EMAIL & IM RETENTION POLICY

SUBJECT: RESPONSIBLE UNIT: REFER QUESTIONS TO: EFFECTIVE DATE: APPROVED BY: DISTRIBUTED TO:
I. PURPOSE

Email & IM Retention Policy Information Technology Service (ITS) Information Security Office January 31, 2009

President, CSU East Bay Users of CSUEB Staff and Faculty Email & IM Systems

Electronic mail (email) and instant messages (IM) have become ubiquitous services that greatly enhance communication, both internally within the CSUEB community and externally to clients, including prospective students, current students, alumni and the public at large. This policy establishes the default retention periods for email and instant messages retained on active servers. It also confirms roles and responsibilities for implementation, including management of litigation holds. The 2006 amendments to the Federal Rules of Civil Procedure addressing the discovery of electronically stored information, and CSU Executive Order 1031, Systemwide Records/Information Retention and Disposition Schedules Implementation require institutions to establish email and IM retention policies. II. SCOPE

This retention policy applies to: 1. All email and IM systems provided or funded (in part or in whole) by CSUEB; 2. All users and account holders of CSUEB email and IM accounts; and 3. All email and instant messages sent or received using CSUEB email and IM systems. III. POLICY

Transitory Messages Most email and usually all instant messaging records are created primarily for routine communication or information exchange, i.e., not university records as defined by CSU Executive Order 1031. These messages should be considered transitory messages that do not have lasting value (defined below) and should be: 1. Read and promptly deleted; or 2. Read and retained on the active server for no longer than the default retention period (defined below) or until their usefulness has ended (whichever occurs first), and then promptly deleted; or 3. Read and moved off the active server when job requirements necessitate retention for periods longer than the default retention period, and then promptly deleted when their usefulness has ended.

CSU East Bay Email Retention Policy May 19, 2008

Page 1 of 5

Examples of transitory messages: Notices about meetings or events Internal requests for information An inquiry about department course offerings or scheduling issues Announcements, etc. Lasting Value Messages When the contents of an email or instant message exhibits one or more of the following characteristics, it should be classified as having lasting value: Has operational value (required by a department to perform its primary function) o Administrative actions taken or planned o Reports or recommendations o Policies, procedures, guidelines, rubrics, or templates Has legal or evidential value (required to be kept by law) o Falls within a litigation hold or internal investigation (see Litigation Holds below) Has fiscal value (related to the financial transactions of the campus) o Required for financial reporting and audits Has historical significance (of long-term value to document past events) o May arise from exceptional age and/or some significant historical event Has vital value (critical to maintain to ensure operational continuity after a disruption or disaster) o Vital records or information may fall into any one of the above value categories Messages, records, and information with lasting value must be retained in accordance with CSU Executive Order 1031, Systemwide Records/Information Retention and Disposition Schedules Implementation. Current retention schedules can be found at the Records/Information Retention and Disposition website (http://www.calstate.edu/recordsretention/ ). Since email and instant messaging systems are not designed to be records retention or document management systems, email and instant messages that have lasting value should: 1. Be moved to dedicated storage on departmental/office networked file systems (the equivalent of an electronic filing cabinet) with pre-assigned retention periods; and 2. Not be stored within individual users email or instant messaging folders/files. Responsibility for Retention of Messages with Lasting Value The burden of determining whether a specific message has lasting value should fall to the department responsible for that particular class or series of records typically the originator or custodian of those records. Other recipients should not retain messages longer than required for their respective job purposes. When that need no longer exists, the information should be destroyed. In other words, only the department responsible for retention of a specific type of information or record shall store and control the disposition of information, including that which is in electronic form. Questions about the proper classification (transitory or lasting value) of a specific message, record, or piece of information should be directed to the employees unit head, manager, or department chair.

