Feature

posted 25 Jul 2002 in Volume 5 Issue 3

E-mail: Retention, disposal and dealing with misuse

The use of e-mail has become so popular that it is used widely across all types of business. All who use it applaud the speed and efficiency gained by its use and the e-mail has become an integral part of day-to-day business. However, law firms, just as any other business, are susceptible to the risks attendant upon its misuse. We need only think back to the recent case of Weil Gotshal & Manges, where it fell foul of e-mail communication in its handling of the bankruptcy of Global Crossing, to understand the potential risks. Stephen Mason, barrister and chairman of Pario Communications, examines the legal requirements and considerations that all businesses must employ if e-mail is to continue to be such a central component of everyday business.

One well-known example of the misuse of the internal e-mail system is the case of Norwich Union Insurance Company and Western Provident Association, dating from 1997. Employees of Norwich Union spread rumours, distributed internally by e-mail, that Western Provident was being investigated by the Department of Trade and Industry and that the group was close to insolvency. Western Provident subsequently:

Obtained an injunction that required Norwich Union to provide a copy of the relevant e-mail;
Was granted an order requiring the company secretary of Norwich Union to examine its employees in sales to determine whether anybody had repeated the defamatory remarks to potential customers, and to produce an affidavit in which the results were set out in full.

This particular case was settled out of court when Norwich Union paid Western Provident £450,000, admitted the rumours were false, deeply regretted such e-mails were sent and sincerely apologised to Western Provident for the dissemination of the rumours. The reader will be aware that the costs of this case will have been significantly higher than the amount of the settlement made by Norwich Union to Western Provident. The actions of Norwich Union in failing to prevent such e-mails from being written in the first place could be described as a self-inflicted weakness, which in turn caused a loss of reputation and reduced profit.

Misconceived retention and disposal policy. The recent case of McCabe v British American Tobacco [2002] VSC 73, decided by His Honour Judge Eames in April 2002, serves to highlight the importance of ensuring a document retention and disposal policy is objective and not open to being misconstrued.

During the autumn of 2001, Rolah McCabe initiated legal action against British American in Australia. Both sides consented to a speedy trial because Ms McCabe had a life expectancy of months, possibly weeks. The date of the trial was set for 18 February 2002, but a range of pre-trial issues had to be resolved before the trial commenced, in particular the discovery and admissibility of relevant

documents from British American, who were reluctant to deliver up documents to her lawyers. The lawyers for Ms McCabe applied to the judge for British American’s defence to be struck out and judgement be entered for her because there was no possibility of a fair trial taking place.

For this reason, a hearing concerning these issues started on 30 January 2002 and continued to 1 March 2002. During the course of this hearing, the judge:

Was provided with volumes of witness statements;
Was given copies of letters and other documents relating to the legal advice offered by a number of firms of lawyers in Australia and England in relation to the British American document retention policy;
Listened to the evidence of a number of lawyers, senior managers and directors of British American.

The judge had to determine whether Ms McCabe was able to receive a fair trial. If she could not receive a fair trial, he then had to decide whether judgment be entered against British American. Having heard the evidence, the judge decided that British American:

Had a document retention and disposal policy, but the original policy and subsequent versions of the policy were intended to permit the destruction of documents relating to British American's knowledge of the health risks of smoking, the addictive qualities of cigarettes and its response to such knowledge;

Knew there was a possibility of legal action being taken against them at the time the destruction of documents were authorised, but destroyed the documents anyway;

Destroyed material contained in electronic format on CD Roms, together with evidence of the contents of each CD Rom (which meant it could not be determined what records had been destroyed), even though it would have been possible to retain such records because of the minimal space required for storage purposes.

The judge concluded that British American subverted the process of discovery with the deliberate intention of denying a fair trial to Ms McCabe, in that most of the relevant documents were no longer available. He ordered their defence to be struck out and judgement was entered for Ms McCabe. Damages were later assessed at $700,000.

This case illustrates the need to ensure you can justify your retention and disposal policy. While your policy will take shape around the operational requirements of your business, you must take the various legal requirements into account to ensure your policy is both reasonable and measured.

