General Principle – To identify and certify all processes; equipment, component and material streams managed; and activities related to the collection, refurbishing, repair, resale, de-manufacturing, asset recovery, brokering and recycling of used electronic equipment, components, and materials.
(a) An R2 Facility shall be audited and R2 certified for all used electronic equipment, components, and materials managed and all processes and activities undertaken at the facility, as well as any external processes, activities and locations under the control of the R2 Facility and associated with its certification, including all:
(1) R2 Core Requirements in this Section 1, and
(2) R2 Process Requirements in Section 2 applicable to its scope of operations.
(b) An R2 Facility shall document and have published on the R2 Certificate:
(1) An accurate statement of the scope of operations covered under the R2 Certification reflective of all processes and activities undertaken for the used electronic equipment, components, and materials managed, and
(2) All applicable R2 Process Requirements to which it has been certified, and
(3) Authorized allowances in accordance with the R2 Code of Practices, and
(4) All legal names and legal entities associated with the certifiable activities operating at or in conjunction with the R2 Facility.
(c) An R2 Facility shall maintain and communicate publicly on an ongoing basis a current listing of all additional locations owned and/or operated by the R2 Facility that are not R2 Certified and are used to manage used or end-of-life electronic equipment, components, or materials.
(d) An R2 Facility shall not have been included by SERI, within the previous 24 months of any certification audit, in a list of organizations maintained by SERI on its website that have been found to have engaged in deceptive marketing, illegal acts or other fraudulent activities which could reasonably lead to a false impression that the R2 Facility was certified to the R2 Standard during that period.
General Principle – To develop and adhere to a policy for managing used and end-of-life electronic equipment, components, and materials that is based on a hierarchy of responsible management strategies
prioritizing reuse first, followed by materials recovery for recycling into new products.
(a) An R2 Facility shall develop in writing and adhere to a policy stating how it manages used and end-of-
life electronic equipment, components, and materials – with respect to off-site and on-site activities, as well as the selection of downstream vendors – that is based on a hierarchy of responsible management
strategies.
(b) An R2 Facility shall evaluate and sort equipment, components, and materials in accordance with the
policy and Core Requirement 6, and take all practical steps to direct items for processing in the following order of preference:
(1) Reuse – For all equipment and components capable of reuse, the R2 Facility shall direct the items to a Reuse process meeting the requirements of the R2 Standard. However, equipment and components that are not legal to sell such as lost/stolen, counterfeit, or recalled equipment shall not be reused and instead be directed to Materials Recovery.
(2) Materials Recovery – For equipment and components not capable of reuse, the R2 Facility shall direct the items to a Materials Recovery process meeting the requirements of the R2 Standard for recycling.
(3) Disposal –
(A) Focus Materials (FMs) – Energy recovery, incineration, or land disposal1 shall not be used as a management strategy for FMs or equipment and components containing FMs unless applicable law requires the use of a specific technology (e.g. hazardous waste landfill or incineration of PCBs). However, if documented extreme and rare circumstances beyond the control of the R2 Facility disrupts its normal management of an FM, it may consider using these technologies to the extent allowed under applicable law until normal management is again possible.
(B) Non-Focus Materials – Only when all opportunities for reuse or materials recovery have been exhausted and there are no technically viable recycling processes available may an R2 Facility direct material to the most environmentally beneficial option of energy recovery, incineration or land disposal.
General Principle – To maintain a certified Environmental, Health, and Safety Management System (EHSMS) to plan, implement, and monitor environmental, health, and safety practices, including the activities to conform to each requirement of the R2 Standard.
(a) An R2 Facility shall be certified by an accredited Certification Body, to one or more of the approved EHSMS standards2, to plan and manage the environmental, health, and safety aspects of its operations.
(b) An R2 Facility shall fully integrate the requirements of this R2 Standard into the EHSMS, including
maintaining all documents and records necessary to demonstrate conformance with each of the R2 Requirements, and review the system at least annually through internal audits.
(c) An R2 Facility shall ensure that all documents and records required to demonstrate conformance with this R2 Standard are readily available at the certified facility and maintained for a minimum of three
years.
General Principle – To use practices and controls designed to protect the health and safety of workers, the public, and the environment under both normal and (reasonably foreseeable) exceptional circumstances.
(d) An R2 Facility shall:
(1) Demonstrate the expertise, knowledge, and technical capability to process each type of electronic equipment, component, and material it accepts in a manner that takes into account legal compliance as well as the need to protect the health and safety of workers, the public, and the environment, and
(2) Identify, analyze, and demonstrate effective control of important environmental impacts, and health and safety risks that it can control and those that it can influence, both internal to the R2 Facility and through its recycling chain activities, and
(3) Maintain a process to periodically evaluate the risk of exposure to hazardous substances such as mercury, lead, beryllium, cadmium, PCBs, phosphor compounds, flame retardants, silica dust, and hexavalent chromium through processing or handling of electronic equipment, components, and materials, and
(4) Maintain processes to visually inspect electronic equipment and components received and handled for any conditions or damage that may result in adverse environmental, health or safety incidents during handling, storage or processing of the equipment, and controls for the containment, segregation, and storage of items requiring special handling, and
(5) Adhere to good housekeeping standards, including keeping all work and storage areas clean and orderly. Housekeeping for all areas of the facility shall be planned, regularly implemented, and monitored, and
(6) Provide sanitary facilities for workers, and
(7) Prevent the consumption of food and beverages in areas not maintained free of contaminants, and
(8) Provide the same level of care to the entire workforce, including staff, volunteers, consultants, temporary workers, and anyone else performing activities under its direction, and
(9) Designate a qualified employee(s) or contract worker(s) to coordinate its efforts to promote worker health and safety, and environmental protection. This designated individual(s) shall be identified to all employees and two-way communication shall be proactive and effective between employees and this individual regarding potential hazards and how best to address them.
