The business risks of email and the impact of employment law May 11, 2011 By Dave Hunt, Founder & CEO of C2C

Email is mission critical in most organizations with corporate knowledge locked inside multiple inboxes. However, email overload is a major issue often addressed by IT setting restrictive mailbox quotas, resulting in users either deleting email to keep within their mailbox limits or using a default archive setting in Outlook for storage. The latter creates an enormous risk should email need to be retrieved as evidence in a civil lawsuit, a court case or compliance related procedure.

Organizations may suffer serious losses resulting from an inability to take action against wrongdoers, and an inability to defend themselves adequately against legal actions, some of which may be based on questionable evidence. Legal, compliance officers and records managers must ensure email doesn’t become a corporate liability and should have best practices in place to respond to email retrieval requests regarding investigations into employment disputes and audit and compliance related procedures.

Since 2009, more than 90% of disputes between organizations and current or former employees have included email as part of the evidence. (Source: Enterprise Strategy Group)

Legal disputes are of most concern due to their financial impact to US organizations
(Source: Fulbright Litigation Trends Survey 2010)

In disputes with former employees, organizations often settle due to lack of evidence. Email could have been used.

Civil Action Lawsuits

Email may be admitted as evidence in civil action lawsuits so organizations need to consider the practical issues this raises. These include taking steps to enhance the reliability of email evidence, to manage the storage of email effectively and to have appropriate controls in place regarding its use.

Conflict at work can cost the average employer at least 350 days of management time every year, even before the direct cost of lawsuits is taken into account. However, only six out of 10 senior managers are concerned about the impact a dispute could potentially have, especially on employee morale. Low morale is endemic in some industry sectors and is noticeable by the high staff turnover, low customer service levels, poor repeat sales rates and ultimately low profitability and high business failure rates.

In some cases there is insufficient evidence to justify action against an employee who is clearly not behaving in the interests of the employer; in others, the fairness of a dismissal made on suspect evidence is challenged in a lawsuit. For example, under the Americans with Disabilities Act (ADA), an employer must maintain records such as:

• Application forms submitted by applicants and other records related to hiring
• Requests for reasonable accommodation
• Promotion, demotion, transfer, lay-off or termination
• Rates of pay or other terms of compensation
• Selection for training or apprenticeship

The records must be held for one year after making the record or taking the action described (whichever occurs later). For example, managers need to understand that once a disabled employee requests a reasonable accommodation by asking for an additional leave of absence, the employer’s obligation to engage in the “interactive process” is triggered and if the employer fails to engage in the process and/or worse terminates the employee, the employer subjects itself to claims that it has violated the ADA.

Leave of absence issues can be tricky for employers. However, understanding the employer’s requirements under both the Family and Medical Leave Act (FMLA) and the ADA will enable the employer to ensure compliance with these important leave laws and help avoid liability in any future litigation that may arise.

Private individuals may bring lawsuits in which they can obtain court orders to stop discrimination. Individuals may also file complaints with the Attorney General, who is authorized to bring lawsuits in cases of general public importance or where a pattern or practice of discrimination is alleged. In these cases, the Attorney General may seek monetary damages and civil penalties. Although civil penalties may not exceed $55,000 for a first violation or $110,000 for any subsequent violation, the legal costs are unlikely to be recovered by organizations. Where disciplinary action is concerned, an inability to take decisive action under an “Acceptable Use Policy”, or to detect wrongdoing, based on poor records management, will weaken the ability of the employer to enforce that policy when it needs to. If there is an uncoordinated approach to enforcement, it is far easier for a dismissed employee to allege that he or she has been unfairly treated because previous offenders have escaped with lesser penalties.

In the case of an action against a former employee or supplier, the lack of readily available evidence may lead to a settlement of a dispute that might otherwise have been successfully fought and won. The weight that can be attached to favourable evidence is based on its reliability. If the email evidence was held in a secure and separate system, with an audit trail, and a policy in relation to archiving was consistently applied, that organization has the best chance of its evidence being believed. Failure to have effective archiving procedures could mean the difference between winning and losing an important case.

Mailbox quotas – Are they enforced on you?

Storage (disk space) used to be a considerable expense but that is no longer the case.

Reducing costs on storage as the key driver in enforcing mailbox quotas is a false economy so it’s a concern that 80% of organizations still impose them. Consideration should be given to the wasted time spent by your employees trying to manage their email around quotas and It’s usually your most productive workers who are most affected.

