This Might Shock You: Indefinite Data Retention on Free Accounts Like Slack Can Be a Legal Risk!
Hi. I'm Max Clark. Let's talk about data retention policies. Sounds really exciting, doesn't it? First off, you need a data retention policy and you need to pay attention to this.
Speaker 1:And why do you need a data retention policy? Well, let's just use the example of ediscovery. If you have any sort of legal action that you're involved with, actually even before the legal action starts, you're gonna get a a hold notice. You're gonna get a letter that says, hey, we're gonna sue you, and you have to preserve all the records before this lawsuit comes. And now you have to.
Speaker 1:A discovery in the process, and this can come from a lot of different places. Right? This can be a customer action. This could be a vendor action. This could be an employee action.
Speaker 1:This could be a regulatory action. This could be a government action. Whatever. I mean, there's lots of different vectors that these things come in and can hit you with. And I worked for a company.
Speaker 1:The general counsel told me one day I was actually it was in her office when she was served with a lawsuit. It was really shocking and jarring to me. First time I'd seen it and she just looked at me and she winked and she said you're not a real business until you've been sued. And so, you know, maybe you're still you haven't crossed that threshold yet and I'm really happy for you. But at some point you're gonna cross the threshold and you're gonna have some sort of legal action.
Speaker 1:So this starts with discovery and discovery in today's world. Basically, you're gonna get a demand to produce documents related to everything in every mechanism known to mankind ever in existence possible. Right? So this is gonna say we want everything related to this topic between these people addressing this stuff, discussing between this time period that exists in paper documents, fax, email, chat, carrier pigeon, signal flares, posters on the wall. Like, basically, you know, the lawyers are very good at this in figuring out, you know, every potential place that this thing could ever be documented or ever come up or come out.
Speaker 1:Right? And they also know that tooling now makes it very easy for them to search this stuff. So it used to be that a discovery request would be would result in, boxes and boxes and boxes and boxes and boxes of paper that then somebody would have to shift through. And by the way, that that person was being paid hourly, and they were billing hourly to shift through that paper. So they didn't really care because they're billing their client.
Speaker 1:But nowadays, the e discovery systems allow it to be electronic search and, like, instant retrieval. So it's it's even better for them. So the best counter to this is if you have an actual retention policy in place that you are have implemented that you've documented and that you actually do. And by the way, all of these things are very important. Right?
Speaker 1:You can't just say, oh, we decided to randomly delete all of our email and chat logs prior to this date because we just felt like it. Now you have to create and document policy. Our policy is gonna say we store email for 2 years and everything past 2 years is automatically purged. We store chat for 1 year and everything after 1 year is automatically purged. And the second part of that's really important.
Speaker 1:Right? The policy defines and also there's tiers. Right? You know, so things related to customer legal is going to be a longer longer retention or, you know, your tax filings are gonna have longer retention. And mind you, when I say, you know, longer retention, what that really means is that you're gonna take that data out of your email platform or out of your chat platform, and you're gonna put it into the proper mechanism to store that thing.
Speaker 1:Right? It's gonna go into your Google Drive. It's gonna go into your Dropbox. It's gonna go into your SharePoint. It's gonna go into your CRM.
Speaker 1:It's gonna go into whatever system that you're actually doing to maintain records long term because that's where it actually belongs and where it should live. It's gonna go into your filing cabinet. Right? So the first part is defining the policy of what data has to be maintained, what doesn't have to be maintained. Email is not a database.
Speaker 1:Do not store data in email. Emails for collaboration is for messaging. When you're done with that, save it wherever it needs to go. Put it in another different system. That's the system you actually have to maintain.
Speaker 1:Okay. So that was the first part. The second part is automated automatic. So you want a platform that can take and automatically apply the policy and either retain or purge the data as it applies to policy why am I recording this and why is this important here's an example slack if you are on the free version of slack slack has an indefinite retention now it might not show it to you and by the way this is common with a lot of these systems they won't show you the messages past a certain point but when you if you scroll back you're gonna get something that's gonna say like oh it's available to us you just upgrade. So upgrade from free to paid.