General Principle – To comply with all applicable environmental, health, safety, and data security legal requirements, and only import and export electronic equipment, components, and materials in full compliance with all applicable importing, transit, and exporting countries’ laws.
(a) An R2 Facility shall develop a legal compliance plan to maintain full compliance with all environmental, health, safety, and data security legal and other requirements applicable to its operations, as well as full compliance with all applicable import and export laws covering shipments of electronic equipment, components, and materials. This plan shall be included as a section of its EHSMS.
(b) Facility Compliance: The plan shall identify and document the environmental, health, safety, and data security legal requirements that cover the R2 Facility’s operations both at the facility and all associated off-site locations where activities within the scope of certification are occurring, and define the controls, competence, and monitoring activities to maintain full compliance.
(c) Import/Export Compliance: The plan shall also identify and document the applicable legal requirements of the exporting, transit, and importing countries to demonstrate the legality of all international shipments of:
(1) Electronic equipment, components, and materials directly transferred by the R2 Facility, and
(2) R2 Controlled Streams, including shipments made by downstream vendors, to final disposition or the first R2 Facility.
(d) Monitoring Compliance: The R2 Facility shall:
(1) Identify and implement the actions and controls required to ensure compliance with all requirements, and
(2) Maintain the legal compliance plan, consistent with changes in the requirements and the FM Management Plan, and
(3) Periodically audit its compliance with legal requirements by a competent auditor knowledgeable in the operations and applicable requirements, and
(4) Take corrective action to promptly stop and resolve any issues of non-compliance; and
(5) Notify the Certification Body within 30 days of receiving any regulatory order or notice of violation that requires any action to address the violation and follow up with the issuing agency.
(e) Child and Forced Labor: An R2 Facility shall not use child labor, as defined by the International Labor Organization (ILO) or forced labor, where the worker cannot leave or terminate employment freely.
(f) Prison Labor: The use of prisoners is only acceptable if it is voluntary, compensated beyond room and board, and skills are taught for gainful employment after release.
(g) Non-Discrimination Policy: An R2 Facility shall document a non-discrimination policy stating the fair and equal treatment of all workers, regardless of aspects such as, but not limited to, age, gender, race, religion, or sexual orientation, including compensation in compliance with applicable wage laws. The policy shall define the process to report, investigate and respond to discrimination complaints, and shall be periodically communicated to all staff.
General Principle – To track and manage the throughput of all electronic equipment, components, and materials, and maintain sufficient records to document the flow of all electronic equipment, components, and materials.
(a) For all inbound electronic equipment, components, and materials controlled by the R2 Facility through physical possession, title, or other contractual agreement, the R2 Facility shall:
(1) Maintain bills of lading or other commercially-accepted records, and
(2) Ensure records have accurate dates, detailed descriptions including types and quantities, and supplier names, an
(3) Maintain a summary report of all transactions.
(b) For all electronic equipment, components, and materials controlled by the R2 Facility, the R2 Facility shall:
(1) Track, manage, and maintain accurate records of the quantity of R2 Controlled Streams in the R2 Facility’s control from receipt through processing, storage, and shipment, and
(2) Maintain total inventory levels below the defined limits in conformance with the R2 Facility’s legal requirements, closure plan, and financial assurance, and
(3) Not store R2 Controlled Streams, or materials with a negative value, for longer than one year, except where:
(A) Components have been evaluated and inventoried in accordance with Appendix C – Test and Repair, or
(B) Complete applications for regulatory permits or other authorizations for the export of the R2 Controlled Stream to the verified downstream vendor have been applied for within the usual issuing timeframe, but not yet received from the governing authority, and where storage is otherwise legally permissible.
(c) For all outbound electronic equipment, components, and materials controlled by the R2 Facility, the R2 Facility shall:
(1) Maintain bills of lading, or other commercially-accepted records, and
(2) Ensure records have accurate dates, detailed descriptions including types and quantities, and
(3) Maintain a summary report of all transactions
General Principle - To evaluate, sort, and categorize all equipment, components, and materials in accordance with the R2 Equipment Categorization reference document to ensure the applicable R2 requirements are followed throughout processing and outbound through the downstream recycling chain. Equipment and components may change categorization through stages of processing.
(a) Documentation:
An R2 Facility shall develop and maintain a documented process to evaluate, sort, and categorize electronic equipment, components, and materials controlled and processed. This process shall:
(1) Conform with the hierarchy in Core Requirement 2; and
(2) Include the applicable categories from the R2 Equipment Categorization (REC) or maintain a documented correlation of existing categories in use to those defined in the REC, to demonstrate the levels of functionality, data sanitization status and physical condition of the items; and
(3) Identify all data storage devices; and
(4) Define the instructions and criteria to determine if the equipment and components are capable of reuse based on physical condition, functionality, and value in the destination market; and
(5) Include steps to re-evaluate R2 Controlled Streams when processing changes the category of the stream.
(b) Categorize:
(1) All equipment, components, and materials controlled by the R2 Facility shall be identified with its corresponding R2 equipment categories from the REC3, or equivalent correlated internal categories.
(2) All equipment, components, and materials shall be managed as an R2 Controlled Stream that requires further processing in accordance with the R2 requirements, unless it:
(A) Has been processed and categorized by another certified R2 Facility, in which case the provided REC categorization can be recognized, or
(B) Has been processed and categorized by a non-R2 facility and the R2 Facility has implemented a documented evaluation and sampling process to verify the categorization, or
(C) Can be demonstrated with appropriate test and/or verification records to be sanitized and functional, or
(D) No longer meets the definition of an R2 Controlled Stream.
