Top Ten Issues in International Records Retention
Aug 01, 2010 Top Ten Download PDF
By Paul Smith and Diana Newcombe
Paul Smith and Diana Newcombe, Eversheds LLP
The Records Retention agenda has recently come to the fore again, with proposed amendments to the US Federal Sentencing Guidelines, recommending that “high-level personnel and substantial authority personnel be aware of the organisation’s document retention policies and conform any such policy to meet the goals of an effective compliance program”. A subsequent provision refers to the same obligation in respect of employees. This will heighten the need, of which many companies are already aware, to develop a records retention policy and schedule of documents, identity relevant regulatory obligations and roll the strategy out throughout their operation.
Implementing a records retention policy is a challenging task for any organisation. This is particularly the case in respect of companies with international operations where regulations concerning the retention and destruction of records across multiple jurisdictions have to be taken into account and that analysis combined with litigation limitation periods and strict emphasis on data privacy principles.
We have set out below ten of the current issues that you should address in your international records and information management project.
Effective international retention policies need be written in a user-friendly, straightforward format, and where appropriate translated into local language. It is easy for document schedules to grow to hundreds of pages as you try to map every document type handled by every team. Editing and consolidating all of the different categories is hard work and time consuming but pays dividends when it comes to implementation.
2. International Document Schedules
In developing the classes of documents that are included in the schedule, companies should also consider areas where categories of documents are additional to those maintained in the US. There may be specific regulatory requirements that will vary from country to country across Europe but which might not be anticipated in a US schedule. For example, in the UK, the Working Time Regulations 1998, which implement the EU Working Time Directive with respect to a limitation on the number of hours worked per week, require that documents showing compliance be retained for two years. In addition, the UK put in place provisions entitling workers to “opt out” of the 48-hour working week in order to work longer hours. The retention period for those opt-out agreements is not specified, but they need to be available for inspection by regulators upon request; the effect is that these records should be retained indefinitely. That opt out provision is not mirrored in other member states and, accordingly, it is an additional, jurisdiction-specific requirement.
3. Obtaining International Legal Information
Having developed a schedule (and refined it where possible), it is important to ensure that you have a clear understanding of the relevant international laws. There are a number of complexities to consider in developing the international regulatory review. While ascertaining the law in Western Europe might be reasonably simple, a number of jurisdictions can present particular challenges, either because the law is difficult to ascertain, or there a number of overlapping approaches adding to the already complex US picture. The initial identification of laws can be very complex in jurisdictions where the laws are not easily accessible, particularly through electronic means, such as the former Russian states.
An example of the different layers of international laws is the U.A.E. Like many jurisdictions in the Middle East, there are limited specific laws on records retention. There are some provisions in labour laws, laws regarding the ownership of property, and in insurance laws. Laws in freezones, however, also need to be taken into account. For example, the freezones of Jebel Ali and Ras Al Khaimah, as well as the Dubai International Finance Centre, require accounting records to be retained for a minimum of ten years. The Abu Dhabi Media Zone regulations state that business records must be retained for as long as the company is in operation in the freezone and for 5 years after ceasing operations.
4. Integrating with Statutes of Limitation
Different legal systems and approaches have, of course, given rise to a wide range of limitation periods within which an action should be commenced. In civil jurisdictions, these windows of opportunity are called “Periods of Prescription”. A simple contact matter in England and Wales should be commenced within six years if the document is not executed as a deed. Action on a similar contract in Italy, France, Switzerland or Scandinavia would be open for ten years.
For employee records, the retention period may reflect the statute of limitations for personal injury claims. For employers in some industries, the actual period of retention chosen may be considerably longer than in others because claims for ailments associated with work in that sector, such as exposure to asbestos, may not emerge until many years later. You may choose to retain some information so as to provide references or in relation to pensions administration.
5. Retention Form
In addition to understanding the retention period, it is also important to understand whether there is a required retention form for the data. Electronic archiving is commonly adopted as a solution for implementation of retention policies, and also to support centralised shared service programmes intra-group. However, an often overlooked issue is that some countries prescribe that certain documents be retained in their original form, e.g. board minutes, documents under seal, trust documents and original documents that are subject to court proceedings.
