1. Dangerous Documents

2. Legal Compliances State and federal laws Contractual obligations Subject to an affirmative legal duty to establish and maintain certain records for specified periods of time

3. It’s Not Just Paper Anymore Approximately 30% of all data make it to paper Most all documents are computer-based Information is being stored digitally CD = 700 MB = 5 boxes of paper Hard drive = 30 GB = 214 boxes of paper Multiple copies and variations exist in multiple locations

4. Where are dangerous documents found? MainframeMail Server (email)File server Computer hard drive Disks, CD ROMs, DVDs, Zip drives, etc. Tape backups, including offsite storage Cell phonesPalm pilotsBlackberry Voice mailVirtual Workrooms (bulletin boards, chat rooms) Digital cameras

5. MS Word – A Dangerous Document? Embedded information in documents Comments Redlines Metadata Data, filename, file type, author Drafts Keep only the final copy Destroy draft versions

6. Who has these dangerous documents? Sources Internal External Internet People Employees Consultants Clients Experts Suppliers

7. Electronic dangers Viruses and Trojans Increased use of email in litigation Instant Messaging (IM) can allow users to “go under the radar” if IT does not track Spyware can be deployed on user’s computer w/o their knowledge to track people’s computer movements

8. Sarbanes Oxley Act (Jan 2002) Purpose: to assure accountability and accurate reporting of financial data and significant events Requires internal controls and information management Must document to demonstrate compliance

9. Document Retention Prevent violations of state & federal laws Provide standard procedures Protect organization during litigation, investigations & audits Reduce costs of discovery Protect officers & directors from liability Preserve organization’s reputation

10. Company Retention Policy Must be reasonable & not in bad faith Must cover… Responsible individual(s) Procedure for storing, indexing & destroying documents Identify documents (consistently not selectively) Identify physical location of paper & media Indicate retention schedule

11. Acceptable Use of Policies Legitimate business purpose No reasonable expectation of privacy Inform employees that institution retains the right to review emails & web browsing activities

12. HR Issue Documents contain social security numbers Identity theft Electronically collected information must be secured As it is collected & stored

13. Sources Guide, Advise, Protect Brian H. Nelson, Esq. (Edwards & Angell) Hidden Liabilities: What is Lurking in Your Files Elizabeth Bates (Consultrex USA) Controlled & Uncontrolled Records: Management & Discovery David Whetmore (Ernst & Young)