Exposing legal land mines: protecting the privacy and integrity of e-records is a critical issue for information professionals; understanding e-records laws and company policies can help. (Legal Watch).

The legal landscape is changing rapidly with the passage of new laws whose intent is to bring technology under control through the legal system. These new laws provide guidance not only on what is considered an electronic record or electronic signature but also on how these technologies should create and maintain data to meet legal evidentiary requirements and ensure its privacy.

The new laws cover a wide variety of complex issues, but there is one that is most important: the privacy of collected information, both on the Internet and within corporate systems. What these laws do not address is the hidden legal menace of spoliation -- the intentional or unintentional destruction of evidence -- that can cause great harm to a business in litigation or in achieving compliance under a regulatory agency.

There is no federal privacy requirement in the United States for electronically created or captured information. In this area the United States has adopted the policy of self-regulation rather than imposed regulation, with some exceptions, which are addressed later. The Federal Trade Commission (FTC), under the authority of the Federal Trade Commission Act, has the authority to monitor unfair or deceptive trade practices of businesses. This is done by reviewing the privacy policy posted on a business' Web site.

Although a business is not required to adopt a privacy policy, if it does adopt one and does not follow that policy, the FTC may bring an enforcement action against the company for unfair or deceptive practices. Possible consequences of not complying with the posted privacy policy would be the issuance of a cease and desist order or the imposition of civil fines. Most actions have been settled with the FTC rather than litigated.

A congressional report recently released details of how government Web sites use cookies and collect social security numbers in violation of federal law. Of the 10 sites that reported policies, not one was meeting the provisions of its own stated privacy policy.

Companies must be aware that the European Union (E.U.) has stringent privacy rules for data protection and these rules affect companies doing business with E.U. member countries, whether traditionally or over the Internet. In August 2001, a survey of 75 U.S. corporate Web sites found that none measured up to the E.U. standards for ensuring the privacy of customers' personal information.

U.S. regulations ensuring privacy protection are focused in three major areas: information collected from children, financial information, and health information.

Protecting Children

The Children's Online Privacy Protection Act of 1998 (COPPA), which was enacted on October 21, 1998, and became effective April 21, 2000, is directed at companies whose Web sites are intended for children or who have actual knowledge that a person from whom they collect information is a child. It regulates the online collection, use, and disclosure of individually identifiable information of children under the age of 13 years. COPPA requires parental consent prior to online collection of information about children, and sites must have prominent links to their privacy policy on all pages.

Recent studies suggest that companies need to be more attentive to the requirements of COPPA and the consequences of non-compliance. The Center for Media Education issued a report in April 2001 in which 153 Web sites were examined. The majority did not obtain prior parental consent or provide parental notice before collecting personal information from children and did not feature prominent links to their privacy policies as required by COPPA. Violations of COPPA are prosecuted by the FTC under section 5 of the FTC Act as unfair or deceptive trade practices. Penalties may include civil fines up to $11,000 per violation, attorney's fees, and injunctive measures to stop non-compliant practices.

COPPA recognizes a safe harbor, or protection from penalty, for companies that comply with self-regulatory guidelines, which are issued by online businesses and approved by the FTC. The first self-regulatory business recognized by the FTC as a safe harbor is the Children's Advertising Review Unit (CARU) of the Better Business Bureau. The FTC will consider businesses that comply with the CARU guidelines to be in compliance with COPPA.

Protecting Financial Information

The Gramm-Leach-Bliley Act, also called the Financial Services Modernization Law, was enacted on November 12, 1999. This act permits financial holding companies to sell banking, securities, and insurance products and services through an organization comprised of one or more related entities. Subtitle A of Title V of Gramm-Leach-Bliley, "Disclosure of Nonpublic Personal Information," imposes certain obligations and restrictions on a financial institution's collection, use, and disclosure of nonpublic consumer personal information.

Various federal agencies that regulate the financial services industry were required by Congress to adopt rules to implement the privacy standards of the Gramm-Leach-Bliley Act. These agencies are the Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve System (FRB), Federal Deposit Insurance Corporation (FDIC), Office of Thrift Supervision (OTS), National Credit Union Administration, Securities and Exchange Commission, and the FTC. Each agency has issued regulations, and mandatory compliance with these regulations was required by July 1, 2001. In addition, the OCC, OTS, FRB, and FDIC issued guidelines relating to administrative, technical, and physical security measures, also effective July 1, 2001.

Consequences of failure to comply with the requirements of Gramm-Leach-Bliley and the regulations of the other agencies can result in civil and/or criminal remedies and penalties. A recent report from the Center for Democracy and Technology found that several online mortgage companies fail to disclose privacy policies and most online banks fail to accommodate consumers wanting to keep their personal financial information private, thereby in violation of Gramm-Leach-Bliley.

Protecting Health Information

The Health Insurance Portability and Accountability Act (HIPAA), which went into effect on April 14, 2001, regulates the use or disclosure of all forms of personally identifiable health information by health plans, health care clearinghouses, and certain health care providers and business associates. Most affected entities have until April 14, 2003, to comply with HIPAA. Health plans with annual receipts of $5 million or less have until April 14, 2004, to comply.

Some of the requirements of HIPAA include:

* Notice - Covered entities must inform individuals of the uses that may be made of their protected health information and of any options they have to prevent it from being used by the covered entity or disclosed to outside parties. They must also provide a privacy-policy notice about the individual's rights, the covered entities' duties, and the types of information uses and disclosures that may be made.

