Several weeks ago Ron Miller wrote a piece about a potential smoking gun email in the Google/Oracle Java patent suit where he cites Cyrus Mistry’s 2010 AIIM keynote. As Ron recalls, Mistry declared “Everyone gets access to all data and keep it forever.” I was at the same event and my reaction at the time was similar to Miller’s. I found the position quaint and condescendingly naive. While I don’t recall a specific conversation I am sure that at some point I said – “eventually this will come back to bite them” and it appears that is what has happened.
There are several ordinary reasons why we implement records management and retention policies. Compliance with global privacy regulations for example. But in all cases we are trained in ECM that every piece of electronic data is potentially electronic evidence and you should purge it at the earliest opportunity. This is how I have advised customers for years and in the industry we build whole programs around it. The problem is this approach ignores one simple thing that is lost in the process. The truth.
Setting aside the specifics of the Google/Oracle suit, the principle that says if I delete the data it ceases to be a threat may not be entirely true. We forget that data itself is not always a real thing. Data often represents something else. The email is not often what the court is looking for in the first place. It is the intent of the senders reflected in the message. The only thing that changes when I remove the email is that I have now made it more difficult to prove or disprove guilt. Deleting the record does not make you innocent.
There was a time when we would suggest that we dispose of data because of constraints like storage cost and manageability. The cloud however offers the potential for theoretically infinite storage at affordable cost and minimal operational impact. Most organizations of any size will find it hard to justify the destruction of electronic records based on cost of retention alone. As a matter of policy then the only non-regulated reason that a company removes data then is to prevent wrong doing from coming to light.
Policy cannot establish character but it can promote damage to it. When protection from risk takes precedence over right and moral behavior we inevitably create an organization that will be less inclined to behave rightly in the first place. The very character of an organization is eroded when the adherence to policy becomes the sole justification for any act but especially the act of destroying potential evidence.
Ironically then, as Google is probably modifying their own email retention policies I am coming around to agreeing with the share and keep forever idea Mistry promoted. Not because there is a lack of risk but because all else being equal – it is probably just the right thing to do.
Lee Dallas
Marko Sillanpää
So not applying retention policies could become a public demonstration of virtuous business practices.
It is not the application of retention policies at issue. It is the intent (cultural and/or fiscal) behind them. Is retention defined for the primary purpose of removing data from scope of future discovery. (e.g.risk avoidance)
Have you dealt closely with litigation for many years? How many petabytes of carp do you want to store and pass on the cost?
With all the “cheapness” of storage, it’s still costing companies 20% of their IT budget. Good call since 80% is short-term stuff that no one wants again. Of course you could buy something like Watson as a nice capital investment which you can pass on too. Companies are hammered to control and lower cost.
Retention is based on law, value, cost and risk. Risk cuts both ways too. That nice piece of information that was valuable once can hurt you later when no one from its creation is left to further explain/defend it.
Thanks for the comment Randy
exactly how many carp and in a petabyte – sounds fishy..
Seriously though -you rightly state the four pillars of retention but embedded in your argument is another question – exactly how do you determine enmasse what content has no value at all. I am the first one to admit that the VAST majority of content spinning on disks today is essentially worthless
The point is not that there isn’t content that can and should be removed. The point is that we use overly simplistic justifications for summarily deleting data based on cost metrics and assumptions that may no longer be valid – when the real motive is obfuscating the historical record.
The contextual point is an interesting one and I have no doubt there are examples of that occurring. I am however asking an ethical question.
You are ask to prove a negative which is impossible. No one can say that an arbitrary document will NEVER be a threat. The potential for threat does not establish its existence. The fact that the threat might exist may equally be used as justification to keep it.
This whole idea is completely contrary to what I have thought and taught until now. I am simply pondering whether or not it is morally right to establish a policy that deletes data for the sole purpose of protecting oneself. Hiding truth behind the policy.
Great article. Even with the “keep everything” approach, we still need retention policies. While we may decide against disposing of content, we need to be able to prevent deletion of that content as well. History is lost if people start randomly deleting.
