Garbage presents a special problem for accounting firms. Discarded workpapers, rough drafts, obsolete files, and computer printouts may contain confidential and compromising information that would be damaging to a client if they fell into the wrong hands. The firm may also be damaged by allowing it to happen. Rubbish could be a treasure trove for competitors, business associates and, of course, the government. This problem has been exacerbated by the proliferation of personal computers and copiers in every office.

Trash-Can Law

Once these materials reach the trash bin they become part of the public domain, accessible to anyone who wishes to look and remove items of interest. The law is fairly well settled: Proprietary interests in documents cease when they are thrown out. For example, these abandoned materials may be seized by the government without the procurement of a warrant.

The legal issues that arise regarding the disposal of garbage involve the invasion of privacy rights, implicitly protected by the U.S. Constitution's Fourth Amendment. However, as established through a series of cases, these rights extend only to proprietary interests. Once papers and effects leave a person's possession, such rights no longer survive. Courts have consistently held that the right to privacy does not extend to abandoned items, such as documents placed in trash bins, or to information that is not securely maintained.

In U.S. v. Dunkel, a dentist, who was ultimately charged with tax evasion, disposed of financial records in a dumpster located off the parking lot of his office. An IRS informant searched the dumpster, wading through worn out teeth and discarded needles in order to find incriminating evidence. The U.S. Court of Appeals for the Seventh Circuit held that, although the dumpster was located on private property and within the curtilage (according to Webster's--fenced-in ground and buildings immediately surrounding a house or dwelling) of the dentist's office, the fact that it was shared with other tenants and accessible to the public obviated any reasonable expectation of privacy. The court ruled that the warrantless search and seizure orchestrated by the IRS was permissible.

In recent years, courts have had many opportunities to examine the legal status of garbage. The decisive factor in most of these cases appears to be the reasonable expectation of privacy. In 1988, the U.S. Supreme Court debated privacy rights for garbage left on the curbside in opaque plastic bags (California v. Greenwood). The court ruled that garbage left outside the curtilage of the home may be searched and seized without a warrant.

The Supreme Court's decision has been fine tuned by subsequent Court of Appeals' decisions, acknowledging that while garbage remained within the curtilage of the home, at the time of the search there was no reasonable expectation of privacy therein, and the material was subject to warrantless search and seizure for Fourth Amendment purposes.

The implication from the court cases is that client papers placed in ordinary garbage receptacles are subject to unauthorized disclosure. Not only can government agencies explore the depths of trash cans, but the same principles apply to non-government entities. The risk of disposing of client workpapers and obsolete records by traditional methods is that confidential or sensitive information may fall into the wrong hands.

The Exposed Accountant

As in most fiduciary relationships, there must be a strong element of trust between CPA and client. In order for a CPA to best serve the interests of a client, the client must be candid and truthful in disclosing information and providing the CPA with relevant yet confidential documentation. From the client's perspective, the CPA is liable for the confidentiality of all information, and that information will not be disclosed to the authorities or other third parties without the client's consent.

Pursuant to the AICPA Code of Ethics, Rule 301, "a member shall not disclose any client information without the specific consent of the client." There are a limited number of specific exceptions to this rule. These include a court ordered subpoena or summons, peer review requirements, or the need to respond to investigative inquiries of disciplinary bodies. This discrete list of exceptions to the confidentiality rule does not pertain to the inadvertent disclosure of information that could result from careless garbage disposal.

At the very least, a CPA would be very embarrassed if information regarding a client was obtained through a search of garbage. There may not only be a loss of face but also a loss of client and reputation. In addition, a client may also be able to hold the CPA legally liable for damages. Furthermore, there are ethical and professional implications for the seeming breach of a professional ethical standard.

Although there are a number of cases discussing CPA/client confidentiality, most have involved purposeful disclosure or lack thereof due to conflicts of interest. None involve inadvertent disclosure of client information. Nevertheless, liability for such a disclosure is implicit in the language of Rule 301.

It is apparent that there is no safe harbor for a CPA whose client's confidential information falls into the wrong hands. Unauthorized access to documents, records and workpapers could result in a quagmire of lawsuits and disciplinary hearings for the unwary practitioner. In order to avoid such liability, accounting firms should adopt precautionary and defensive tactics to minimize public access to private papers.

Is a Paper Shredder Vital Equipment for a Practice?

In an effort to determine how significant the problem is, a survey was conducted in 1992 to investigate actual procedures at accounting firms. In addition to measuring the scope of the problem, the survey sought to identify vulnerable practices so that remedial measures could be recommended.

