraisal and scheduling, where institutions establish clear policies defining how long different types of Objects should be preserved. Disposal is usually triggered on AIP level.

Disposal can be triggered by the following reasons:

• The TDA no longer has a legal basis to retain data (e.g. there is no consent);
• The TDA has been requested to remove data (e.g. there is a legitimate take down request);
• The TDA has transferred data to another TDA and no longer needs to retain the data;
• The data is no longer usable by the designated community (e.g. because it has been corrupted or damaged and is beyond repair, or because quality assessment shows that it is no longer usable);
• The data is no longer being used by the designated community, there is no expectation of future use, and organisation policy requires it to be disposed of (e.g. to reduce operational costs);
• The retention period for data has expired and the data should be disposed of (e.g. to ensure regulatory or legislative compliance);
• The TDA has alternative versions of the data that allow the original to be disposed of (e.g. as a result of normalisation or migration, or because a depositor has provided a superior version);
• The funding bodies that support the TDA no longer require or fund retention of the data (e.g. because the data no longer has funding body requirements for it to be accessible);
• The TDA elects to dispose of data (e.g. to help ensure its long-term sustainability in economic or ecological terms).

The TDA must have a disposal policy, that in addition to the disposal of Objects or (derivative) Files includes related Technical and Descriptive metadata. This is especially important when the related Metadata contains sensitive or confidential information. The policy may state that all or most of the Metadata is retained, disposed, or something in between. However, at minimum, TDA must create and retain provenance Metadata about the disposal and provide (e.g. some “tombstone metadata” for keeping the PIDs resolvable).

The TDA must also consider the technical aspects of disposal, such as secure deletion methods that prevent data recovery, and the potential impact on related Objects that may reference the disposed items.

As the Objects can be copied and distributed across multiple storage systems and different storage media within a TDA, the complete physical removal of all copies might be complex and needs a timeframe. For instance, whereas a File is quick and easy to remove from a hard drive, it may be practically impossible to remove it from a magnetic tape. Thus, the actual disposal of copies of Files on tapes may occur only at the time when the tape is refreshed (i.e. the disposed File is then not included on the new tape). Therefore, the first step to do could be a “logical disposal” (i.e. preventing access to the Object, which gives time for the TDA to dispose of the physical copies). Sometimes this is referred to as “Deaccessioning” where Objects are removed from the collections that an organisation holds before the Objects are physically disposed of. The storage management information must be updated accordingly.

Disposal decisions must be made carefully, as recovering disposed Objects may be impossible after physical deletion has been performed. Thus, effective disposal requires clear policies, robust documentation, secure technical procedures, and ongoing monitoring. The disposal process must produce audit trails and other relevant documentation about the disposal. An organisation may choose to implement additional safeguards as part of the disposal process depending on the type of data they hold. For example, data may be moved to a ‘trash bin’ for a period of time before permanent deletion takes place, which can be used to provide a short-term recovery window to guard against unwanted deletion (accidental or deliberate). Request, review or approval processes may also be employed. For example to prevent permanent deletion of an Object without explicit and documented approval from a requisite number of staff members who are authorised to approve disposal.