IT Security Standard: Email Retention

Brief Description:

University responsibilities regarding the disposition and retention of electronic messages

Related Policy:

• Cal Poly Electronic Mail and Messaging Policy
• Systemwide Records Information Retention and Disposition Schedules Implementation
• Cal Poly Information Security Program
• Cal Poly Information Technology Responsible Use Policy
• CSU Information Security Policy

Introduction:

Electronic mail and messaging services are a means to transmit information. Email is not, in and of itself, a university record series for which a schedule exists. However, electronic messages may contain content raising them to the level of an official record that is subject to established university information retention and disposition policies. In addition, electronic messages stored on university information resources are subject to discovery and can be used as evidence in the event of litigation.

The following standard advises employees and managers of their responsibilities regarding the disposition and retention of electronic messages.

Scope:

This retention policy/standard applies to:

1. All electronic mail and messaging systems provided or funded (in part or in whole) by Cal Poly;
2. All users and account holders of Cal Poly electronic mail and messaging accounts; and
3. All messages sent or received using Cal Poly electronic mail and messaging systems.

Standard:

Electronic messages generally fall into three categories:

1. Lasting-Value Messages, i.e., messages that document the business of the university or are deemed to have lasting value as defined by Executive Order 1031 and are subject to record retention schedules.  Examples include administrative actions taken or planned, reports or recommendations, policies, procedures, guidelines, rubrics, or templates, etc.
2. Transitory Messages, i.e., messages created for routine communication or information exchange with no lasting value as defined by Executive Order 1031. Examples include meeting or event notices, internal requests for information, announcements, routine inquiries, etc.  
3. Personal Messages, i.e., non-record messages such as lunch arrangements between friends, etc.

Disposition of Messages

Transitory and personal messages should be read and promptly deleted or as soon as their usefulness has ended.

Messages, records and information with lasting value constitute an official university record and must be managed in accordance with established university retention and disposition schedules.

Messages deemed to have lasting value must be stored in an auditable file structure or medium until their scheduled disposition date. This may be accomplished by:

1. Electronically storing the message in a searchable message archive (the equivalent of an electronic filing cabinet) within the enterprise email account, e.g., by date or subject folder.
2. Printing and storing a copy of the message in a paper document file. The printed copy must contain the following minimum header information:
   1. Who sent the message
   2. Who the message was sent to
   3. Date and time the message was sent
   4. Subject

Regardless of how and where stored, when their scheduled disposition point is reached, messages must be destroyed in a way that precludes restoration and recovery using established campus practices.

The legal custodian of an electronic message will normally be the originator if that person is a university employee; otherwise, it will be the individual to whom the message is addressed once the message is received. The legal custodian is the person responsible for ensuring compliance with this standard.

When an employee leaves a department or the university, the department head is responsible for ensuring that any messages, records and information with lasting value in the separating employee’s possession are properly transferred to the department’s control for retention and disposition purposes.

Information Technology Services will provide access to an individual’s enterprise electronic mail and messaging account only after receiving written authorization from the appropriate campus authority.

Responsibility for Retention of Messages with Lasting Value

The burden of determining whether a specific message has lasting value should fall to the department responsible for that particular class or series of records – typically the originator or legal custodian of those records.  Other recipients should not retain messages longer than required for their respective job purposes. When that need no longer exists, the information should be destroyed. In other words, only the department responsible for retention of a specific type of information or record shall store and control the disposition of information, including that which is in electronic form.

Questions about the proper classification (transitory or lasting value) of a specific message, record, or piece of information should be directed to the employee’s unit head, manager, or department chair, and/or to the originator or legal custodian of the applicable record.

Default Retention Period

Messages stored in active accounts on Cal Poly’s enterprise email system are retained indefinitely. The retention period is currently limited only by the amount of storage allocated to each account.

For active accounts, messages stored in default folders (such as In-Box, Send, Trash, and Junk) will be deleted in accordance with established purge cycles.  Account holders are responsible for ensuring that messages of lasting value are moved to an appropriate archive folder prior to the scheduled purge.

Unless a litigation hold has been placed, messages stored in inactive accounts are permanently deleted when the account is purged, based on established university practices.  

Litigation Holds

When litigation is pending or threatened against the University or its employees, the law imposes a duty upon the university to preserve all documents and records that pertain to the issues. A litigation hold directive must be issued by the University Legal Counsel to the legal custodians of those documents.

A litigation hold directive overrides this standard as well as any record retention schedules that may have otherwise called for the transfer, disposal or destruction of relevant documents, until the hold has been cleared.