The survey instrument, developed by the authors of this article, was mailed to a random selection of 250 small to medium-sized accounting firms throughout the U.S. About 30% responded in a short time, indicating their interest in this problem.

Analysis of the data revealed that responding firms were aware of issues concerning their handling of client files, correspondence, and tax returns. Many had adopted specific procedures to safeguard the confidentiality of client materials, particularly the destruction of obsolete documents. Eighty-five percent of the respondents reported that obsolete records were either incinerated, shredded, torn into pieces, or commercially destroyed. Only 15% disclosed that obsolete records were discarded in the nearest garbage receptacle.

Less diligence was demonstrated regarding the storage of current client files or the destruction of rough drafts and work papers. Almost 39% of the respondents revealed that client files were returned to unlocked cabinets at the end of the work day. Twenty-one percent of the respondents indicated that rough drafts of client financials, projections, and tax returns were discarded into ordinary trash receptacles. However, 35% of the firms did report that such drafts were routinely shredded or commercially destroyed, and just over seven percent made it a practice to tear the documents into pieces before disposal. In response to a question inquiring whether procedures had been adopted for the safeguarding of computerized information, a surprising 70% answered "no."

Client confidentiality cannot be accomplished without the adoption and implementation of formal procedures and control mechanisms to assure compliance. The survey indicated that only 60% of the responding firms required support staff to sign confidentiality agreements or had established mechanisms to verify compliance with procedures.

Firms performing a higher proportion of audits seemed more stringent in their practices. Firms that reported tax practice as their largest component generally had more individual clients and appeared not to be as meticulous in handling their client materials. They were less likely to tear up materials before disposal or to keep records as securely as predominantly audit firms.

Breaking the Habit

A bifurcated approach is essential to meet the challenge of maintaining confidentiality. Firms must address these issues from an organizational perspective, while individuals within each firms must be sensitive to their practices on an ongoing basis. The two points of view must be complimentary in order for any program to succeed.

The following suggestions could be implemented organizationally in order to minimize liability for inadvertent disclose of client information:

1. All accountants and support personnel with access to client information should be required to sign nondisclosure agreements. The purpose is not only to impose liability for improper breach of confidentiality but also to sensitize all personnel to the issue of confidentiality.

2. Formal procedures should be adopted for disposing of obsolete files. Depending on the size of the firm, it may be advisable to have one person responsible for all such dispositions. Some options available include incineration and shredding inhouse or destruction through an outside vendor whose reliability and integrity have been assured.

3. Client materials should be stored in locked cabinets or desks at the end of the day rather than left exposed to unauthorized persons. Access to files should be limited.

4. Mechanisms for the destruction of appropriate documents should be established. Paper shredders might be positioned in strategic places throughout the office. At the very least, employees should be instructed that all client-related documents slated for destruction must be effectively destroyed before being discarded. Extremely sensitive material, after being torn, could be distributed into multiple trash receptacles. Special attention should be paid to the duplication areas and word processing centers that process large quantities of paper.

5. Firms should recognize that adequate safeguards and procedures need to be developed to secure computerized data. Mere erasure of files does not necessarily prevent retrieval by motivated, unauthorized persons.

6. It is not sufficient to mandate procedures; compliance verification is essential for the system to work. Periodic internal reviews to assure consistency and diligence should be utilized. Occasional end-of-day spot checks of desks, cabinets and trash containers is advisable.

7. For Earns subject to formal quality control and peer reviews, it may be appropriate to add some pertinent questions to the various checklists.

In addition to the foregoing recommendations, individuals within an organization should consider the following additional suggestions:

1. Take care not to inadvertently breach confidentiality through the discussion of client affairs in public places, such as elevators, restrooms, and crowded restaurants.

2. When meeting with clients, be certain that other client information isn't accessible, either through telephone conversations or files left on the desk.

3. Each new technological development presents new challenges. For example, when sending sensitive information via fax, the sender should be assured that not only is the fax number correct but also that there is someone authorized to receive the transmittal.

4. Use caution when taking client files home. The same diligence regarding securing and disposing of client documentation that is imposed at the office should be followed at home.

What should Leslie Campbell, the accountant in the opening scenario, do with the discarded material? Don't throw them into the trash can. The best solution to Leslie Campbell's problem regarding the disposal of obsolete client papers would be to defer to the firm's established and effective procedure for their destruction.

Deborah S. Kleiner is an attorney and assistant professor of business law at St. John's University. Mary D. Maury, CPA, is an associate professor of accounting and taxation at St. John's University.