Over Half of Businesses Lack a Clear Email Retention Policy

The revised Federal Rules of Civil Procedure (FRCP) set aggressive
timelines for the discovery of electronic information, such as email,
and strict penalties for the destruction of evidence. The revised FRCP
also include safe harbor provisions to protect organizations that
implement standard retention policies for electronically stored
information. The rules, which were drafted by the Supreme Court and
approved by Congress and the U.S. Judicial Conference, have already had
a profound effect on the way the U.S. legal system handles electronic
evidence including emails and digital files.

Companies Remain Unprepared for Litigation

Section 37(f) of the revised FRCP allows for the destruction of
email and other electronic documents, as long as the deletion is part
of a standard retention policy. Despite the clear requirements, the
Email Archiving Practices Survey showed that most organizations are not
prepared:

• * 53 percent of companies lack a policy to govern email retention and deletion.
• * 67 percent of companies allow individual end users to determine how long messages are kept by the company.
• * 66
  percent of companies do not have the email archiving technology
  required to manage email retention, litigation holds and e-Discovery.

In the event of litigation, these companies would likely be required
to search back-up tapes, desktop files and legacy systems to find
information that was deleted in the absence of a good-faith retention
policy. Manual e-Discovery searches can cost hundreds of thousands or
even millions of dollars. In addition, these companies risk being
sanctioned for the illegal destruction of evidence, including courtroom
penalties that can cost a company an important legal case on process
grounds.

”The survey reveals serious legal issues for organizations that are
either ignoring the new federal mandates for compliance and e-Discovery
or are clearly not well educated on how to meet the technical
requirements,” said Michael Osterman, CEO of Osterman Research. “Many
recent court cases have shown that companies are expected to show a
clear retention policy. The time is now for all companies to set and
manage retention policies for their entire organization.”

No Consensus on Retention Strategy

While the revised FRCP provide a strong incentive for potential
litigants to put email retention policies in place, they do not provide
any guidance on the contents of the actual policies. As a result,
companies have taken vastly different approaches to email retention:

47 percent of companies have implemented email retention policies.

36 percent of companies keep all messages for the duration of their
policy while 64 percent vary retention policies based on a pre-defined
criteria. Within this group, 50 percent vary retention policies by
user, department or business unit and 50 percent set policies by
message content.

The average retention period varies greatly by company. 21 percent
of companies keep messages, on average, for more than 5-years; 43
percent keep messages for 1 to 5-years; 36 percent of companies keep
messages for less than 1-year.

77 percent of companies have at least one retention policy that
dictates that messages are kept more than 5 years. 36 percent have a
policy that dictates that some messages are kept for longer than
10-years.

Retention strategies typically reflect an individual corporation’s
philosophy around email and litigation. Companies that view email as a
strategic asset and who value the context provided by email in
litigation keep email messages for many years. Other companies view
email as a necessary evil and who worry about “smoking guns” tend to
delete messages as quickly as possible.

2008 Will Be the Year of Email Management

Although most companies are not prepared to meet the new FRCP
requirements, the survey results show that 64 percent of companies plan
to implement new email retention policies over the next 12 months.

One of the reasons that companies have been slow to comply with the
new requirements is that there are typically many stakeholders involved
in setting retention policies. According to the survey:

• Legal typically drives the development of retention
  policies. The legal team is involved in setting policies at 81 percent
  of companies.
• Other stakeholders that are typically involved include IT (72 percent of companies) and compliance (65 percent of companies).
• Business
  stakeholders play a less important role in the development of retention
  policies. Only 48 percent of companies included business managers in
  the process and only 28 percent included records managers in the
  development of email retention policies.

MessageOne

Osterman Research Inc.