The Folly of 90-Day Email Retention

Companies that trash their email too quickly are asking for trouble. The motivation for considering a short retention policy for emails may be a concern that "something" in the emails could turn out to be damaging to the company (or possibly incriminating in regulatory investigations or litigation). Or it may be driven by a desire to limit or control the size of individual mailboxes on the mail server. Either way, the conclusion is that it’s safer not to have the emails at all; the underlying notion is that because the records are in emails, the rules of records retention do not apply. Such a conclusion is a grave mistake, however. Email Is Not a Record TypeEmail is not a record type. E-mail is a delivery system like FedEx or the postal service. When it comes to retention rules, what matters is the content of the message, not the way in which it was delivered. Retention rules are based on the purpose, use or content of the message. If a given record would be retained when originated in paper form, that record must also be retained when it originates in email—and it must be retained for the same period of time as a similar physical record would be kept. The courts have determined that the rules that govern the retention of the paper records also apply to emails. One intent of a short email retention policy is to manage mailbox sizes on mail servers. Periodically, employees reach the mailbox limits and are asked to "clean up" their mailboxes. Wanting to keep the emails for reference, employees move the mailboxes from the mail server to their laptops or desktops. But central systems do not back up these files and cannot search them. The problems that result are twofold. First, if a company is in litigation, the U.S. Federal Rule of Civil Procedures (FRCP) obligates the company to provide the names and addresses of all people that have information relevant to the case, and to surrender all related documents (even before discovery requests). If the emails are on desktops and laptops, employee names should be provided and the relevant files on their desktops collected for submission in the case. Obviously, this will be difficult and time-consuming—if not impossible—to do completely. Second, if the emails are deleted and no copies remain within the company, there are new risks, as several recent court decisions have made clear:In a 1988 case, the courts ruled that litigants were required to retain documents that they knew or should have known would become material at some point in the future. A 1995 decision made it clear that data in computerized form is discoverable even if paper hard copies of the information have been produced. A third ruling establishes a clear obligation to preserve records, noting, "Spoliation is the destruction or material alteration of evidence or failure to preserve property for another’s use as evidence in pending or reasonably foreseeable litigation." In a fourth case, in light of a clear precedent for the obligation to preserve records, a $ I million penalty was assessed because the company persistently ignored the requirement. Lastly, Sarbanes-Oxley Sections 802 and 1102 introduce felony penalties for record tampering that may apply to email that is not retained properly. If a company strives to run an honest business, short email retention strategies not only introduce new risk but also reduce the company’s abilities to manage its employee conduct and protect itself if there are problems. Failure to properly manage records, email included, also sends a signal to the investment community that something might be amiss. Court OpinionsThe courts are consistent in their opinions regarding email retention:E-mail is not a record type, it is a delivery and storage method. The content and use of the email is what determines its retention requirements. Deleting emails or letting them "disappear" is regarded by the courts as "spoliation," the destruction of records. Under new laws it is a felony punishable by fines and imprisonment of up to 10 or 20 years to remove or let disappear records that are required to be retained.E-mails Have a Life of Their OwnOne final note: There is a common misconception that just because emails have been removed from one mail server, they are gone. Every email has a sender and at least one receiver, often more. Once people receive an email, they often send it to others, or save it for personal reference or protection. Some send it off to a personal mailbox outside the company. Just because an email has been deleted from the corporate mail server does not ensure that it is gone. If that email is presented as evidence against a company, not only does the question arise of why the company has no copy of its own—but how does the company prove the email has not been altered from the original? A company may intend for a short retention strategy to protect the enterprise. The truth is that a short retention strategy exposes the enterprise to more risk, not less. Short retention strategies for emails and other documents are short-sighted. Such strategies are risky business. Reprinted by permission of Business Communications Review, www.bcr.com. Thomas Bookwalter is president of FMDC, a records management and compliance consulting company. He has been personally involved in the design and implementation of numerous compliant records management solutions. He can he reached at Thomas@fmdc.com or by phone at 908-812-5000.

The Folly of 90-Day Email Retention

News | 06/28/2005 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us