Electronic mail and accounts of separated employees that have been placed on litigation hold status must be maintained until the hold is released, including messages archived in electronic and paper form.

No employee who has received a litigation hold directive may alter or delete an electronic record that falls within the scope of that hold. Those employees are required to provide access to or copies of any electronic records that they have downloaded and saved, or moved to some other storage account or device, including archived copies in paper form.

Definitions:

Lasting Value - When the contents of an electronic message exhibits one or more of the following characteristics, it should be classified as having lasting value:

• Has operational value (required by a department to perform its primary function)
• Has legal or evidential value (required to be kept by law, e.g., litigation hold or internal investigation
• Has fiscal value (related to the financial transactions of the campus, e.g., required for financial reporting and audits)
• Has historical significance (of long-term value to document past events, e.g., may arise from exceptional age and/or some significant historical event)
• Has vital value (critical to maintain to ensure operational continuity after a disruption or disaster, e.g.,  vital records or information may fall into any one of the above value categories

Administrative Officials – Managers with responsibility for overseeing a university department or unit.

Official University Record – Information in electronic or paper form that documents university business and is required to be retained based on established university record retention schedules.

Appropriate Campus Authority – Campus entity with the authority (acquired through policy or law) to approve requests to access and/or preserve an individual’s account without the individual’s knowledge or permission, e.g., University Legal Counsel, Human Resources, Academic Records, etc.

Legal Requests – Subpoenas, court orders, public records request, or other valid legal documents seeking university information.

Responsibilities:

Information Technology Services (ITS)

• Establish and publish standards for electronic mail and messaging account administration
• Provide facilities and instructions for moving messages with lasting value to archived folders within the centralized email environment
• Provide the required end user training and service desk support
• Establish and implement cycles for purging messages in default folders
• Manage central server implementations of litigation holds issued by University Legal Counsel
• Manage central server implementations of other legal requests for information as determined by the appropriate campus authority
• Suspend automatic deletion processes, as necessary to preserve specific electronic messages, records and information that fall within the scope of the litigation hold, and that reside on active servers maintained by ITS

Administrative Officials:

• Are responsible for providing records retention guidance to faculty and staff in their respective units.  The guidance provided must be in accordance with this standard and CSU Executive Order 1031, System wide Records/Information Retention and Disposition Schedules Implementation.

Originators and custodians of electronic messages, records, and information that have lasting value are responsible for:

• Appropriately identifying and retaining such records
• Seeking assistance from their respective unit managers or department heads when unsure about how to categorize specific types of messages.

University employees who have been notified of a litigation hold

• Are responsible for preserving all messages, records, and information that fall within the scope of the hold that they have downloaded and/or stored locally.

All users are expected to:

• regularly check for new messages
• delete transitory messages as quickly as possible
• create archive folders for storing messages of lasting value
• routinely move messages with lasting value to those archive folders
• delete messages in archive folders at the end of their prescribed retention period

Service providers who manage email services on behalf of the university must:

• Adhere to established retention and disposition schedules
• Abide by any contractual agreements with respect to retention and disposition of messages
• Comply with university requests to generate, retain or otherwise handle university records

University Legal Counsel

• Is responsible for determining when a litigation hold is placed and for notifying the appropriate university entities or individuals as to what is required.

• Reviews legal requests for information and advises appropriate campus entities how to respond.

Related Procedures and Resources:

• CSU Record Retention Schedules
• Cal Poly Record Retention Schedules
• Cal Poly Information Classification and Handling Standard
• Cal Poly Record Retention Standard
• Cal Poly Designated Information Authorities - for record retention purposes
• Cal Poly Email Policies, Standards and Practices
• Account Eligibility and Purge Practices – account deletion schedules (enterprise email accounts)
• CSU Office of General Counsel Manuals - Records Access, Subpoenas
• Litigation Holds - CSU General Counsel’s Office presentation
• Litigation Holds – Cal Poly Guidelines (PDF)

Implementation

Effective Date:	9/30/2010
Review Frequency:	Annual
Responsible Officer:	Vice Provost/Chief Information Officer

Revision History

Date	Action	Pages
9/30/2010	Release of draft standard	All
10/1/2010-3/21/2011	Review and comment by Administrative Advisory Committee on Computing (AACC), Instructional Advisory Committee on Computing (IACC) and Information Resource Management Policy and Planning Committee (IRMPPC)	All
3/22/2011	Final draft endorsed by IRMPPC	All
April 2011	Release of approved standard	All