(c) Evaluate:
The R2 Facility shall evaluate all equipment and components in accordance with the defined process to determine the capability of reuse and direct evaluated equipment, components, and materials to the appropriate next process.
(d) Process:
(1) All equipment and components shall be evaluated for data, including connected user accounts and services, and identified with the corresponding data sanitization status from the REC.
(2) All equipment and components that may contain data shall be secured and controlled to prevent unintended access or theft of data, until processed in accordance with Core Requirement 7 for data security.
(3) An R2 Facility shall not reuse, sell, or donate equipment or components prohibited by written and binding commercial agreements with those from whom the equipment or components were received. Equipment and components not allowed to be sold or donated for reuse shall conform to Core Requirement 7 for data security and Appendix E – Materials Recovery.
(4) Equipment or components that are evaluated and determined to be capable of reuse shall be:
(A) Identified with unique identifier for each piece of whole equipment, or grouped in batches and assigned a unique batch identifier for non-serialized equipment or components, and
(B) Tested, refurbished and/or repaired internally according to Appendix C – Test and Repair, or
(C) Transferred to a downstream vendor qualified in accordance with Appendix A – DownstreamRecycling Chain, for testing, repair, and refurbishing, or
(D) Processed in accordance with Appendix D – Specialty Electronics Reuse.
(5) Equipment and components not capable of reuse and other materials for recovery shall be:
(A) Processed by the R2 Facility in accordance with Appendix E – Materials Recovery, or
(B) Transferred to a downstream vendor qualified in accordance with Appendix A – Downstream Recycling Chain.
(e) Output:
(1) Any equipment or components evaluated and determined to be an Unrestricted Stream as defined in the REC, shall:
(A) Be clearly identified and managed separately from R2 Controlled Streams, and
(B) Have demonstrated justification for the unrestricted classification, and
(C) Have adequate records maintained tracking the type of stream, any reason for return, and evidence of all transfers.
(2) Prior to transferring functioning products4, an R2 Facility shall:
(A) Identify and disclose the appropriate REC, or equivalent correlated internal categories, for Functioning Product, Data Sanitization Status, and either the Cosmetic Condition or provide other detailed description of the cosmetic condition5 of the equipment or components to the buyer, and
(B) Reference the unique identifier(s) in commercial sales and shipping records, and
(C) Prior to any international shipment, verify import/export compliance of each shipment in accordance with its legal compliance plan in Core Requirement 46 that affirms the international shipment is legal, and
(D) Package and protect equipment and components in such a way as to prevent damage during shipment in accordance with Core Requirement 10, and
(E) Make the product return policy available to potential buyers prior to sale in accordance with Appendix C – Test and Repair.
(3) Collectible and Specialty Electronics may be transferred:
(A) In accordance with Section (e)(2) of Core Requirement 6, without testing if sales do not exceed 1% of total individual units by quantity sold on a rolling 12-month average, and equipment may be returned by the buyer if not wanted under a documented warranty/return policy at no charge to the buyer, or
(B) In accordance with Appendix D – Specialty Electronics Reuse as applicable to Verified Specialty Electronics.
General Principle – To provide for the security and sanitization of all data storage devices as appropriate to the type of device and level of sensitivity of the data.
(a) Documentation:
(1) An R2 Facility shall document and maintain a Data Sanitization Plan and procedures, including defining the following:
(A) Security controls to protect data in the R2 Facility’s control, including declarations of secured areas dedicated to data sanitization with access limited to authorized individuals, and
(B) Types of data storage devices accepted that may contain data, and
(C) Types of data to be sanitized, and
(D) Declaration of general information that does not need to be sanitized, and
(E) Potential associations to network services that could automatically repopulate data on the device, and
(F) Written contractual requirements not to sanitize data on user’s data storage devices when requested, and
(G) Applicable legal, supplier, and other requirements for data sanitization including applicable data breach and privacy regulations, and
(H) Where legal, supplier, and other requirements are addressed in written policies and procedures to ensure conformance, and
(I) Methods for data sanitization for each type of data storage device, and
(J) Planned durations to sanitize data from the time of receipt, and
(K) Downstream vendors or contractors that perform data sanitization in accordance with this plan, if data sanitization is not performed internally, and, where applicable, those downstream vendors whose services will be provided in another country, and
(L) Records to be maintained to demonstrate the effectiveness of the sanitization and verification activities, and
(M) Process for authorizing and monitoring workers, visitors, and others permitted to have access to equipment and components containing data.
(2) An R2 Facility shall document and maintain a written data security policy that:
(A) Prohibits unauthorized individuals from accessing or handling equipment containing data, and
(B) Assigns a competent Data Protection Representative with the overall responsibility and authority for the R2 Facility’s data security and legal compliance, including oversight of all related duties otherwise assigned, and
(C) Mandates reporting of known and suspected breaches of security and data to the Data Protection Representative, and
(D) Requires completed training and confidentiality agreements prior to individual authorization to handle equipment containing data, and
(E) Identifies penalties for non-compliance with the policy, including personal liability.
(3) All workers shall be trained regularly and verified to be competent on these policies and procedures for data security, consistent with their level of authorization.
General Principle – To employ security measures appropriate for the electronic equipment it handles and the suppliers it serves.
(b) Security :
(1) An R2 Facility shall implement and maintain a security program that controls access to all or parts of the facility in a manner and to a degree appropriate given the type of electronic equipment handled, sensitivity of data on storage devices, and the needs of the suppliers served. This security program should consider risk of theft and unauthorized access to the facility and equipment.
(2) An R2 Facility shall develop and implement levels of security authorizations to control access for employees, visitors, and contract workers based on the types of equipment received, the sensitivity of the data handled, and the legal, supplier and other requirements applicable to the facility. Authorizations shall be granted by the Data Protection Representative and based on documented evaluations allowed by law.
