Comments, please. Our IT people asked me how long they should save backed up email on their servers. My incination is to say, flatly, one year max. My opinion is where users may have message content subject to records retention requirements, then they should be printing those messages and saving hard copies. LIkewise email attached documents subject to RR reqs should be saved electronically outside the email system. What do you think?

That's a really good question! Speaking for everyone else - I'd agree with one year. Then I thought about my email archive. I really depend on being able to retrieve messages that I've sent or received. I consistently look at messages older than a year. Sometimes, it's the message that I would have never considered printing that is the exact one I need.

I think I'd vote for something more than 1 year, but I'm iffy about how much more. Other opinions?

I would base it on the subject matter and follow paper based rules. I would try not to keep them in hard copy form though.

Many messages are nonsense and should not be retained. On the other hand, you may have serious inquiries as to discriminatory practices. How would you handle these if they were mailed in or called in?

And remember that e-mail is discoverable. What you save is subject to be taken and used in court.

As a suggestion, I have created a "Saved Email" folder and all emails that I want to retain are copied into that folder and it remains there unitl I decide to delete it.

Outside of that I would consider the retention be based on a similar retention schedule as a received hard copy.

Thanks, guys. What I'm asking is on the systems side, not on the user's side. The users know what messages they ought to save according to RRS's. But my IT people want to be able to dump all employee's old messsages residing on the bank's servers after a set period of time. IMHO, they shouldn't have to consider content to have a blanket rule for dumping.

I think that depends on your IT people and the room they have on the server. At a previous employer personal email boxes were dumped every quarter. Employees were aware of this policy, and as a courtesy, the IT people sent a reminder about 3 to 4 days before the dump so the employees could save what emails they wanted. Deleted (cleaned out of the delete folder) email was retained for either 5 or 7 days just in case someone needed to retreive something. It was dumped without warning.

As for email that is received at a "bank's" mail box, that retention should be based on content and similar to hard copy retentions (MO).

We log all email from customers. It was my understanding that the regulators want to see that email letters from customers are replied to in a timely manner. On the log, we enter the customer's name and email address and date the email was received, a very brief explanation of the email, the name of the employee at the bank was responsible for replying to the email, and the date the reply was sent back to the customer. We only receive around 20 incoming email letters from customers a week so this is easy for us to do. So far, the regulators are okay with this. I was also told to do this by our external auditors. I am not in compliance but I am the manager of our Internet banking department which handles all incoming email letters from customers.

There isn't a requirement for this. And thankfully your volume is slow enough to allow this. Growth may cause you to change your ideas as you are increasing the cost of compliance on your own.

posted by FierceFinance http://www.fiercefinance.com.:

2. SEC fines Goldman, Morgan over lack of email

The SEC, NYSE and NASD fined Goldman Sachs, Deutsche Bank Securities, Morgan Stanley, Salomon Smith Barney and U.S. Bancorp Piper Jaffray for failing to preserve e-mails concerning business, including interoffice memoranda and communications, for the required two-year or three-year periods. Each firm consented to the findings and settled the cases today, without admitting or denying the allegations. The firms agreed to be censured and to pay $1.65 million each to the Treasury, NYSE and NASD. They must also take steps to ensure that they remain in compliance going forward. Emails from other firms have played a central role in the historic investigation into stock research and IPO abuses on Wall Street.

> Here is a Bloomberg News article http://quote.bloomberg.com/fgcgi.cgi?ptitle=Top%20Financial%20News&s1=blk&tp=ad_topright_topfin&T=markets_box.ht&s2=ad_right1_topfin&bt=ad_position1_topfin&box=ad_box_all&tag=financial&middle=ad_frame2_topfin&s=APey.bhOjU0VDIEZp.

> And another from Reuters. http://www.uptilt.com/c.html?s=69l,1di3,7ob,6j7f,b408,jcbt,319t