Speaker 1:And now you can go back in history. You can get the rest of the stuff. This is scary to you because if you are on a free version of Slack and you get this discovery request, now you have to pay for the top tier of slack right so you're going from free to $18 a seat right so I don't know maybe you've got a 100 seats now all of a sudden you're signing a contract with slack at almost $2,000 a month you know depending where you are paying taxes on it, and you're gonna be on that for, you know, whatever span of time. So you've gone from a 0 expense to a $24,000 expense out of left field. And now you've get to go through and run the e discovery, you know, process and, you know, and dig out every thing that's in your Slack related to whatever that action is that opposing counsel has asked for.
Speaker 1:You counter this very easily. You counter this by paying for a lower version of Slack that has a retention policy that you can set and you say, hey, we chat for 1 year. There's no history past 1 year. This is not a history platform for us same thing with email there's lots of examples of this and if you're curious about it I mean first off when you're creating your policy talk to your counsel you know figure out what's appropriate for you for your industry for what segment you're in talk to your advisor figure out what you should be doing don't just create these things willy nilly because you don't want to run a foul of anything at the same time probably the most famous case of this I can think of off the top of my head would be Enron not Enron specifically but their accounts and their accounts had a retention policy that they were not actually enforcing so there's a letter and or email and this by the way became the death sentence for the accountant because when the accountant realized that the CPA firm realized that bad things were gonna happen a lawyer sent out a message saying hey don't forget about our document retention destruction policy.
Speaker 1:And that was the trigger for the shutters to start running. So you can't do that. If you think that some something bad is about to happen, you can't go through and start deleting everything. That's bad. Don't do that.
Speaker 1:Create a policy, Put it in place. Have it automated. Put it on your platforms. License the right tiers that you
Speaker 2:get these things done. Have it running the background. And by the way, this
Speaker 1:is really good for you as well because, you know, the counter I hear a lot with these things become like, oh, we need this thing so that we can find this blah blah blah. And and, you know, this is great. If everybody knows this thing is being deleted, it'll help force your employees and your team to take stuff out of platforms where they should not be storing stuff and put them into places where they should be storing them. It's very easy to to, like, PDF and email if you need to store that email. You know, your PDF, the email, you put it into your file, like, no big deal.
Speaker 1:Really easy to do. Same thing with chat. Real easy to do. Chat is chat. It's not retention.
Speaker 1:It's not a database. It is not a file cabinet. It is chat. It should be chat. Take the history out of chat.
Speaker 1:When you make decisions, put it somewhere else. Save it somewhere else. Add it to your Wiki. Add to your knowledge base. Add to your filing cabinet.
Speaker 1:Do whatever you need to do with it. Just get it out of chat. Set up a document retention policy. Set up an automatic process to enforce that document retention policy and enjoy the benefits of it. You know?
Speaker 1:Because down the road, something will happen. And and you'll be able to say, hey, look, you know, we don't have it. This policy has been in place for 5 years, and it runs at this interval. And we just don't have it. We can't give you what you're asking us for because it does not exist.
Speaker 1:And that's a so much better place to be in. Don't testify against yourself, you know, document retention policy. By the way, this is also really good for you because it means you need less storage. You know, like, at some point, you're gonna fill up your hard drives with nonsense. You know, if you don't store this stuff, you're not filling up your hard drive.
Speaker 1:You're not consuming disk space space in your mail platform. You're not consuming storage on your chat platform. You're not consuming it like just it's just this is just good. Just do it. Just do it.
Speaker 1:Document retention policy. Love to hear your stories about it. If you've had any any crazy, you know, retention issues or e discovery, let me know in the comments before below. I'm Max Clark. I'm looking forward to reading it.
Speaker 1:You feel it?
