R2v3 Certified Facilities in Pennsylvania

The Covered Device Recycling Act — Act 108 of 2010 — was enacted 23 November 2010.

Sources: Covered Device Recycling Act, Act 108 of 2010

The ban binds businesses on identical terms to households

CDRA § 506(a) provides that two years after the effective date of that section, no person may place in municipal solid waste a covered device or any of its components, excluding any nonhazardous residuals produced during recycling in any solid waste disposal facility. DEP's FAQ dates the ban and applies it to businesses expressly: beginning January 24, 2013, no business may dispose of a covered device or any of its components with its municipal waste, and from that point forward all covered devices and their components must be properly recycled.

The one relief in § 506 runs to landfills, not to generators. Section 506(b) holds an owner or operator of a solid waste disposal facility harmless if it made a good faith effort to comply, posted a conspicuous sign that covered devices will not be accepted, and notified in writing every collector registered to deposit waste there. Nothing in the section gives the business discarding the device an equivalent defence.

Sources: Covered Device Recycling Act, Act 108 of 2010 · PA DEP, CDRA frequently asked questions

But the ban covers five device types and no more

The covered devices are desktop and notebook computers, computer monitors, computer peripherals, and televisions — all marketed and intended for use by a consumer. Section 102's definition of "computer" excludes an automated typewriter, professional workstation, server, mobile telephone, portable handheld calculator, portable digital assistant and MP3 player by name. The definition of "covered device" then excludes four further categories: motor vehicle parts; a device functionally or physically a part of or connected to or integrated within equipment or a system designed and intended for use in an industrial, governmental, commercial, research and development or medical setting, or equipment designed and intended primarily for use by professional users; a device contained within a clothes washer, dryer, refrigerator, microwave, oven or range, dishwasher, room air conditioner, dehumidifier, air purifier or exercise equipment; and telephones of any type, personal digital assistants and global positioning systems.

Rack servers sit outside the CDRA by name — § 102 excludes a server from the definition of "computer" expressly. SAN arrays and network gear are not named; they sit outside on the broader ground that they are not marketed and intended for use by a consumer, and are integrated within systems designed for a commercial setting. The first is textual, the second is a reading of the exclusion.

Sources: Covered Device Recycling Act, Act 108 of 2010 · PA DEP, CDRA frequently asked questions

The consumer test is four conditions, not a headcount

This is Pennsylvania's signature trap, and it is narrower than it is usually described. CDRA § 102 defines a consumer as an occupant of a single detached dwelling unit or a single unit of a multiple dwelling unit who has used a covered device primarily for personal or small business use. It then defines that small business by four conditions joined by "and": it is independently owned or operated, it employs 50 or fewer people, it has purchased or leased a covered computer device from a computer manufacturer or retailer, and — but for the program established under this act — it would not otherwise have access to electronic recycling programs.

The headcount is one condition of four. A 20-person firm that already has access to an electronics recycling programme fails the last condition and is outside the definition on the statute's own terms, whatever its size. DEP's own page states the threshold as "fewer than 50 employees" where the Act says "50 or fewer" — a one-employee divergence sitting exactly on the cliff, and a reason to read the Act rather than the summary if a business is near the line.

Sources: Covered Device Recycling Act, Act 108 of 2010 · PA DEP, CDRA frequently asked questions

DEP is blunt about the consequence: businesses employing 50+ employees, or public entities such as schools, local government offices and religious organizations, are not covered under the CDRA and must make their own recycling arrangements, and waste generated by these entities is no different than any other type of waste and must be handled accordingly. The funding asymmetry is stated as plainly in the FAQ: manufacturers are required to make collection and recycling programs available to home-based businesses, but do not have to make them available to other businesses, and the CDRA does not prohibit any fees for the collection, transportation or recycling of any electronic devices originating from businesses that are not home-based.

A 60-person company is fully bound by the § 506 disposal ban and fully excluded from the free programme that makes compliance cheap.

Sources: PA DEP, Electronics Recycling · PA DEP, CDRA frequently asked questions

Penalties, and the gap between them is 25x

CDRA § 507(b)(2) provides that any person, including a retailer, who violates any requirement of the act may be assessed a penalty of up to $1,000 for the first violation and up to $2,000 for the second and each subsequent violation. The larger figures in the Act — $10,000 and $25,000 under § 507(b)(1) — reach only a manufacturer that fails to label its devices with a brand or fails to register and pay the registration fee.