(3) Secured areas shall be clearly identified and labeled with signage to warn against unauthorized access.
(4) Appropriate security controls shall be implemented and monitored to limit access to equipment based on established security authorizations and the workers’ need for access.
(5) For individuals granted security authorization, the R2 Facility shall maintain in writing individual acknowledgements of the responsibility to prevent disclosure of data; and to report any theft of equipment or data, or data breaches; and to disclose any incidents that may change their security authorization.
(6) An incident response procedure shall be created and implemented to investigate potential data or security breaches, and to notify affected suppliers, legal authorities and other interested parties as required by law, of any potential or actual breaches.
(c) Process:
(1) For the receiving of any equipment or components that may contain data, the R2 Facility shall provide to the supplier confirmation of:
(A) Receipt of equipment or components containing data, and
(B) The method7 of data sanitization to be used, and
(C) Whether data sanitization will be performed internally or by a downstream vendor.
(2) Equipment and components containing data shall be sanitized in a timely and effective manner, in accordance with one of the following methods, as disclosed to the supplier:
(A) Sanitize the data on the data storage devices in accordance with Appendix B – Data Sanitization, or
(B) Physically destroy the data storage media in accordance with an applicable method defined in Appendix A of the NIST Guidelines for Media Sanitization: Special Publication 800-88 (rev.1), and verify destruction in accordance with a defined process to demonstrate 100% effectiveness of the destruction process, or
(C) Ship/transfer data storage devices under written contract to a downstream vendor that has been verified in accordance with Appendix A – Downstream Recycling Chain, with the capabilities to sanitize data from the type of equipment shipped in accordance with the planned method disclosed to the supplier.
(3) Internal data security and sanitization audits shall be performed at minimum annually by a competent and independent auditor to validate the data sanitization processes are effective and conforming to the R2 Standard, legal requirements, and the data sanitization plan.
(d) Notifications:
(1) An R2 Facility shall maintain a process to provide information to suppliers where requested of the following:
(A) Changes in downstream vendors to process supplier’s equipment and components containing data, and
(B) Breaches in security
General Principle – To manage, both on-site and in the selection of downstream vendors, the Focus Materials that pass through its facility or control in a manner protective of the health and safety of workers, the public, and the environment.
Development and Adherence to an FM Management Plan
(a) An R2 Facility shall analyze, plan, regularly review, and update as necessary how the FMs that pass through its facility or control will be properly managed both on-site and down the recycling chain (and include this analysis and plan as the FM Management Plan section of its EHSMS). The FM Management Plan shall state how the R2 Facility and its downstream vendors shall conform to the applicable requirements of the R2 Standard including:
(1) The demonstrated expertise and capabilities required to process each type of electronic equipment containing an FM, and
(2) The planned methods and demonstrated capacity needed to process each type of electronic equipment containing an FM, and
(3) When not the final point of processing, a flowchart of the downstream recycling chain selected according to Appendix A – Downstream Recycling Chain, including identification of international movements, to either final disposition or the first downstream R2 Certified facility.
Non-Focus Materials Requiring Specific Management
(b) An R2 Facility shall manage print cartridges in accordance with Core Requirement 2 through print cartridge remanufacturers, recyclers, or Original Equipment Manufacturers (OEM), in facilities that meet all applicable regulatory requirements to receive these print cartridges, and that use technology designed to safely and effectively manage ink and toner print cartridges.
(c) An R2 Facility shall manage all equipment, components, and materials that pass through its facility or control that do not contain Focus Materials or are not electronic equipment, in accordance with Core Requirement 2, and otherwise integrated into the EHSMS, to ensure handling that is in full legal compliance, protective of the environment, and protective of worker and public health and safety.
General Principle – To process and store electronic equipment, components, and materials in a manner that is legally compliant and protects the health and safety of workers, the public and the environment.
(a) An R2 Facility shall conduct all processing operations indoors unless the risks of the outdoor operations have been assessed and controls established to prevent uncontrolled releases to the environment.
(b) An R2 Facility shall store all R2 Controlled Streams, in a manner that:
(1) Protects them from reasonably foreseeable adverse weather conditions, and (2) In accordance with the established legal compliance plan, and
(3) Provides security from unauthorized access, and
(4) Is in clearly labeled containers and/or storage areas.
(c) An R2 Facility shall store all equipment destined for reuse in an enclosed environment protected from the elements, unless intended for outdoor use.
General Principle – To possess insurance that is appropriate to cover the potential risks and liabilities associated with the nature and size of the operations.
(d) The R2 Facility shall demonstrate that it has evaluated the risks related to the scope of its operations, including any changes in operations and volume of material processed, and that it has used the evaluation to obtain insurance or reserves that it can demonstrate is appropriate to cover liabilities arising from all activities and locations in which it operates. Insurance or reserves shall include:
(1) Coverage for treatment of work-related injury and illnesses of workers, and (2) Any process insurance requirements specified elsewhere in this R2 Standard.
General Principle – To have legal and financial assurances in place for the proper closure of its facility.
(e) An R2 Facility shall develop and maintain a current, written plan that provides for the closure of the facility in the event of abandonment. The plan shall:
(1) Include the use of appropriate commercial businesses to manage any electronic equipment, components, and materials under the R2 Facility’s control, and
(2) Consider the risks identified, including equipment and materials that could be received under the R2 Facility’s certification scope, and applicable law, and
(3) Include reasonably foreseeable costs in the financial instrument for processing remaining inventory, sampling for environmental contamination, and possible site remediation to restore the premises to sellable condition, and
(4) Establish a financial instrument to provide the necessary funds for closure, including in the event of abandonment, consistent with applicable law and the closure plan, and
(5) Include any process or other closure requirements specified elsewhere in this R2 Standard.