Auto-Archive – the obvious alternative?

The easiest way of keeping email and not having to delete it is to use Outlook Auto Archive.

Your Microsoft Outlook mailbox grows as items are created in the same way that papers pile up on your desk. In the paper-based world, you can occasionally shuffle through your documents and store those that are important but that are rarely used. You can discard documents that are less important, such as newspapers and magazines, based on their age. You can complete the same process in Outlook 2007 and Outlook 2003. You can manually transfer old items to a storage file by clicking Archive on the File menu, or you can have old items automatically transferred by using the Auto-Archive feature. Items are considered old when they reach the age that you specify. With the Auto-Archive feature, you can either delete or move old items. Outlook 2007 or Outlook 2003 can archive all kinds of items, but it can only locate files that are stored in an e-mail folder, such as a Microsoft Excel spreadsheet or a Microsoft Word document, that is attached to an e-mail message. A file that is not stored in an e-mail folder cannot be archived.

The issues with Auto-Archive

The files created by the Auto-Archive process reside on your server, desktop or laptop computer. If they are on your desktop or laptop, IT will not be aware of them and they will not be backed up. If they become corrupted or if you have a hardware problem, the data may be lost without considerable effort to recover it. Sensitive, corporate information may be locked inside these files, which may need to be produced to a deadline in a legal or compliance case.

Does Outlook automatically create Auto-Archive files for you?

Until the release of Office 2010, automatic creation of Auto-Archive files was the default setting for Outlook unless it was disabled. As a result, files are created on a daily basis without user or IT knowledge.

How can an organization avoid Auto-Archive files?

More than 56% of organizations try to search Auto-Archive files, but because of their complexity, it is difficult and expensive to find specific data without using specialized software. The business requires IT to find, repair and reduce the impact to the organization although they may be reticent to help as employees have created the files in the first instance to avoid their mailbox quotas.

Why keep copies of email if backups are in place?

A backup is a temporary copy of the email system at any one time, it is not a long term secure retention system created to preserve company data for a set number of years.

Who is ultimately responsible?

Responsibility for email should be a company level activity as it is a face to the world, in the same way as your web-site. The priorities of IT will be determined by factors including budget, rather than the impact of poor company results, bad publicity and low staff morale should the organization face employment tribunals or court cases.

How is the problem solved?

The solutions to this issue is not complex or time-consuming

Solution Scenario

Venango County

Pennsylvania’s Venango County has approximately 57,000 people across its nine boroughs and 20 townships and they can ask for information about any organization, business, investigation, historical event or incident; a third party, a deceased person or about themselves.

Business Issue

In accordance with the Freedom of Information Laws, government agencies have to respond to such information requests. However, the process had been dependent on the back-up of mailboxes to tapes on a nightly basis. A copy of an e-mail that may have been needed for legal matters could not be retrieved. If it had been deleted, Venango County couldn’t always go back far enough on the tape, putting them at risk of non-compliance with Freedom of Information Laws and HIPAA requirements. However, being prepared for inquiries about email is a constant challenge which administrators must be able and ready to meet.

When prosecutors sought evidence to accuse a local investment firm from charges of stealing more than $1 million from the coffers of Venango County, local information technology officials could not produce the crucial email. The case and the firm was found guilty, but local technology officials were left scrambling to identify an electronic discovery function to enable them to comply with this critical requirement and avoid this predicament.

Solution

Archive One Compliance from C2C has helped us reduce risk.” Says Bill Kresinski, MIS Director, County of Venango, Pennsylvania. Venango’s local government departments (such as the Tax Claim Bureau, Veterans Services and Voter Registration/Elections) and elected officials (auditors, district attorneys and the sheriff) are all subject to Freedom of Information Laws. The archiving, retention and retrieval management application for Microsoft Exchange is designed to provide a full discovery and audit trail to organizations that need to comply with the vast array of country, government, industry and corporate rules and regulations for email retention and retrieval.

HIPAA sensitivity

In addition, many of Venango’s Human Services departments: Area Agency on Aging, Children and Youth, Mental Health, Mental Retardation, Protective Services, Substance Abuse Programs and Veterans’ Office — are also subject to HIPAA (Healthcare Insurance Portability and Accountability Act). HIPAA, a privacy law that regulates access to personal information, explains how, when and why the departments may use and disclose a patient’s health information. Since information is often exchanged via email, Venango needed an enhanced archiving solution.