If You Must Retain E-Mail, Be Smart About It.

Many employers who historically had saved all company e-mail have been jolted into action by the Microsoft antitrust case, the American Home Products trial, and other high-profile lawsuits in which old e-mail messages have played a damaging role in court. As a result, employers are becoming more cautious about e-mail retention. If you want to reduce liability or are uncomfortable with the idea of deleting all your organisation's e-mail messages, strive for middle ground.

Some organisations, for example, opt to destroy e-mail backup routinely after 30 days. A month-long retention period enables the employer to retrieve data in the event of a crash. But because only a small number of stored documents are in the system, awaiting review, exposure is limited.

What's Your Excuse for Retaining E-Mail?

Given the risks inherent in retained e-mail, why do so many companies insist on backing up all their electronic correspondence? Some executives really do want to maintain a formal record of all business discussions and decisions. Others remain unaware of the risks associated with retaining both formal and informal electronic messages. And at some companies, the information management professionals in charge of backing up data haven't been educated about the legal exposures they are creating simply by doing their jobs.

Information management people typically are charged with ensuring that no matter what type of system crash or computer problem occurs, data is not lost and users can get back online quickly. Consequently, systems people tend to err on the side of overretention.

Employers who are sincere about reducing the risks of e-mail retention must educate their people, informing them fully of the e-risks facing the company. Once educated, technical personnel can help protect the company from risk, while still saving important data.

Sample Deletion Statement: All e-mail older than [thirty (30)] days will be automatically purged from mail queues and mail host backup. Users must explicitly save e-mail to user files when backup is required. E-mail should not be automatically saved, in order to reduce the need for system memory.

Analysis: This statement may be too technical for the average employee to understand. If you want to use a comprehensive deletion statement like this one, be sure to combine it with training that covers "mail queues", "mail host backup", "user file", and other technical terms that may appear throughout your written e-policies.

As an alternative, you may elect to draft a basic deletion statement that all employees are likely to understand. For example: "The company automatically will delete all e-mail after thirty days. When backup is required, save documents to files. Do not save e-mail messages on your hard drive."