(f) Financial instruments to assure closure in the event of abandonment are not required if:
(1) The total cost to properly close the facility in the event of abandonment is less than $10,000 United States Dollars, and
(2) The size of all buildings owned, leased, or used by the R2 Facility is less than 1,000 square meters, and,
(3) The facility prohibits and never accepts equipment or materials containing mercury, CRT glass, lithium primary batteries, or polychlorinated bi-phenyls.
General Principle – To transport all electronic equipment, components, and materials using entities that meet the applicable legal requirements for the transportation, and in a manner protective of physical and data security, health, safety, and the environment.
An R2 Facility shall ensure that:
(a) All electronic equipment, components, and materials to be transported are packed appropriately:
(1) Considering the risk they could pose during transportation to data security, health, safety or the environment, and
(2) To the level of care warranted by its intended use, and
(3) To secure in accordance with Core Requirement 7, and
(4) To comply with any legal requirements identified under Core Requirement 4.
(b) When electronic equipment or components containing data are transported:
(1) Defined security measures are implemented as planned and transportation is tracked as appropriate for the sensitivity of the data on the devices and the requirements of the suppliers served, and
(2) Contracts are enforced with the transporter with a level of service that conforms to these requirements, and
(3) Additional security controls are used to conceal the package contents from public view and prevent unintended access during transportation.
(c) All shipping documentation, labeling, and import/export declarations use accurate codes, descriptions, and required declarations consistent with regulatory requirements for the equipment, components, and materials being transported.
(d) Transporters meet the legal requirements under Core Requirement 4 to transport the electronic equipment, components, and materials.
General Principle – To manage the downstream recycling chain for all R2 Controlled Streams to ensure that all downstream vendors operate in conformance with the R2 Standard.
(1) An R2 Facility shall manage the movement of R2 Controlled Streams through their downstream recycling chain, to final disposition or the first R2 Facility, using the REC, and confirm conformance by each downstream vendor to this Appendix A.
(2) If the equipment, components, or materials handled have a negative value, then the R2 Facility shall:
(a) Maintain pollution liability insurance addressing these risks, and
(b) Include this equipment, components, and materials in the closure plan and financial instrument calculations in accordance with Core Requirement 9.
Transboundary Movements
(3) Prior to any international shipment, the R2 Facility shall verify import/export compliance of each shipment in accordance with its legal compliance plan in Core Requirement 48 that affirms the international shipment is legal. Verification shall document:
(a) If the equipment, components, or materials are a regulated waste under the regulations of the export, transit, and import countries, and
(b) If determined to be a regulated waste, determine if the waste is hazardous, and
(c) Other information or documentation required by applicable law.
Transparency
(4) An R2 Facility shall:
(a) Track and demonstrate the complete downstream recycling chain of all R2 Controlled Streams to final disposition, or
(b) Register with SERI, the portion of the downstream recycling chain that it manages, including all R2 Controlled Streams to final disposition or the first R2 Facility, to enable mapping of the entire chain, and register any changes prior to shipment.
(5) An R2 Facility shall provide, to each supplier to the R2 Facility that owns or arranges for transfer of equipment, components, or materials to the R2 Facility, upon request and subject to agreed upon confidentiality restrictions:
(a) The names and locations of all downstream vendors in the recycling chain that handle said supplier’s R2 Controlled Streams, and
(b) Notification prior to shipping the supplier’s R2 Controlled Streams to a new or changed downstream vendor.
(6) An R2 Facility shall verify with commercially-accepted records that R2 Controlled Streams are received at the next downstream vendor’s facility.
Downstream Vendor Qualification
(7) If a downstream vendor is R2 Certified, then verification that the R2 Certification is active with a certification scope, including applicable Process Requirements, consistent with the equipment, components, and materials received and the processes performed, shall qualify the downstream vendor to receive shipments without further downstream tracking and verification, which is alternately addressed through the downstream vendor’s R2 Certification.
(8) If a downstream vendor is not R2 Certified, the R2 Facility shall determine before shipment and reasonably confirm at least annually and document, through audits or other formal review, that each downstream vendor receiving an R2 Controlled Stream through the entire recycling chain continues to conform to the requirements of this section for as long as it receives an R2 Controlled Stream directly or indirectly from the R2 Facility. The R2 Facility shall verify that the downstream vendor:
(a) Demonstrates their capabilities and conforms to the R2 Facility’s FM Management Plan in Core Requirement 8.(a), and
(b) Adheres to a documented system to manage environmental, health, and safety risks and legal requirements. The management system shall include, at a minimum, the components of Core Requirement 3(d), and Core Requirement 4, other than 4(d)(5) and 4(g), and
(c) Has demonstrated knowledge of, and has taken measures to comply with applicable environmental, health, and safety legal requirements as identified in its compliance plan and maintains a current list of its permits and copies of each, and
(d) If performing data sanitization:
(1) Smelts or incinerates data devices and media for final destruction, and provides written confirmation of processing of all devices, or
(2) Is annually audited by a competent auditor, that is:
(A) Independent of both the R2 Facility and organization being audited, and
(B) Has demonstrated knowledge of data security best management practices and data sanitization processes; and
(C) Has demonstrated knowledge of management systems auditing; and
(D) Has successfully completed a SERI approved data sanitization training with maintenance through annual refresher training, and
(3) Confirmed through the annual audit to be operating in conformance with all requirements of Core Requirement 7 and Appendix B – Data Sanitization; and
(4) Provides records of proof of sanitization of all data containing equipment and components, and
(5) Transfers all R2 Controlled Streams to:
(A) An R2 Certified Facility, or
(B) A non-R2 facility qualified to this Appendix A by the R2 Facility, and
(e) If testing, refurbishing, or repairing the equipment or components received for reuse
(1) Tests, refurbishes, and repairs equipment and components in accordance with Core Requirement 6 and Appendix C – Test and Repair, and
(2) For equipment and components received from the R2 Facility, only sells or donates Functional category equipment and components according to the REC9, and
(3) Transfers all R2 Controlled Streams to:
(A) An R2 Certified Facility, or
(B) A non-R2 facility qualified to this Appendix A by the R2 Facility, and
(f) If processing an R2 Controlled Stream for materials recovery, operates in conformance with Appendix E – Materials Recovery, and
(g) If brokering, operates in conformance with Appendix F – Brokering (1)(c) and (2), and
(h) Tracks throughput to demonstrate with records:
(1) Receipt and acceptance of R2 Controlled Streams from each shipment from the R2 Facility, and
(2) Shipments of R2 Controlled Streams to downstream vendors, and
(3) R2 Controlled Streams and materials with a negative value are not stored for longer than one year.
