short answer

The Privacy Commissioners Annual Report (2011) criticized Staples Business Depot for not

taking better steps to protect the privacy of customers who returned computers and USB hard drives. These returned items had undergone a wipe and restore process before resale, but the Privacy Commissions audit found that sensitive data, such as social insurance numbers and tax records, had not been erased in all cases. What should Staples Business Depot do to ensure better compliance with privacy legislation? Would it be sufficient, for example, to ask customers to sign a form saying that they have wiped the returned electronic clean?