* Accuracy -- HIPAA imposes no duty on the covered entities to ensure that the information collected is complete or accurate.

* Access and correction - Individuals have the right to access, inspect, and

obtain a copy of protected information in a "designated record set" for as long as the information is maintained. Entities may provide a summary of the requested material instead of the full file of information, provided that the individual has agreed upon this in advance. Entities must act on a request for access no later than 30 days after receipt of the request.

* Security -- Entities must implement policies and procedures to enable the verification of an individual's identity or entity requesting protected information. Covered entities must ensure that valid contracts are in place to cover their business associates' compliance with HIPAA requirements.

Non-compliance with HIPAA will result in civil penalties from the Department of Health and Human Services' Office of Civil Rights. Violations can result in a penalty of up to $250,000 and a prison term of 10 years for the unlawful acquisition or disclosure of individually identifiable health information relating to an individual. Violators could also be charged with a federal crime for willful violations of the regulations.

Destruction Issues

Spoliation of evidence is defined as the "... destruction of evidence. The destruction or the significant and meaningful alteration of a document of instrument." Spoliation arises from the duty to preserve evidence. The duty to preserve can come from existing, pending, or reasonably foreseeable litigation, through state or federal law, contract, or a company's record retention policy. Spoliation becomes a legal hazard when dealing with electronic records due to the ease of their creation, duplication, and alteration. Special care must be afforded to electronic documents to retain their integrity and to prevent unauthorized alteration and/or deletion. This goes not only to the security of the data, but of the system itself as well. Limiting access to documents to those people required to have access for their jobs will limit the potential for unauthorized access and alteration.

A company must have the appropriate policies and procedures to put a legal hold on the destruction of records during litigation. Even routine functions, like rotation of back-up tapes, may invoke a cause for spoliation of evidence if documents on the backup tapes are not available from another source. The consequences of having a spoliation charge during litigation can be severe. Many companies have been -- and will be -- heavily sanctioned monetarily for failure to protect their documents during litigation.

There are generally two methods that courts rely upon to remedy spoliation: recognizing an independent cause of action for intentional and/or negligent spoliation and engaging in civil discovery or evidentiary sanctions in pending litigation (Koesel, Bell, and Turnbull 2000). Only 12 states and the District of Columbia have recognized an independent cause of action for spoliation of evidence. They are Alabama, Alaska, Florida, Idaho, Illinois, Indiana, Kansas, Louisiana, Montana, New Mexico, New Jersey, and Ohio. Other states rely on the authority of the court to implement sanctions. The authority to impose sanctions on a party for failure to produce evidence in violation of the discovery rules comes from the federal and state rules of civil procedure. These rules give the courts broad discretion to impose a variety of sanctions.

Why are these new laws of importance to records and information managers? Many of these new laws may create new record series that must be scheduled and added to the retention policy. Long-term retention issues need to be addressed, specifically for information being retained in electronic format.

Understandably, all electronic records are not created equal, depending upon their use, and there are specific retention issues for records that use electronic signature technologies. The new laws, both federal and state, provide the requirements that must be met in order to ensure the privacy, integrity, and security of electronic records. Records and information managers should be able to identify the laws that affect their businesses and understand the requirements for retaining electronic information.

Every company needs to understand the legal landscape for their records, both paper and electronic, to avoid the landmines that may detonate as a result of non-compliance. Like the old saying goes, ignorance of the law is no excuse.

At the Core

This article:

* Lists the various new e-record laws

* Investigates how these laws are affecting information management

* Looks at establishing company policies for document destruction

Read More About It

Black, Henry C. Black's Law Dictionary, 7th Ed. New York: Kluwer Law International, 2001.

Center for Democracy and Technology at www.cdt.org/privacy/(provides privacy resources, including information about ConsumerPrivacyGuide.org, an online resource providing consumers with tips and other information on how to better protect their privacy)

Center for Media Education at www.cme.org/children/privacy/coppa_rept.pdf (provides a report on Web site compliance with COPPA)

Children's Advertising Review Unit at www.caru.org/carusubpgs/harborpg.asp (describes the CARU Safe Harbor Program to aid its supporters in protecting the privacy of children online and meeting the requirements of COPPA)

Gramm-Leach-Bliley Act at thomas.loc.gov/cgi-bin/query/z?c106:S.900.ENR: (provides the full text of the act)

"Highlights of Recent IG Reports on Internet Data Collection," 2001. Available at www.senate.gov/~thompson/pr061801b.html (provides a summary of a report that reveals many U.S. government agencies are violating the federal Internet privacy rules for data collection)

Koesel, Margaret M., David A. Bell, Tracey L. Turnbull, and Dan Gourash. Spoliation of Evidence, Sanctions, and Remedies for Destruction of Evidence in Civil Litigation. Chicago: American Bar Association, 2000.

U.S. Department of Health and Human Services at aspe.os.dhhs.gov/admnsimp/ (provides guidance on Standards for Privacy of Individually Identifiable Health Information regulation)

"Web Banks Come Up Short on Privacy," August 2001. Available at news.cnet.com/news/0-1005-200-7004484.html

Rae N. Cogar, J.D., is a consultant with RCS Consulting in Hamburg, New York. She can be reached at [e-mail].