General Principle – To recognize organizations that maintain enhanced data security controls and perform physical or logical data sanitization in accordance with best practices, where data devices are managed to the highest level of sensitivity as required by the supplier or regulation.
(1) An R2 Facility shall add to its Data Sanitization Plan and procedures in Core Requirement 7 the following:
(a) Methods to distinguish sanitized devices from devices containing data, and
(b) Documented quality controls to assess and verify the effectiveness of the data sanitization processes on an ongoing basis, and confirm that:
(1) All devices have been properly processed, where the output is consistent with the planned sanitization method and data has been successfully sanitized from the data storage device, or
(2) Corrective actions are taken to manage any processed devices where sanitization cannot be confirmed and address any other issues in the sanitization process, and
(c) Monitoring activities to ensure continued effectiveness of the execution of this plan, and
(d) Competency requirements to perform sanitization and verification.
(2) For traceability, records shall be kept of the unique identifier of each data storage device or tracking through other means from the point of control by the R2 Facility through the sanitization process.
(3) Data sanitization workers shall be trained and evaluated, including any necessary updates as processes, data storage devices, and sanitization methods change, to be competent to perform the specific methods for data sanitization and processes to which they have been authorized.
(4) All markings associating a device with its previous user shall be removed or destroyed.
(5) Effective security controls that are appropriate to the most sensitive classification of media accepted at the facility shall be implemented, tested, and maintained. These security controls shall include:
(a) Physical Security controls including locked and alarmed access points during both working and after hours, and
(b) Enclosed work and storage spaces that are secured, and
(c) Closed circuit camera systems with at least 60 days of recordings covering all areas of the facility where equipment or components containing data are received, stored, or passed through, and
(d) Active monitoring of security cameras, access points, and other security controls for secured areas, and
(e) Regular tests of the effectiveness of these security controls, and
(f) Inventory tracking to identify the physical location of any recorded data storage device at any time while in the R2 Facility’s control.
(6) Data sanitization services delivered outside of the certified R2 Facility shall be performed in conformance with this Appendix B and Core Requirement 7.
PHYSICAL SANITIZATION (Destruction)
(7) Where physically sanitized, data storage devices shall be physically destroyed in accordance with:
(a) An applicable method defined in Table 1 – Physical Destruction Methods, or
(b) The National Security Agency (NSA) Storage Device Sanitization Manual using equipment listed on the Evaluated Products List, or
(c) Any other method of physical destruction that has been independently verified by a competent expert and determined to be an effective means of sanitization.
(8) If customer, legal, or sensitivity of information requirements necessitate more stringent destruction methods, the most stringent requirements shall be implemented.
(9) Video recordings of the physical destruction of all media shall be maintained for at least 60 days.
LOGICAL SANITIZATION (Erasure)
(10) Where logically sanitized, electronic records of data sanitization created by the software used to sanitize the data shall be maintained for each unique identifier of the data storage media.
(11) Data sanitization software used shall be:
(a) Configured to sanitize all user-addressable locations on the data storage media containing data that was not original when the device was purchased, and
(b) Configured to fail the media if any user-addressable locations cannot be sanitized, and
(c) Maintained with software patches, and
(d) Verified to be a currently supported version before use.
(12) All logins, passwords, locks, or any other connections to a remote service shall be removed and no longer connected to the device.
(13) A minimum of 5% of logically sanitized data storage media shall be routinely sampled by a competent and independent party to demonstrate data is not recoverable by commercial software, and where continued sampling results demonstrate:
(a) No issues with the sanitization process, subsequent sample sizes may be decreased to no less than 1%, with continued routine sampling; or
(b) Nonconformity or other sanitization issues, corrective actions are promptly initiated and nonconforming product appropriately managed, and sampling is increased until no further issues are identified.
(14) If logical sanitization is unsuccessful or cannot be verified, then the item or data-bearing component must be physically destroyed in accordance with the requirements above.
QUALITY CONTROL
(15) Quality controls shall be implemented to verify that received equipment and components containing data:
(a) were processed as planned, and
(b) quantities processed match quantities received, and
(c) suppliers are notified of any discrepancies.
(16) After verification of (15)(a)-(c) above, data storage devices shall be approved for release by the Data Protection Representative and records retained.
(17) When quality control issues are detected, corrective actions shall be implemented in accordance with the data sanitization plan.
General Principle – To recognize organizations with the competency and tools to test, repair, or refurbish electronic equipment in accordance with best practices, to produce functional equipment, and accurately communicate the level of functionality, cosmetic condition, and data sanitization status.
(1) An R2 Facility certifying to Appendix C – Test and Repair shall also be certified, by an accredited Certification Body, throughout the duration of its R2 certification, to an approved quality management system (QMS) standard10 with a scope that includes all the equipment, components and processes to which this Appendix C applies.
