When storage media are deleted or destroyed by external service providers, the information on them could be exposed if there is not sufficient regulation on how the external service provider is integrated into the process of deletion and destruction.

For example, attackers could steal storage media from inadequately secured collection points or gain access to residual information if a service provider does not delete or destroy the storage media with a sufficient level of security.