🛡️ Add data disposal workflows

[JFWooten4]

Creates disposal procedures for Regulation S-P compliance under 17 CFR § 248.30(b). The procedures should define how BlockTransfer properly disposes of consumer information and customer information, including paper records, electronic records, storage media, devices, backups, exports, and vendor-managed systems.

Recordkeeping implementation is out of scope for this PR and should be handled separately under the transfer-agent recordkeeping issue.

Regulatory basis

Subsection (b)(1): disposal standard

Every covered institution, other than notice-registered broker-dealers, must properly dispose of consumer information and customer information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.

Subsection (b)(2): written disposal policies and procedures

Every covered institution, other than notice-registered broker-dealers, must adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information according to the standard identified in paragraph (b)(1) of this section.

Subsection (b)(3): relation to other laws

Nothing in this paragraph (b) shall be construed:

a. To require any covered institution to maintain or destroy any record pertaining to an individual that is not imposed under other law; or

b. To alter or affect any requirement imposed under any other provision of law to maintain or destroy records.

Subsection (d)(7): disposal

Disposal means:

a. The discarding or abandonment of consumer information or customer information; or

b. The sale, donation, or transfer of any medium, including computer equipment, on which consumer information or customer information is stored.

Subsection (d)(1): consumer information

Consumer information means:

a. Any record about an individual, whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report, or a compilation of such records, that a covered institution maintains or otherwise possesses for a business purpose regardless of whether such information pertains to:

a. Individuals with whom the covered institution has a customer relationship; or

b. To the customers of other financial institutions where such information has been provided to the covered institution.

b. Consumer information does not include information that does not identify individuals, such as aggregate information or blind data.

Subsection (d)(5)(ii): transfer-agent customer information

With respect to a transfer agent registered with the Commission or another ARA, customer information means any record containing nonpublic personal information as defined in § 248.3(t) identified with any natural person, who is a securityholder of an issuer for which the transfer agent acts or has acted as transfer agent, that is in the possession of a transfer agent or that is handled or maintained by the transfer agent or on its behalf, regardless of whether such information pertains to individuals with whom the transfer agent has a customer relationship, or pertains to the customers of other financial institutions and has been provided to the transfer agent.

Changes to be made

• Create written disposal procedures for consumer information and customer information.
• Define covered disposal events, including discarding, abandoning, selling, donating, or transferring any medium that stores consumer information or customer information.
• Define disposal procedures for paper records, electronic files, cloud storage, backups, exports, devices, drives, and other storage media.
• Require reasonable measures to protect against unauthorized access to or use of information during disposal.
• Define when disposal must be performed internally v. through an approved service provider.
• Add service-provider disposal requirements for vendors that handle customer information or consumer information.
• Cross-reference any separate record-retention requirements so disposal does not override records that must be preserved under other law.
• Cross-reference the separate safeguards, service-provider oversight, vendor contract review, and transfer-agent recordkeeping workstreams.

[JFWooten4]

Migrate safeguarding policies from https://github.com/blocktransfer/website/tree/7e4bfab2aa54922352b7e64e587617db4bf6b5eb/compliance