Email retention.

Data management and retention has never received a high profile within organisations until recently, particularly now in the UK we are beginning to look more closely at how we maintain our records and the ability to recall the information we need quickly.

Some organisations feel that the US has given us a sneak preview of the effects of not keeping accurate records with the highly publicised demise of Enron/Anderson. Others feel that the introduction of the freedom of Information Act is enough to warrant introducing new technology or simply gaining protection against Civil or Criminal claims disgruntled employees may make.

Whatever the drivers for improving the way a company shares and retains data, we have the ability to create, capture, transmit and store e-records in a trust worthy and accurate fashion.

At the present time there is little concern regarding the legality of e-records and whether they can provide evidential weight. In fact, a number of regulations introduced or updated both here and in the US over the past few years have made clear, that in more instances than ever before, e-records will satisfy the legal requirements of the courts and regulators.

In order for emails to be considered valid evidence in court however, they must be considered to have 'evidential weight' so that the information presented may be considered to be an accurate and true record that has not been tampered with during its lifecycle.

To give guidance as to how electronic records should be stored to provide admissibility in court and to have due evidential weight, the British Standards Institute created the Code of Practice for Legal Admissibility of Information Stored Electronically--BSI-DISC PD 0008 which has been renamed BIP 0008 in its 2004 third edition. The Code describes the means by which it may be demonstrated in a manner acceptable to a court of law that:

"The contents of a specific data file created or existing within a computer system have not changed since the time of storage; and where such a data file contains a digitised image of a physical source document, the digitised image is a true facsimile of that source document."

To achieve admissibility and evidential weight, the code suggests users adopt five guiding principles, which are briefly summarised below:

Principle 1: Recognise and understand Senior management should adopt an Information Management Policy Document and review it regularly. This document should specify what information is covered, how each type will be stored, relevant security classifications; define retention/destruction periods and state management ownership responsibilities for the information.

Principle 2: Legal issues and duty of care It is recommended that organisations adopt an Information Security Policy with certain minimum requirements. A Disaster Recovery Plan is also recommended. Consultation with regulators, government bodies, auditors, legal advisors etc is also recommended regarding external implications of using electronic information management systems.

Principle 3: Processes and procedures Organisations should maintain a Procedures Manual for each information management system covered by the Code. Examples of relevant procedures are information capture, indexing, backup and system recovery, version control, security and protection.

Principle 4: Enabling technologies A Systems Description Manual is recommended, it should describe how hardware, software and network elements interact. The manual should detail systems configurations, detail changes made such that the details of the system may be determined for any point during its lifecycle.

Principle 5: Monitor and audit The code requires sufficient audit trail information to be kept to enable authenticity of stored information to be proved in court. This should include both audit trail information of the stored information and the system used. This might include the date of storage and details of movement from one storage medium to another.

Conclusion:

There is no legal obligation to retain email records unless their particular nature would render them relevant to the requirements of legislation or regulatory bodies. However, the potential requirement to prosecute or defend civil and criminal actions makes email retention a sensible precaution.

If it is impractical to classify email records for the purposes of assigning separate retention periods, it may be sensible to set a default retention period for all email that will be determined by the longest retention period appropriate to the organisation.

www.storage-expo.com