Retaining documents

It is neither practical nor necessary to keep every document created in a business. With the introduction of electronic storage methods, it is possible to retain bulky documents in a fraction of the space that hard copies will occupy. However, now documents are created in electronic format, you will need to ensure your document retention and disposal policy reflects the way in which your employees create, alter and manipulate electronic documents. This includes correspondence passing through your e-mail system.

The types of document you have to retain, and how long you retain them for, will partly depend on the nature of your business. Some documents created during the course of a business are common to all organisations, and provisions are made in the relevant legislation for the retention of such documents. In addition, some acts of Parliament also create an offence to destroy documents before the time laid down has elapsed.

Examples of statutory retention periods:
accounting records

By way of example, consider how long you should retain records relating to your accounts. First, by section 222(5) of the Companies Act 1985, records relating to company accounts must be retained (subject to the rules made under section 411 of the Insolvency Act 1986):

In the case of a public company, for a minimum of six years from the date they were made;
In the case of a private company, for a minimum of three years from the date they were made.

A company director or officer of a company is guilty if an offence if they fail to take all reasonable steps to ensure the company complies with the provisions of section 222(5), or intentionally causes the company to fail to retain such records. The penalties are a term of imprisonment of up to a maximum of two years or a fine of up to £5,000, or both.

To complicate matters, the requirements of section 222(5) have to be considered in the light of other factors. For instance, the Inland Revenue may decide to conduct an investigation into a tax liability. By section 20 of the Taxes Management Act 1970, a person or business is required to deliver up or make available for inspection all documents in their possession that might reasonably contain information that is relevant to such an investigation.

The problems are compounded when considering the provisions of sections 34 and 36. Section 34 provides that the period for making an assessment for corporation tax is six years from the end of the year to which the assessment relates. However, where the Inland Revenue has reasonable grounds to believe tax has not been paid because of fraudulent or negligent conduct, under section 36, the period is extended to 21 years after the end of the accounting period to which the investigation relates.

Examples of statutory retention periods: employee records

An employer is required to retain certain documents in accordance with the Taxes Management Act 1970. For instance, section 15 requires you to retain all papers relating to payments made to employees for six years. Such records include summaries of expenses, payments made on behalf of the employee, payments made that are connected to the business and details of benefits in kind.

Further, an employer is required, by Regulation 55 of The Income Tax Employments) Regulations 1993 (S. I. 1993/744), to produce the records that relate to the calculation of pay. These records must be retained for at least three years after the end of the year to which they relate. The types of document you must retain include wage sheets, deductions from working sheets, working sheets, certificates (unless such certificates must be sent to an inspector) and all other relevant records.

Examples of limitation periods

In most cases, there is a limitation on the period of time that can pass beyond which you cannot begin legal proceedings. Placing a time limit on the period that can go by before legal proceedings can start encourages certainty, which in turn helps a company to set a relatively precise date on the retention and disposal of certain types of document.

Although there is some certainty with respect to the periods of time documents should be retained, section 32 of the Limitation Act 1980 also provides for the postponement of the start of a limitation period. These are where:

The person defending the action has acted fraudulently;
Facts that are relevant to a claim have been deliberately concealed by the defending party;
The person initiating legal action asks the court for help to rectify the consequences of a mistake that may have been made.

Further, in the case of personal injuries, judges have discretion, under the provisions of section 33, to waive the time limit completely.

The business response to limitation and retention periods for e-mail

The reader will readily note that the document retention and disposal policy needs to reflect:

The service the firm sells;
The statutory and legal retention periods;
The likelihood of legal action being taken;
Suitable control and archiving of electronic documents, including e-mails.

Each company has different requirements, and it is imperative in the light of the Enron scandal and the British American case above that due care is given to comply with the legal and statutory duties consistent with keeping retention costs down and providing for the efficient performance of the business.

To understand the need to ensure your document retention and disposal policy deals with the archiving of e-mails appropriately, consider the use to which e-mail is put today:

Some time ago the accounts department decided that all motor mileage claim forms and miscellaneous claim forms would only be available on the company intranet in electronic format. Employees are required to fill in the electronic form online and submit the form to their head of department by adding their electronic signature to the form instead of signing it with a manuscript signature. In turn, the head of department authorises the claim by affixing their electronic signature to the form and sending it to the accounts department. In the meantime, the accounts department have been sending and receiving invoices electronically for some years now, dealing with any queries by way of e-mail correspondence (including with the Inland Revenue and Customs and Excise).