Sources: Covered Device Recycling Act, Act 108 of 2010

The real exposure is the Solid Waste Management Act, and it runs a full ladder rather than a single rung. SWMA § 605 caps civil penalties at $25,000 per offence, with each separate day constituting a separate and distinct offence, and provides that the penalty may be assessed whether or not the violation was willful or negligent. On the criminal side § 606(a) is a summary offence at $100 to $1,000 and up to 30 days. Section 606(b) makes a violation a third-degree misdemeanour — $1,000 to $25,000 per day for each violation, or up to a year's imprisonment — escalating under § 606(c) to a second-degree misdemeanour at $2,500 to $50,000 on a repeat within two years of a conviction.

Dumping monitors in a dumpster draws a $1,000 CDRA penalty. The same act characterised as unlawful solid waste disposal under the SWMA carries $25,000 a day, and § 605 asks nothing about intent — willfulness goes to the size of the penalty, not to whether one is owed.

Sources: Covered Device Recycling Act, Act 108 of 2010 · Solid Waste Management Act, Act 97 of 1980

The felony tiers turn on conduct, not on the presence of hazardous waste. Section 606(f) reaches a person who stores, transports, treats or disposes of hazardous waste in the Commonwealth in violation of section 401 — the permit requirement — or in violation of any order of the department: a second-degree felony at $2,500 to $100,000 per day and two to ten years. Section 606(g) sits above it, reaching a person who intentionally, knowingly or recklessly does the same in violation of any provision of the act and whose acts or omissions cause pollution, a public nuisance or bodily injury: a first-degree felony at $10,000 to $500,000 per day and two to twenty years.

An earlier version of this page said § 606(f) reaches a felony "where hazardous waste is involved". It does not. It requires a violation of § 401 or of a department order. Handling hazardous waste under a valid permit and in compliance with department orders is not within the subsection however much of it there is.

Sources: Solid Waste Management Act, Act 97 of 1980

The manifest is the release

This is the provision worth building a process around, and it is the last sentence of SWMA § 605. A generator of hazardous waste who has complied with section 403 and has designated on the manifest a facility permitted to treat or dispose of its wastes shall not be held liable for civil penalties with respect to those wastes by other persons after the wastes have been transported in compliance with all applicable provisions of the act and the regulations and licences under it, and those wastes have been accepted by a disposal or treatment facility permitted to receive them and designated on the manifest.

Liability for what happens downstream ends at acceptance — but only if the manifest named a permitted facility and the load actually went there. That makes the retained manifest, matched to the facility's permit, the document that closes out the generator's exposure. A vendor's certificate of destruction is evidence of service rendered; the manifest is what the statute keys the release to.

Sources: Solid Waste Management Act, Act 97 of 1980

Section 606(i) is the criminal half of the same bargain, and it carries a warning alongside the relief. The relief: a generator who has complied with section 403 shall not be held criminally liable under this section if the wastes have been transported in compliance with the act and have been accepted by a facility designated in accordance with section 403(b)(6). The warning is the sentence before it — with respect to the offences specified in subsections (a), (b), (c) and (f), it is the legislative purpose to impose absolute liability.

Absolute liability means the second-degree felony at § 606(f) asks nothing about what the generator knew or intended. Only § 606(g), the first-degree tier, carries an intentionally, knowingly or recklessly element. So in Pennsylvania the manifest is not merely the document that limits a civil penalty — it is the named statutory defence to a strict-liability felony, and it is the only one the section offers. Ask for it, keep it, and match it to the receiving facility's permit.

Sources: Solid Waste Management Act, Act 97 of 1980

Certification: the statute and the agency disagree

We are flagging this rather than resolving it. CDRA § 505(b)(1) provides that all entities shall, at a minimum, demonstrate to the satisfaction of the department that the facility to be used to recycle covered devices has achieved and maintained third-party accredited certification from the Responsible Recycling (R2) Practices Standard, the e-Stewards standard, or an internationally accredited third-party environmental management standard. DEP says the opposite for ordinary businesses, in two documents and two formulations. Its businesses handout: businesses are not required to choose an electronics recycler that has obtained an R2, e-Steward or other third-party certification. Its FAQ: businesses are not required to utilize a certified electronics recycling facility for their electronics recycling needs; however, businesses are strongly encouraged to begin utilizing certified electronics recycling facilities.