6. Data Privacy Overlay
Data protection laws in Europe require that personal information not be kept for any longer than is necessary for the purposes for which it is collected. Unfortunately, unlike records retention obligations, this is often not clearly stated: there is very little guidance from the data protection authorities as to just how long is necessary for any given purpose. In the UK, draft guidance on specific retention periods for Human Resources records was withdrawn by the Information Commissioner’s office. In practice, however, this apparent lack of specifics can be helpful, as it reserves the flexibility for the controller to keep the data for such period as is objectively justifiable. The main point then is not that personal information can't be retained, but more that you should think about whether all of the personal information about the person concerned needs to be kept for a particular purpose.
Care should be taken when setting international retention periods with respect to personal information. Whereas the approach that might commonly be taken is one of setting the retention period at the longest generally applicable period, with individual exceptions, it is important to compare the proposed retention period with local laws. If the company is proposing to hold personal information for significantly longer periods than required in that country, data privacy laws might be breached.
7. International Roll Out
Having decided what the retention period is going to be, how do you ensure that the data will be treated in that way? The technical solutions are still playing catch up in this regard, particularly when it comes to email. When you have no control over the content of an email or how many copies are circulating around the business, how do you ensure that it is archived correctly? It is virtually impossible in electronic environments to audit trail emails: email sent, forwarded and resent multiple times, each recipient copy stored on multiple media (hard drives, portable devices). Many take a simplistic view of emails - setting up automatic archiving after a given period of time, e.g. three or six months. The problem arises where information within those emails would (if it were printed out on paper) be retained for a shorter or longer period of time than has been pre-set for the emails. In a world in which electronic communication accounts for the larger proportion of most peoples’ work output and will increasingly do so, that is far from a satisfactory solution. E-filing solutions therefore need to be considered carefully. You should consider whether these can be adopted so that those communications necessary for compliance are retained. The challenge is keeping that workable where human intervention is required; there is always a real danger that given colleagues’ busy working lives, the default setting absorbs more than you.
8. Keeping Up-to-date with International Developments
Regulatory obligations are of course frequently changing, and it is important to have a regular (annual or bi-annual) review of laws. We would suggest a more regular review in jurisdictions where the organisation has an important, complex or high-risk business and in countries where laws can change frequently, as in the Middle East.
You should also put in place a method for adapting to significant changes as they arise and adjusting the policy in the event of important but unanticipated change. The legal position on electronic records is a subject of frequent attention from European governments as they endeavour to balance document retention objectives with the need for personal privacy. International organisations should monitor developments in this area closely. For example, German courts have recently determined that a 2008 law requiring telecommunications companies to retain telephone and internet data for six months (in accordance with a 2006 EU Directive on Data Retention) is unconstitutional. That information should then have been deleted immediately.
8. Document Destruction
It is essential that policies also address data destruction in order to avoid issues arising at the time when destruction is proposed. To implement this policy you will need to tap into the existing culture and use that knowledge to influence change. In short, you need to work with your HR, IT and internal PR colleagues to plan a campaign to win hearts and minds.
9. Litigation Holds
A related issue is managing litigation holds on documents where documents are retained for actual or pending litigation. It is important that, where documents may be required from international businesses, there is a clear method for communicating the need for a litigation hold and a process for securing the documents and ensuring that they are not altered. This is particularly important with electronic records. On receipt of a litigation hold notice, the Legal Department should have an established process for contacting the relevant owners of the documents, providing details of the requirements, and seeking confirmation as to whether documents are retained or not in that business unit. Management of documents where there is actual or anticipated litigation should also be addressed in the business training.
Building an effective international records retention program is a tough but important exercise. Ultimately, the program will repay the effort invested with greater protection afforded though the compliance controls, improved ability to address discovery claims and greater efficiency and cost control arising from the orderly storage of documents and their destruction.
Additional ACC Resources
ACC Resource Library - Top Ten - Sponsored by Arent Fox LLP
ACC Resource Library - QuickCounsel - Sponsored by Arent Fox LLP
ACC Resource Library - Sample Form & Policy - Sponsored by Arent Fox LLP
ACC Resource Library - Primer