MPAA Data Destruction: Maintaining Compliance After Project Delivery

Part 5 of 5: In this series, we’re exploring how to maintain compliance with the MPAA Content Security Best Practices during the decommissioning process. Part Five takes a deeper look into the MPAA Data Destruction process. To begin the series, MPAA Content Security: Media Destruction provided an overview of the guidelines and their impact on your entertainment industry business.

[cherry_hr height=”2″ color=”#cecece”]

Whether you operate a post-production creative agency or you’re working directly for a major studio, the proper handling of proprietary information is essential. The entertainment industry continues to struggle against the growing demand for leaked footage, spoilers, and content – and improperly destroying digital assets after you’re done working with them puts your project, your reputation, and your company at risk.

To aid in the battle against stolen data, the Motion Picture Association of America, Inc. (MPAA) established the MPAA Content Security Best Practices. As a major element of their guidelines for securing physical and digital assets, they outline the importance of professional and certified data destruction.

The Background: Understanding Certified Data Destruction

We often think of data breaches resulting from malware and viruses, but sensitive information is at a significantly increased risk of theft when hard drives and storage devices are no longer being used. For example, when you’ve delivered the final product and your team moves on to new projects, it’s easy to lose track of who is accessing the drives that stored the studio’s proprietary assets. Certified hard drive destruction mitigates your liability.

There are different options for data destruction, but the most secure form is shredding the drive. Just as shredding sensitive paperwork eliminates the risk of it falling into the wrong hands, hard drive shredding ensures the data is unrecoverable.

Step 4: Standards for MPAA Data Destruction

According to their Best Practices, MPAA-compliant content disposal involves several essential steps, including:

1. Damaging, overwriting, or sanitizing hard drives that are ready for decommissioning (Step 1)
2. Securely storing those drives prior to certified hard drive destruction (Step 2)
3. Maintaining an asset disposal log for 12+ months (Step 3)

Step 4 emphasizes the importance of using certain data destruction processes to ensure the security of digital assets.

Section PS 16.3 of the MPAA Content Security Best Practices

Destruction must be performed on-site. On-site destruction must be supervised and signed off by two company personnel. If a third-party destruction company is engaged, destruction must be supervised and signed off by two company personnel and certificates of destruction must be retained.

PS 16.3 is arguably the most important step in your project wrap-up routine because your post-production studio remains fully liable for your clients’ assets. There are two key elements to PS 16.3: on-site destruction and certificates of destruction.

A reputable MPAA Data Destruction Firm will protect your chain-of-custody by performing their services at your location – allowing you to witness and verify that the information has been completely destroyed prior to leaving your property.

It will also provide complete and detailed documentation (aka Certificate of Destruction), including serial numbers/descriptions for each drive, dates of destruction, method of destruction, and the name of the individual who performed the shredding.

Are You Prepared for a Post-Project Audit?

When working with a major film studio, such as NBCUniversal or Paramount Pictures, you need to be prepared for a post-project audit – to ensure compliance with MPAA Content Security Best Practices or with the studio-specific requirements.

At E-Waste Security, we support countless entertainment industry clients with their MPAA-compliance needs. As a NAID-Certified Vendor, we put your digital security first by providing certified, on-site hard drive destruction and IT asset disposition services throughout the greater Los Angeles and Las Vegas areas.