The first generally accepted email principle IN THE U.S. is that email belongs to the organization. So let me start with the disclaimer that this is often NOT true outside the U.S.
But generally speaking, in the U.S. there is more deference to the notion that if the computer, the network, the software, etc. are provided by the organization, anything created with that belongs to the organization, particularly if it's done on the organization's time. To further buttress this argument, many organizations require employees to periodically acknowledge such organizational ownership of content - for example, by signing off on an employment agreement or HR policy to that effect. Others are even more direct and cause a dialog box to appear when the employee logs onto the network or into the email application. The dialog box usually reads something like
By clicking OK and logging into Outlook you agree that SomeCompany owns any messages sent or received and that you have no right to or expectation of privacy while using SomeCompany's messaging systems.Employee acknowledges and the email client opens.
Now, there are some interesting cases going on right now in the public sector that question this even when public sector employees are using public sector computer services and even under Open Records Acts or their equivalents. The gist of it is that employees have been caught doing things they aren't supposed to, like taking bribes, having affairs, etc. using their employers' computers. A local activist, newspaper, etc. files an Open Records Act request and the employee (or employer!) contest it on the grounds that the activity in question isn't related to the mission of the agency and therefore does not fall under the Act. Not sure I agree with that interpretation, but I'm not a lawyer. The immediate issue here then is to a) follow the law and b) watch this space carefully!
The next principle is that email is a business tool. Various surveys from AIIM and others indicate that 99+% of organizations use email as a vital part of their everyday business, ranging from sending and accepting payments or contracts via email to collaborating and developing decisions. Indeed, email is a mission-critical application in almost every organization - and if you don't accept that assertion, have your IT staff turn email off for a week.
Email should be used appropriately. This means of course that it should not be used to send offensive materials like jokes, pornography, music files, etc. It also shouldn't be used excessively for person traffic - for example, sending around chain letters, funny screensavers with dancing elves, requests to support this charity or that cause, and so forth. And many organizations' email policies come from HR and legal and address those types of concerns.
But email should also be used when it is the appropriate tool - and not when it isn't. Email is not that good a tool for collaboration. Nor is it the best tool for keeping employees informed. We'll talk more about this later in the series.
Email should be managed according to its value to the organization - and more specifically, according to its contents. That means that different messages will have different value, depending on whether a message is the only receipt for a transaction or whether it lists who will bring desserts to the company potluck - last year. This principle includes a number of corollaries:
- Email is not a records series. There is no reason to list email on the retention schedule, any more than a schedule would list "microfilm", "Word documents", or "white 24-lb bond". Email is the medium - the content is what determines the value of the message.
- Email is more than "correspondence". Sometimes organizations have a general classification or records series for correspondence - but an email that is the receipt for a transaction or the acceptance of a proposal has different retention than cordial correspondence between a CEO or agency head and an industry group.
- Not all messages need to be saved - and they certainly don't need to be saved forever. This is a challenge for many organizations because of both the perceived risk of destroying messages and the perceived benefit of keeping everything for trending, knowledge management, etc. Storage is cheap, the reasoning goes, so what's the harm? The harm is that the bigger the haystack, the more painful and expensive it is to sift through it. Consider that if the average employee sends/receives 140 messages/day, according to IDC, for a 1,000-user organization that's 140,000 messages/day, or 3 million messages/month, or 35,000,000 messages per year. When, not if, the subpoena, audit, or Open Records Act request is received, how much will it cost to effectively sift through that? The answer is MUCH more than you think. If you don't believe me - ask your legal staff how long it would take to review that body for discovery, and ask IT how long it would take to produce, say, all messages from your senior management from Jan 1, 2007 - June 1, 2008.
The next principle is that users have to be trained on expectations for these principles. Users must understand that it isn't their email and the potential risk to the organization of keeping everything forever OR of getting rid of email inappropriately. I like to remind users that there really is no such thing as "the only copy" of an email - once it's been sent, it's in a number of places, and once it's been sent to someone outside the firewall the recipient could keep it forever, print it, etc.
The last principle is that email policies and procedures have to be enforced consistently, all the time, and across the organization. This is not to say that different departments might not have different mailbox sizes or rules regarding attachments. But it does mean that whatever the policy is has to be enforced all the time, not simply when users remember or when it's convenient. It's an old canard in records management but it bears repeating: it's better to NOT have a policy at all - than to have one and not follow it. Ignorance and stupidity can sometimes be excused (and arguably not having a policy today is one or both) - but when adherence to the policy is called into question, it's generally interpreted unfavorably at best and suspiciously at worst. So write a policy that everyone can understand, train them on the policy, and audit compliance with it periodically.
In the next post we'll look more specifically at some of the business drivers for email management, including operational, legal, and regulatory drivers. In the meantime, if you have questions, comments or concerns, email me. :)
