Retaining emails for old/left staff

[E_G_R2]

Hi,

 

what do people do about staff who have left email accounts in case they have kept an important message/document in their email.

 

Senior staff here seem to use email as a filing system and our head is about to leave and I just know that someone will need something from their email account.

 

Any advice on best practice (disable and keep, archiving or anything else?)

[Fazza]

We have a journaling account so if anything is needed we can get it from that so deleting mailboxes for users that have left is OK.

 

For someone like the Head, I would export their mailbox to a .pst file and save it in a secure area on the network in case the new head needs/wants it.

[mjk]

Does anyone know what the position should be if people ask for their data to be deleted?

(right to be forgotten GDPR etc)

[just_david]

1. Have a clear rule on what Email accounts are to be used for - nothing personal etc

2. A clear retention policy that everyone knows of (1 month past their leaving date was ours)

3. Leave them to it

 

As part of any handover period that was when these important emails should be shared.

 

All our staff knew months in advance when they were leaving so the above worked well.

[Arcolite]

We tend to disable the account at the end of their contract (end of August usually).

The account is left in this state for a month, after which it's either removed or exported to a PST (depending on the users role).

 

For key roles, I try to keep things segmented off into sub mailboxes (Trips@ or Exams@) therefore if someone leaves, only the sub mailbox needs to change hands, not the user mailbox.

In theory...can lead a house to water and all that...

Edited July 25, 2017 by Arcolite

[Bedders]

...can lead a house to water and all that...

 

Wow, I've never tried that before, could you let me know how you moved it?

 

We use Exclaimer Mail Archiver here at our business. Great bit of software with a fantastic array of Active Directory-based permissions. When a user leaves, their team members can still search their external emails (filtering on the Archiver allows internal emails to be separate to external ones, and AD Security groups allow team members access to their colleagues' external archive).

[Arcolite]

Wow, I've never tried that before, could you let me know how you moved it?

 

Gah! That'll teach me for using my phone. Stupid auto-correct. Could have been worse though I guess!

[elsiegee40]

Does anyone know what the position should be if people ask for their data to be deleted?

(right to be forgotten GDPR etc)

 

Right to be forgotten has to be balanced with the school retaining data for Safeguarding reasons. There may be a need to trawl an email account due to allegations of historical abuse, say.

 

It's not straightforward

 

Tagging @GrumbleDook and moving this to the Information Handling forum

[Geoff]

Separate Mailbox database in Exchange for 'Users that have left'. We also archive with a cloud provider, Mimecast for 7 years.

[GrumbleDook]

I have an open query with DfE on this. Will feedback when I have an answer.

[jmak]

For the head's email, we use a head@ account which is passed from a departing head to the new head.

 

Interested to know what the guidance is on other accounts though.

[mjk]

Right to be forgotten has to be balanced with the school retaining data for Safeguarding reasons. There may be a need to trawl an email account due to allegations of historical abuse, say.

 

It's not straightforward

Definately not straightforward.

I don't believe that hundreds of peoples email and personal details should be stored on school systems incase one person commited a crime many years ago, It seems disproportionate and not in keeping with data protection doctrine. I hope the DfE instruct us to delete the data a few months or weeks after staff leave.

[enjay]

1. Have a clear rule on what Email accounts are to be used for - nothing personal etc

2. A clear retention policy that everyone knows of (1 month past their leaving date was ours)

3. Leave them to it

 

As part of any handover period that was when these important emails should be shared.

 

All our staff knew months in advance when they were leaving so the above worked well.

 

Pretty much what we do too. When staff know they're leaving, they generally have time to tidy things up for handover; it is only the senior staff or unexpected leavers (long-term sick then not return, or maternity starting early) which could cause a problem. Policy states all data held on our network may be viewed by others at Leadership's discretion, so if anything isn't handed over either I can get it or I can give someone else access to go find it.

 

For someone like the Headteacher, I suspect she would ask for her entire mailbox to be made available to her replacement - she is a subscriber to the "you never know when you'll be asked for historic data" theory of data retention.

 

The policy regarding retention of email after leaving should be the same for their MyDocs folders, though. I can't see a reason for different policy or practice.

[enjay]

For the head's email, we use a head@ account which is passed from a departing head to the new head.

We have one of those too but it is full of junk-mail (historically, every school in our county had one, so it made the address an easy target!), so it is checked by HT's PA instead.