Why is it CEXs responsibility?
It just is. Unfortunately I know this from experience working for a major mobile phone recycler.
If we don't data wipe phones, securely, we run the risk of prosecution under the data protection act.
I wonder if CEX are ISO 27001 certified.