P2021-ND-087

Two employees stored documentation intended for shredding in bins that were marked “for shredding” which were mistaken for recycling by the building custodian. On January 29, 2019, the building custodian disposed of the documentation in the building’s outside recycling bin, which is not secured. Each bin contained approximately 20-30 pages. The contents of the documentation was not inventoried but is believed to be draft correspondence that may have included personally identifying Information. The breach was discovered on January 30, 2019 when staff members noticed their shredding bin was missing when they came to work the following day and notified the facilities manager.