-Pie
If a company is basing it’s retention on the issue that a bad document exists, it has far more issues than a shareholder should invest in. I have never had a conversation on retention where worrying about a bad document was included. In fact a bad document does not mean that unethical or illegal activity is taking place.
I have supported litigations for 25 years and often a bad document started as a good document. Unfortunately the English language is open to interpretation which is compounded by the fact that we read with a certain mindset and emotion. Documents do not capture every thought, activity, behind the scenes, etc. So as ‘tacit’ knowledge disappears the defense of the document can become more difficult.
Finding value in documents take an investment of time, understanding of contents, business process and needs. I could add a few more. It is the only way to break through the perceptions many end users have (which have been interesting). It is more than just mapping data flow and systems. The newer content analytic tools may help. Can anyone say retention schedule based on analytic findings tagged back to the records?
Hi Lee,
You are posing an ethical question, whether destroying old documents is the ‘right thing to do’. I can think of some situations where destroying documents actually is the right thing to do in my opinion. For instance in situations where personal privacy is at stake. I sleep better a night, nowing that my internet provider will keep my browsing history no longer than a year. Year-end review reports are fortunalty deleted from personell files after a few years. Not to cover up illegal activity, but to protect the individual.
The idea of everything being kept forever is the start of the Really Big Brother.
Hi Sander – don’t you think though that we live with an incredible sense of false security – there is no way that I can ever KNOW my information is purged. I can only know that it hasn’t been when something bad happens. Big brother or not – with today’s technology privacy is a fantasy we indulge in. A deliberate naivite we embrace and is the price we pay to play in the electronic world.
Randy – I love the term tacit knowledge as another way of describing context. point taken with regard to loss of context being a serious concern. I am not advocating that retention policies are based on the fact that bad documents exist – RM systems however are sold every day based on the idea that they will remove documents before they spoil on you either by loosing context OR by actually demonstrating culpability. In either case – you never really know what threats or truths are removed – Unless as you suggest analytics are used to inform the process. Wonder if anyone is really doing that.
SInce the English language is open to interpretation as Mr. Moeller rightly suggests, I can only persent one question:
“What is is?”
William Jefferson Clinton approx 1996?
Hi all
Disposal is not based purely on storage or dates. The way in which they are properly executed are based on the following:
1. Legal/Regulatory requirement to keep for X time
PLUS
2. Business Needs or wants to retain for X time.
It is definitely not simplistic and when developing disposal schedules you do absoluely look at history, the litigation the company has been involved in, both form the protect of itself but also from the protection of its assets and IP.
Keeping everything is not the solution and Im sorry but while the Cloud has many advantages it is not endless, there are still financial and process/efficiency costs with the keep everything position.
You also need to be mindful that in many jurisdictions around the world there are also legal requirements that “personal information is kept as long as necessary and no longer”, that also precludes endless storage in the cloud.
Retention is an area where IT, Records and Information Professionals, Risk Managers, Legal Counsel etc need to work together for a practical solution. And yes you are right in that determining value is incredibly difficult. But just because its difficult doesnt mean that you dont attempt it….
great comment –
it is not practical to suggest that nothing ever gets deleted and I agree that there is a cost to keeping everything. Yet, that is a daunting list of stakeholders to get in a room and agree. Ultimately the question is not what do you do with things that are regulated (HR, Customer Data,etc.) That is organizationally the easy part.
It is the everything else. That endless list of memos, agenda, and things that fall outside the easily categorized. The “else” part of the “if” logic. Business value is so difficult to quantify that whether we admit it is what we are doing, people do give up and apply classifications so broad as to be meaningless and throw a dart and pick a date. Decision made. Project complete. Next.
I freely admit though – I am not out there doing this everyday anymore like the great people that commented here. I question though if I had it to do over again if I would make the same decisions.
I used to believe some decision is better than no decision in retention. I am just not sure anymore. The core of the argument here is that the traditional justifications for this position need revalidation against new technology and cost structures. If file plan and disposal schedule development practices are unchanged from five years ago then we are probably not doing it right.