Failing to retain electronic data could put you in legal quagmire

Only 70% of nearly 1,600 organizations include electronic records in their records management programs, according to a 2007 Electronic Records Management Survey conducted by Cohasset Associates, a Chicago information management consultancy. Emerging types of electronic records got even less attention. The 70% figure was up from 65% in 2005, suggesting awareness is spreading; however, only 16% of those surveyed by Cohasset had policies on retaining voice messages. Instant messages came close behind at 15%. Yet today the same rules can apply to electronic records – whether word-processing files, PDFs, spreadsheets, medical images, e-mails or voice mails – as would apply if the information were stored more traditionally. And you ignore at your peril the legal requirements to retain such data in an accessible and tamper-proof form. For example, British Columbia’s Interior Health Authority creates about 16 terabytes of medical images each year, yet provincial legislation requires that those images be kept at least seven years if the patient is an adult, and if he or she is under 21 they must be retained until the patient is 28. Keeping them on the authority’s primary storage-area network would be too costly, and tape will not work because of reliability and the difficulty of finding data when needed, says Roy Southby, the authority’s director of information technology in Kelowna, BC. The answer is a Centera archival system from Hopkinton, MA-based storage vendor EMC Corp. The health authority also archives e-mail on a Centera system, using software that sorts through the material to save only one copy of each attached file and allows users to search and retrieve the archived mail. With most business information now stored electronically, ensuring that the way it is kept meets legal obligations can be vital. Yet many organizations haven’t given the issue the attention the Interior Health Authority has. Electronic discovery or e-discovery is the process of gathering electronic information relevant to a lawsuit. It is now clear in Canada that electronic information is subject to the same discovery rules as paper files. As a result, a document must be kept for the same period of time whether it is electronic or hard copy. Myriad laws lay out the requirements, some of which – like tax law – apply to all or most businesses and some of which concern only narrow sectors. Key areas of concern include tax, litigation and securities legislation. The rules depend on where you are – and what you do Nova Scotia introduced new rules January 1 to address electronic production and discovery and similar changes are expected in Ontario this summer, says Martin Felsky, president of Toronto electronic discovery specialists Commonwealth Legal. Alberta and British Columbia have issued practice directions on electronic records. The basic rule of thumb is that as soon as there is reason to expect possible litigation, you are responsible for preserving any information that might be relevant for as long as there is a chance it might be needed, says Kathryn Manning, knowledge management lawyer for the litigation group at national law firm Blake, Cassels and Graydon LLP in Toronto. But, Manning adds, “the best way to be prepared for litigation is to be prepared before.” And if possibly relevant information has been destroyed, the best defence is that it was disposed of in line with consistent rules. “You can’t be faulted if you follow your policy,” Manning says. So too with securities regulation. Regulations generally say businesses should maintain records appropriately and consistently rather than spelling out exact procedures, says Rick Dales, vice-president of product management for Sunnyvale, CA-based Proofpoint Inc., a maker of e-mail security and archiving software. A company might be faulted for inappropriate policies, but this will be a slap on the wrist next to the consequences of having none, he says. Specific to Canada, documents related to tax filings must be kept for six years beyond the current year in case of an audit, says Christine Ardern, principal consultant at Information Management Specialists, a Toronto records management consultancy. How data is stored is also important. The section on retention in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) says a document must be kept in its original format, or in a format that doesn’t change the information it contains. This applies for as long as relevant legislation requires. The document must also be readable by anyone entitled to access. Several provinces have electronic transaction acts, under which the key point is that “you have to be able to prove that the electronic records have not been tampered with,” Ardern says. More specialized laws govern some industries. Banks are subject to the Bank Act, health-care organizations to provincial laws such as Ontario’s Personal Health Information Protection Act (PHIPA) and Alberta’s Health Information Act, pharmaceutical companies to requirements to preserve information about clinical drug trials, and on and on. “One approach is to just throw up your hands and say ‘I’m just going to keep everything’,” says Andy Cohen, vice-president of compliance solutions and associate general counsel EMC Corp. But today’s volumes of electronic information make that prohibitive. “Information has a life cycle,” Cohen says, “and once that life cycle is over, it goes from being an asset to being a liability... you look at that information and sort of run it through a risk and priority filter.” Ardern says any organization should know what legislation governs its particular industry, so developing an electronic data retention strategy starts with identifying what data the enterprise has, then looking at what relevant legislation says about retaining that data and putting policies and technology in place to meet those requirements. How to do what you must Once you know what you need to do, the next question is how. Whatever you must keep needs to be stored reliably so it will be readable and easy to find if needed in a few years. “I really believe you need an archiving strategy,” Cohen says – and that doesn’t mean a room full of backup tapes. “There’s operational cost to maintaining all of those tapes,” he says, and finding information later can be very costly and time-consuming. And tape just doesn’t work for medical images, says Southby at the Interior Health Authority, which has completely eliminated tape from its data centre. Before anything enters an archive, it should go through de-duplication. Whether it’s spreadsheets, word-processing documents or e-mail, many copies of a document often exist within an organization. De-duplication saves information only once. Many organizations use tiered storage to keep archival costs reasonable. Current information goes on fast, readily accessible storage devices. Archival uses slower systems. Information lifecycle management software can move data from one level of storage to another, and dispose of it when the time comes, based on preset policies. That’s what Toromont Industries Ltd.’s Toromont CAT unit does. The Mississauga, ON-based heavy equipment maker installed a Hewlett-Packard Development Co. fibre channel storage-area network four years ago. “It quickly became clear to us that storing seldom-used, unstructured file data on what is deemed to be an expensive storage solution did not make much economic sense,” says Bradley White, Toromont’s manager of distributed computing. So Toromont CAT added an iSCSI SAN from Dell Inc. subsidiary EqualLogic Inc. in Nashua, NH, and transfers data more than a year old to the slower, lower-cost storage technology. Data archival software manages that process and backs up the archives. So far, White says, Toromont hasn’t established a procedure for deleting data from the archives. To ensure information isn’t tampered with, some systems use software that calculates a hash code based on the file’s contents. If the file is altered, the hash code no longer matches. Some systems, like EMC’s, also provide tamper-proofing at the hardware level. Proofpoint archives e-mail in encrypted, read-only format. While more than half of enterprises are now thinking about managing electronic records, most haven’t addressed the growing volume of multimedia content. An obvious issue is voice mail, increasingly in digital form and similar in content to e-mail. The problem is that it’s much harder to index, Dales says. “Most of the voice mail to text services that are out there include a big room of people,” he says. “They run the message through their automated system and then hand it off to a person to clean it up before it goes – and that creates security risks and so on. “The technology is definitely emerging,” Dales continues, “but it’s probably a couple of years before we’ll see wide-scale deployment.” And what if you install all the right systems, follow policies and procedures to the letter, but a technology failure destroys important data? There could be hassles, but you’ll be better off than if you had simply been careless. “If you can show that you took all the reasonable steps that you should have taken,” Manning says, “ if at the end of the day something crashes or some tape gets eaten, I think the court will be more understanding.”

Failing to retain electronic data could put you in legal quagmire

News | 02/17/2009 7:26 pm EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us