The likely reconciliation is that § 505's all-entities language operates on entities participating in the manufacturer plans the Act creates, rather than on every generator choosing a vendor. But the statutory text does not say so on its face, and a business relying on DEP's guidance should keep a record of that guidance.

Sources: Covered Device Recycling Act, Act 108 of 2010 · PA DEP, Managing Electronic Waste Generated by a Business · PA DEP, CDRA frequently asked questions

What is genuinely mandatory is a permit, and it is jurisdictional

DEP states it in both documents and in the same terms. Whether or not a certified facility is utilized, if the facility is located in Pennsylvania, it must have obtained general permit #WMGR081 — regarding the processing and beneficial use of electronic equipment and components by sorting, disassembling or mechanical processing — from DEP. An out-of-state vendor satisfies the CDRA without it.

The one truly mandatory vendor requirement in Pennsylvania is geographic. Certification is encouraged; the permit is required, and only of processing performed in-state.

Sources: PA DEP, Managing Electronic Waste Generated by a Business · PA DEP, CDRA frequently asked questions

On the data

Breach notification: yes. A separate records-disposal statute for private businesses: none. The Breach of Personal Information Notification Act — Act 94 of 2005, amended twice since, by Act 151 of 2022 and again by Act 33 of 2024 — requires notice without unreasonable delay to any Pennsylvania resident whose unencrypted and unredacted personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorised person. The clock now runs from determination of the breach, a term the 2022 amendment defines as verification or reasonable certainty that one has occurred. More than 500 affected individuals in Pennsylvania means concurrent notice to the Office of Attorney General, and notifying more than 500 persons at one time also obliges the entity to notify every nationwide consumer reporting agency of the timing, distribution and number of notices. The fixed clocks in the Act — seven business days, three business days — apply only to State agencies, counties, public schools and municipalities, not to private businesses. Enforcement is exclusive to the Attorney General through the Unfair Trade Practices and Consumer Protection Law: no private right of action, and no penalty figure in the Act itself.

Act 94 contains no destruction or sanitisation mandate. Its only nearby provisions are a definition of business that includes an entity that destroys records, and encryption and storage-policy requirements that by their own words reach only an entity holding data on behalf of the Commonwealth. The duty to render a retired drive unreadable is a contractual and sectoral duty in Pennsylvania, not a statutory one.

Sources: Breach of Personal Information Notification Act, Act 94 of 2005 · Act 151 of 2022, amending the Breach of Personal Information Notification Act · Act 33 of 2024, amending the Breach of Personal Information Notification Act

But since June 2024 the Act does carry a cost, and it is uncapped

Section 5.4, added by Act 33 of 2024, is the provision a buyer should price. An entity that provides notification under section 5 shall assume all costs and fees in providing affected individuals access to one independent credit report, where the individual is not already entitled to one free under federal law, and access to credit monitoring services for a period of 12 months following notification. The trigger is narrower than the notice duty itself: the entity must reasonably believe that a first and last name, or a first initial and last name, was accessed in combination with a Social Security number, a bank account number, or a driver's licence or State ID number.

There is no penalty in Act 94 and no private right of action, so the Act reads cheap until this section. It is not a fine — it is twelve months of monitoring for every affected individual, and nothing caps the headcount. A retired drive holding a payroll or HR export is exactly the population that satisfies subsection (b). This is the strongest financial argument in Pennsylvania law for encrypting at rest before an asset enters the disposal chain, because the whole Act keys off unencrypted and unredacted data and never reaches encrypted data at all.

Sources: Act 33 of 2024, amending the Breach of Personal Information Notification Act · Breach of Personal Information Notification Act, Act 94 of 2005

Pennsylvania DEP. Its electronics recycling page publishes the list of registered manufacturers, and links the CDRA overview, the FAQ and the businesses handout. Both PDFs direct readers to an electronics recycling facilities web page carrying lists of permitted and certified recyclers; after DEP's migration to pa.gov that page is not reachable from the electronics recycling page, and the permitted-recycler list is not published there.

A buyer therefore cannot confirm a Pennsylvania processor's WMGR081 status from DEP's public pages as they currently stand, and should ask the vendor for the permit number and verify it with DEP directly. This directory does not cross-reference it either — a vendor's presence here is a statement about its R2v3 certification and nothing about whether it holds WMGR081.

Sources: PA DEP, Electronics Recycling · PA DEP, Managing Electronic Waste Generated by a Business