(2) An R2 Facility shall document an R2 Reuse Plan, that shall include:
(a) Written instructions for each of the requirements in this section applicable to the scope of operations of the R2 Facility, and
(b) Competency requirements for workers testing, repairing, and verifying equipment and components, and
c) Product safety plans to demonstrate the actions the R2 Facility undertakes to investigate and verify that equipment and components are safe to reuse, including procedures to check for conditions affecting product safety, and responding to recalls, and
(d) Test plans to verify the functions of the equipment or components are working, including:
(1) Defining the functions by each equipment type tested, and
(2) Testing methods and test equipment for each function, and
(3) Pass and fail criteria for each function, and
(4) Methods of documenting and storing test results, and
(5) Categorization of equipment based on test results in accordance with the REC, and
(e) Quality assurance plans to ensure the effectiveness of tests, including:
(1) Methods to verify the accuracy of test methods and testing equipment, and
(2) Measurements to monitor the quality of reusable equipment and components, and
(3) Management of equipment or components that fail testing to prevent their unintended use, and
(4) Verification of assigned categories in accordance with the test results for each test performed on each unit, and
(5) Verification that data has been sanitized in accordance with Appendix B – Data Sanitization, and
(f) Product return policy and plan appropriate to the final destinations of the equipment and components being reused.
(3) An R2 Facility shall test, repair, and refurbish R2 Controlled Streams within one year of receipt from suppliers, or evaluate and inventory components for future use in repairing other equipment.
(4) The R2 Facility shall implement and execute the R2 Reuse Plan to produce functional equipment for reuse and manage non-functional equipment for materials recovery. The R2 Facility shall:
(a) Ensure data is sanitized on the equipment or components being tested in accordance with Appendix B – Data Sanitization, and
(b) Ensure workers are competent in testing the functionality of the electronic equipment and effective test methods, and
(c) Test, repair, clean, refurbish and configure equipment and components according to the R2 Reuse Plan to determine the functional category in accordance with the REC, and
(d) Execute the product safety plans to assess safety of all functional equipment and components, and
(e) Generate and maintain records of test results for each function tested for each unique identifier assigned, and
(f) For equipment or components that do not meet a REC functioning product category when tested:
(1) Identify the equipment or components as non-functioning products, and
(2) Repair the equipment or component and repeat testing after repair, or
(3) Harvest the reusable components, or
(4) Evaluate the equipment in accordance with Core Requirement 6 to continue processing, and
(g) For equipment or components that meet a functioning product category in the REC when tested:
(1) Identify and disclose the appropriate REC, or equivalent correlated internal categories, for Functioning Product, Data Sanitization Status, and either the Cosmetic Condition or provide other detailed description of the cosmetic condition, and
(2) Execute the quality assurance plans to confirm the assigned categories, and
(3) Based on the new category assigned after test and/or repair, manage the equipment in accordance with Core Requirement 6 to continue processing.
General Principle – To allow for the legitimate reuse of untested specialty electronics which often require sophisticated test equipment and simulations to test functionality and often cannot be tested by specialty electronics refurbishers.
(1) An R2 Facility certified for processing specialty electronics shall also be certified for Appendix C - Test and Repair.
(2) An R2 Facility shall use competent technicians that shall:
(a) Test all specialty electronics for which the R2 Facility has the capability to test in accordance with Appendix C – Test and Repair, and
(b) For specialty electronics which the R2 Facility does not have the technical capability to test:
(1) Verify and document from the prior user that the specialty electronics was removed from operation with no known defects in functionality, and
(2) Verify all specialty electronics are free of physical damage, physical defects, corrosion, and missing parts, and
(3) Verify the part number(s) or other similar unique identifier for the equipment, and serial number(s) are accurate, and
(4) Verify data on the specialty electronics was sanitized by the source in accordance with Appendix B – Data Sanitization, or the specialty electronics cannot store data that needs to be destroyed, and
(5) If the specialty electronics fail any of these verifications:
(A) Harvest the reusable components and conform to this Appendix D for each component, and
(B) Identify the remaining equipment and components as an R2 Controlled Stream and process according to Core Requirement 6, and
(6) If the specialty electronics pass all verifications:
(A) Track individual specialty electronics with a unique identifier, and
(B) Handle, package, and store all specialty electronics to protect it from physical and electrical damage, and
(C) Label all specialty electronics with the R2 Facility’s name and contact information for warranty returns and recycling, and
(D) Identify the item as Verified Specialty Electronics according to the REC.
(3) Verified Specialty Electronics may be stored indefinitely for reuse as long as they continue to have a positive resale value and market for reuse. Otherwise, they must be processed in accordance with the requirements of this standard.
(4) To sell Verified Specialty Electronics, an R2 Facility shall:
(a) Limit sales only to a customer’s request for specific part numbers(s) or other similar unique identifier for the equipment, and
(b) List each unique identifier and/or part number for the equipment sold on the sales receipt or other commercially-accepted records consistent with the customer’s request for the specific part, and
(c) Demonstrate customers accept the following terms on the purchase order:
(1) Equipment has been inspected and verified but not tested, and
(2) Customer accepts the equipment without testing, and
(3) Customer will return all equipment that is not working for a refund, and
(4) Customer will only sell the equipment to an end-user, and
(5) Customer will provide to the R2 Facility, upon request, records that demonstrate the equipment was sold to an end-user, and:
(A) Accept returns of the specialty electronics for any reason at no charge to the end-user, and
(B) Offer no charge return of the specialty electronics for recycling.
General Principle – To maintain processes for the recovery of materials for recycling and the proper management of Focus Materials in the process of recovery.
