Here are some questions to consider...

Does your organization allow any personal use of email (most companies will
allow "limited personal use" of a company email account)? If you do, you
may then be retaining communications which are not company business and
could be protected by other rules / regulations, regardless of company
policy. (You are a US-based company, so that eliminates most of the EU Data
Privacy considerations.) But there may come a time where US law requires
you to apply "right to be forgotten" rules on email. While this might not
apply to company business, it would likely apply to personal email.

What is your policy on PSTs? What is your plan for "legacy" (pre-Office
365) email? If you are not ingesting all the legacy email into Office 365,
how will it be retained? And if not retained permanently, how will you
justify the difference between the "old" and "new" policy?

Is the plan to "journal" (retain all emails, regardless of content) or only
archive email that employees have designated for retention? Keep in mind
that a large portion of email is simply garbage (spam, unsolicited email,
mailing lists, internal distribution mass mailing, etc.). If you journal,
that means all of that stuff will be retained. What about calendar entries?

Why do *vendors* want companies to retain email forever? Ask yourself that.
Make sure the lawyers ask themselves that as well. Lawyers that have to
review email get paid by the hour. Vendors that sell discovery and search
tools often charge licenses by the gigabyte. Even a well-constructed and
limited search can yield terabytes of data to be reviewed. Lawyers often
like to cast a wide net and opposition counsel (regardless of meet and
confer) WILL want to cast a wide net. What if you have a demand to produce
all email for a matter? Not simply something limited by certain terms, but
let's say a judge allows an opponent to demand all email (since you're
archiving it for your own convenience) be sent to them? What would that
look like?

When someone leaves your organization, how do you plan to retain their
email? Where will this be retained? Since you are talking about vendors, I
am assuming that you are not planning to retain email solely in Office 365
-- if you are, understand the licensing implications for dormant accounts.
This is a particular "gotcha" with Google -- Google does not yet fully
understand corporate ownership of documents and email -- it is all tied to
the individual.

What are your forensic and e-discovery capabilities? How much bandwidth do
you have going out to the cloud? Who will run the initial searches and
collections of email? Where will that happen? This has major implications
for timeliness. If you have limited bandwidth and need to download a large
volume of email to a local workstation for initial processing, you may be
hamstrung by limited bandwidth. If you have to allow a third party access
to your email in the cloud, how will you protect that access?

Is there truly a business reason to retain email forever? And do they
understand what that means? Would a ten year retention be more appropriate?
I know of one company that retains email for 30 days. Period. If you feel
you have to keep something longer, pry it out of email and save it in the
EDMS system as a Word document (the wisdom of this is a bit beyond me, but
apparently this company has made it work... for now). There are no laws
requiring you to maintain email permanently. About all you can say is that
the policy is consistent and there is no risk that someone deleted
something of importance.


It is certainly in vogue to hear people talk about keeping email "forever".
It is a simple solution to a big problem. But that has huge (literally, in
terms of volume) implications. At some point, that mass of email will
become costly -- just because Microsoft and Google give "unlimited"
storage, don't assume that will happen forever. I think Google has been
surprised at how quickly storage volumes increase based upon their contacts
with my former employer. Your lawyers need to understand the risks (out of
context, potential "smoking guns") and the costs (storage, bandwidth,
search) before assuming that archiving all email forever is a good idea.
And as I said, the first question that everyone should ask is, "Why is a
vendor recommending that we keep this stuff forever?" If Iron Mountain came
to a meeting with your lawyers and said, "We think you should keep all your
paper documents forever.", what would happen? How is email different?

Patrick Cunningham, CISM, FAI
[log in to unmask]

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]