Email legal requirements

[Cools]

Just to check.. and get documentation on it..

i was toled by our LEA we had to keep email for 7 years as a legal requirements, sent to and from the school email accounts.

where can i find documents on this??

thanks..

[MK-2]

is this on a server hosted by them? do they mean every single email ever sent and received on your server?

surely that would mean if i emailed you 500 times with a 5mb attachment, you legally have to keep every one of those emails for 7 years wasting space?

[Cools]

Yep.. that is what i was toled..
Every email. apart from the ones blocked by the spam filters.
ever sent and recived for every one, Archived to for min 7 years..

just need to find the paaper work that says it.. if there is any...

[nephilim]

Unless there is something to do with tax or pay rates, then I highly doubt they meant all unless they are willing to shell out for a few terrabyte nas boxes and get the exchange servers archiving

[Heebeejeebee]

I was thinking about this just the other day when I was reading about a case (that made the headlines) where there was an email trail going back several years. I can see why this would be desirable at the highest level but surely they don't expect us cash strapped schools to dedicate TBs of space to old email that in all probability isn't going to get looked at. Yes I know the reasons why, and yes I probably would if I could but without the resources ...

HBJB

[sparkeh]

Personally I would go back to the LA and ask for evidence of this legal requirement.

[pete]

The last time I checked you had to:

a) Have an email retention policy.
b) Stick to it.
c) It has to be "reasonable*".
d) A judge can decide that it's not reasonable if you're clearly taking the michael**.

Your LA may have minimum retention times for schools it's responsible for.


*certain litigation-heavy industries have a "you can't keep an email past 90 days" policy to frustrate** discovery actions.

[Achandler]

Its to do with FOI requests being able to be back dated for 7 years, emails are considered like letters.

[GrumbleDook]

The legal requirement covers 2 areas.

1 - Principle 5 of DPA : personal data should not be kept longer than is required
2 - All companies and public bodies have document retention schedules which apply to hard and electronic copy.

The Information and Records Management Society has a good guide on document retention schedules and your Bursar / Business Manager will probably already have this in place. Also remember that some copies of information does not need to be kept in multiple formats so should you print off emails, save the email as a file or save the text into a longer document, then that can be sufficient to support the retention schedule.

You may choose to retain archives of PST files rather than an archive of sent / received emails.

Also remember that a backup is not the same as an archive. They can be darned close ... but check how you need to access your archive.

The DPA principle 5 is a bit of a catch-all really. It goes back to how we allow users to use email systems. If it is work related then there is no real issue, but we know it is not always like that so there is a balancing act that has to go on about where the priority sits.

I do know of a few schools that retain no emails but they have clear instructions to staff that all relevant files / information *must* be saved into particular areas on the network or communication has to go via particular systems (in this case sharepoint based).

Until it gets presented in court it is hard to tie down what is right or wrong, but the only consistent advice is to be consistent about whatever you do.

[sparkeh]

Personally I would go back to the LA and ask for evidence of this legal requirement.

Just to expand on this, if you manage to get written guidance from your LA on this matter (and follow it) then you are going some way to covering yourself in case of any issues in the future.