The HR department have decided to require those employees that fill out time sheets in respect of overtime, to submit their claims using the electronic facilities recently installed.

While the above scenario does not reflect the use to which technology is put in every business, nevertheless e-mail facilities have become a significant tool with which employees communicate both within the company and externally. In reflecting upon how your e-mail facilities are used, it is conceivable that your company requires to reassess how you deal with e-mail traffic. The scenarios set out above illustrates the need to retain all:

Internal e-mails relating to motor mileage claims and miscellaneous claims for six years;
Invoices sent out of the company for a minimum of seven years;
Claims for overtime for three years;

Documents relating to any contracts they may have entered by way of exchange of e-mails for a minimum of six years, bearing in mind a claim can be made from the date of the breach, which means if the contract is open-ended, the documents must continue to be retained until the contract is terminated.

None of the above examples can be described as best practice in every instance. It may be, as with the British American case above, that you are or become aware that legal action is possible in the future. Given such knowledge, it is crucial to obtain appropriate legal advice before you take action to dispose of records. If you destroy records in the knowledge that legal action is possible, a judge may well make adverse inferences against you in the event a legal action is initiated, as in the British American case outlined above.

Dealing with e-mail misuse

Many companies find the implementation of an e-mail policy is fraught with complications. If employees are permitted to use the e-mail facilities for private use, you will need a policy that must be enforced if you want to rely on its provisions should you need to take disciplinary action. As a result of having a policy, you will need to consider offering guidance, including, but not limited to such issues as:

Differentiating between private and company correspondence;
Controlling the communication of confidential information;
Sending or receiving unusually large e-mails or attachments;
The dangers of propagating computer viruses;
Preventing the sustained use of e-mails that substantially hinders others in their use of the network.

As any lawyer specialising in employment law will confirm, the numbers of employees disciplined for improper use of e-mail facilities has grown, as has the number of claims made by employees that have been dismissed for misusing the e-mail system. The costs of enforcing the policy can be expensive, and failing to implement the policy properly, by linking it to your disciplinary and grievance policy for instance, leaves many employers no option other than to settle claims with former employees before a tribunal hearing.

The Data Protection Act 1998

A further problem that few employers recognise when they permit employees to use the system for private e-mails, are the employer’s duties under the provisions of the Data Protection Act 1998. An individual, perhaps an employee or ex-employee, has the right to ask for all e-mails that contain personal data. If your e-mail system does not archive e-mails in a way that makes searches for personal data easy, complying with a request to deliver up all e-mails containing personal data for a named individual can be a lengthy and expensive process.

An added complication when deciding on a suitable e-mail retention policy relates to the data protection principle that does not permit you to retain personal data for longer than is necessary. This provision is in conflict to many business requirements, and careful consideration must be paid to this issue when revising your policy.

A technical solution?

You can diminish some of the problems you face with enforcing your e-mail policy by incorporating your e-mail system into the wider document retention and disposal policy. To do this effectively, you will need to consider an appropriate technical solution that enables you to:

Document the changes to the lifetime of each e-mail as it is sent, returned, copied and where text is cut and pasted;
Archive each e-mail and each change to each e-mail that ensures e-mails cannot be altered or changed without leaving an audit trail;
Set appropriate retention dates for each type of e-mail that is sent or received, and to allow you to search quickly and effectively for personal data to comply with your duties under the Data Protection Act 1998;
Create a policy that applies at the organisational level that prevents individuals making independent decisions about the retention and disposal of e-mails on their computer.

Conclusion

You need to consider how you are going to carry out your duty to retain and dispose of e-mails in accordance with the wide variety of inconsistent legislation and regulations that deal with the retention of documents. When you begin your search for a technical solution to this problem, you may also find an answer to the problems you face with the misuse of your e-mail facilities. It is possible that Norwich Union may not have faced the problems they experienced, if they had a suitable technical e-mail archiving and retention solution in operation at the relevant time. Once each employee becomes aware that every e-mail they send and receive is subject to an audit trail, has a retention period and will be archived, it is probable that they will be less likely to send your database to their personal e-mail account six months before they leave.

Stephen Mason is a barrister who advises on matters relating to commercial law and e-risks. For further information, contact stephenmason@parioc.co.uk, or visit p://www.parioc.co.uk.