CSU East Bay Email Retention Policy May 19, 2008

Page 2 of 5

Default Retention Period CSUEB email systems will be configured to automatically delete messages retained for more than 120 days on active email servers. This auto-delete policy applies to messages within all folders (inbox folders, sent file folders, draft file folders, etc.) stored on active email servers. CSUEB email systems will also be configured to automatically delete messages that have been marked for deletion by users but are still sitting in their deleted items folders for more than 7 days on active email servers. CSUEB IM systems will be configured to prevent the storage of instant messages on the servers. All CSUEB email and IM system users are expected to: 1. Regularly check for new messages; 2. Routinely move messages with lasting value to dedicated storage on departmental/office networked file system; and to 3. Delete transitory messages as quickly as possible. Backup Files Backup copies of CSUEB email and IM system files will be kept for no more than 5 weeks. These backups are for system restoration and disaster recovery purposes, and are not designed to facilitate retrieval of deleted messages. Litigation Holds When litigation is pending or threatened against the University or its employees, the law imposes a duty upon the University to preserve all documents and records that pertain to the issues. A litigation hold directive must be issued to the legal custodians of those documents. A litigation hold directive overrides this email and IM retention policy, as well as any records retention schedules that may have otherwise called for the transfer, disposal or destruction of relevant documents, until the hold has been cleared. Email and accounts of separated employees that have been placed on litigation hold status must be maintained by the Information Technology Services (ITS) Division until the hold is released. No employee who has received a litigation hold directive may alter or delete an electronic record that falls within the scope of that hold. Those employees are required to provide access to or copies of any electronic records that they have downloaded and saved, or moved to some other storage account or device. IV. ROLES & RESPONSIBILITIES Information Technology Services (ITS) Division will: o Establish and publish standards for email and IM account administration, storage allocations, and automatic archiving of messages (that must be retained for periods longer than the default retention period) to users local computer folders/files; o Provide facilities and instructions for moving messages with lasting value to dedicated storage on departmental/office networked file systems; o Provide the required end user training and helpdesk support;
Page 3 of 5

CSU East Bay Email Retention Policy May 19, 2008

o o

Manage server implementations of litigation holds that are issued by University Counsel; and Suspend automatic deletion processes, as necessary to preserve specific electronic messages, records and information that fall within the scope of the litigation hold, and that reside on active servers.

Department heads and unit managers are responsible for providing records retention guidance to staff and faculty within their respective units. The guidance provided must be in accordance with this policy and CSU Executive Order 1031, Systemwide Records/Information Retention and Disposition Schedules Implementation. Originators and custodians of electronic messages, records, and information that have lasting value are responsible for: o Appropriately identifying and retaining such records in accordance with this policy and CSU Executive Order 1031, Systemwide Records/Information Retention and Disposition Schedules Implementation; and o Seeking assistance from their respective unit managers or department heads when unsure about how to categorize specific types of messages. University employees who have been notified by management of a litigation hold are responsible for preserving all messages, records, and information that fall within the scope of the hold that they have downloaded and/or stored locally. V. RELATED INFORMATION

For information about the Federal Rules of Civil Procedure, visit http://www.uscourts.gov/rules/EDiscovery_w_Notes.pdf . For information about CSU Executive Order 1031, Systemwide Records/Information Retention and Disposition Schedules Implementation, visit http://www.calstate.edu/EO/EO-1031.html . For information about Litigation Holds, see CSU General Counsels Office presentation at http://www.calstate.edu/risk_management/events/documents/ftpt_presentations/SS073.pdf . For information about configuring CSUEBs Outlook email client software for AutoArchive, visit http://www.csueastbay.edu/its/exchange . For information about CSUEBs SharePoint document management system, visit http://www.csueastbay.edu/its/training/sharepoint/home.html . VI. REVISION HISTORY This policy is subject to revision in response to changes in technology or CSUEB operational initiatives. Issue/Revision Date Issue date of draft: May 12, 2007 Legal Review: October 13, 2007 Administrative Reviews: October 29, 2007 Shared Governance Review: November 6, 2007 Revision by Task Force: April 18, 2008 Legal Review: April 30, 2008 Review of Task Force Report: May 8,
CSU East Bay Email Retention Policy May 19, 2008

Approving Committee/Official University Information Technology (UIT) Advisory Committee University Counsel (Eunice Chan) Cabinet & Provost Council ExComm & Academic Senate Email Retention Policy Task Force University Counsel (Christine Helwick) UIT, ExComm, & Provost Council
Page 4 of 5

2008 Review of Task Force Report: May 13, 2008 Final Administrative Review: May 19, 2008 Approved: May 19, 2008

Academic Senate Cabinet Mohammad H. Qayoumi President, CSU East Bay

CSU East Bay Email Retention Policy May 19, 2008

Page 5 of 5