Workforce and Environmental Protection
(1) An R2 Facility shall conduct on a regular basis (e.g., as new types of materials are processed, or new processes or equipment are used) a hazards identification and assessment of occupational health and safety, and environmental risks that exist or could reasonably be expected to develop at the facility. Such risks could result from any sources, including but not limited to emissions of and/or exposure to substances, noise, ergonomic factors, thermal stress, substandard machine guarding, cuts and abrasions, etc.
(2) The hazards identification and assessment shall be conducted by an individual trained in risk assessment and analysis techniques, and knowledgeable of the hazards associated with the materials recovery activities.
(3) The hazards identification and assessment shall be captured in writing and incorporated as a component of the organization’s EHSMS.
(4) The hazards identification and assessment shall at minimum address the following additional EH&S criteria, which shall be incorporated as applicable into the R2 Facility’s EHSMS to the level defined through the assessment:
(a) Establish wash facilities for decontamination, clean areas for eating and drinking, and transition areas from materials recovery areas to clean areas to prevent transfer of contamination, and
(b) Prohibit food and drink in materials recovery areas unless ongoing industrial hygiene (IH) records show no detectable risk, and
(c) Prohibit work clothes and shoes from being taken home by workers unless ongoing industrial hygiene (IH) records show no detectable risk, and
(d) Implement procedures for cleaning and caring for personal protective equipment, and
(e) Implement cleaning procedures to regularly remove contaminants from equipment and work areas consistent with the Focus Materials processed, and
(f) Implementproceduresforcontrolofhazardousenergy(lockout/tagout)inequipmentandprocesses, and ensure workers are trained and competent, and
(g) Ensure physical safety guards are in use on mechanical equipment, and
(h) Perform pre-use safety inspections of equipment before use in accordance with the manufacturer’s specifications and do not use equipment that has failed the inspection, and
(i) Implement an industrial hygiene monitoring program, including air, noise, and wipe sampling to monitor applicable risks at a frequency consistent with past results and current trends of the results, and
(j) Risks associated with mechanical separation processes shall be re-evaluated at least annually, and
(k) Air quality shall be periodically monitored for mercury in material recovery areas where electronic equipment with fluorescent lamps is dismantled or lamps are removed, and
(l) Implement a medical monitoring program to establish baseline and regularly evaluate worker exposures to mercury, lead, or other toxic substances consistent with hazards in the materials recovered and trends in monitoring results.
Removal of FMs
(5) The R2 Facility shall ensure that controls are maintained in any disassembly areas to minimize the risk of environmental, health or safety incidents during dismantling operations such as battery removal.
(6) Prior to shredding or materials recovery of equipment or components, FMs (as well as print cartridges) shall be removed using safe and effective mechanical processing or manual dismantling, with two exceptions:
(a) Items containing mercury may be processed using methods designed to safely and effectively capture mercury if:
(1) Workers are protected from the potential risks of handling mercury, and
(2) The materials recovery occurs in facilities that meet all applicable regulatory requirements to receive and process mercury, and
(3) Processing demonstrates mercury recovery.
(b) CRTs, batteries, and circuit boards contained in equipment or components destined for materials recovery need not be removed prior to shredding and/or materials recovery if:
(1) Workers are protected from hazards by technology designed to safely and effectively process equipment or components containing these FMs, and
(2) The shredding and/or materials recovery occurs in facilities that meet all applicable regulatory requirements to receive and process these FMs, and
(3) Processing demonstrates effective recovery of these FMs.
Processing, Recovery, and Treatment of FMs
(7) An R2 Facility shall send removed FMs to processing, recovery, or treatment facilities that meet all applicable regulatory requirements to receive the FMs, and that use technology designed and operated to safely and effectively manage the FMs. This shall include:
(a) For items containing mercury – mercury retorting or other legal methods, excluding incineration, and
(b) For circuit boards – removal of batteries and mercury, and processing for metals recovery, unless the R2 Facility can demonstrate conformance to the requirements in requirement 6(a)or (b), above, and
(c) For items containing polychlorinated biphenyls (PCBs) – technology specifically designed for PCB destruction or disposal, occurring in facilities that meet all applicable regulatory requirements, and that use technology designed to safely and effectively manage equipment or components containing these FMs.
Assurances for Environmental Incidents
(8) An R2 Facility shall maintain pollution liability insurance, guaranteed reserves, or government guarantee to cover potential environmental incidents, per Core Requirement 9.
Continued Processing
(9) An R2 Facility shall evaluate each output stream from the materials recovery process, re-categorize in accordance with the REC, and continue processing in accordance with Core Requirement 6.
General Principle – To enable an R2 Facility to source and control the delivery of equipment, components, or materials directly to a downstream vendor, while ensuring that the same R2 requirements apply to all brokered R2 Controlled Streams.
(1) An R2 Facility undertaking brokering activities shall:
(a) Declare and document all brokering activities in the R2 scope in accordance with Core Requirement
1, and
(b) Include downstream vendors receiving R2 Controlled Streams in the R2 Facility’s audited activities under Appendix A – Downstream Recycling Chain, and
(c) Maintain certification, by an accredited Certification Body, throughout the duration of its R2 certification, to an approved quality management system (QMS) standard11 with a scope that includes the brokering activities to which this Appendix F applies.
(2) For R2 Controlled Streams that are brokered, the R2 Facility shall:
(a) Identify and demonstrate conformance to all legal requirements in accordance with Core Requirement 4, and
(b) Manage the movement of all R2 Controlled Streams through their downstream recycling chain using the REC, and
(c) Be responsible for data and physical security of the equipment, components, and materials throughout transport in conformance with Core Requirement 10, and
(d) Conform to the throughput tracking requirements of Core Requirement 5, and
(e) Provide packaging requirements to the seller and/or transporter prior to shipment to conform to Core Requirement 10.
(3) If no R2 Controlled Streams ever pass through a facility of the broker, then conformance to Core Requirement 3 and Core Requirement 9 are not required.