Must companies keep records of internal messages (emails, Slack messages, MS Teams chats, etc.) and if so, for how long?

Question

Must companies keep records of internal messages (emails, Slack messages, MS Teams chats, etc.) in case some court later asks for it, and if so, for how long do they have to keep it? I'm mostly interested in the United States.

Answer 1

Only if ordered by law or required for litigation

Most laws only necessitate accounting information to be kept for tax and accountability reasons, and maybe medical data for accountability. All other communication is usually not obligatory, but for when there is an anticipated or pending lawsuit about that specific material. Only that is when all ancilliary material is required to be preserved to prevent spoliation.

Since most production material is neither required for tax, nor material required for a clearly coming or already started litigation, any such material can be deleted without legal consequences. However, since often material might be needed years later for making more of the same item or to look up changes to a project, retention is typically several years. Still, the policy might be much shorter if such retracing is deemed not necessary but a security risk. In any case, once that internal retention time is up and the material appears no longer needed, especially if not required for litigation, then the material can be destroyed without consequences. Do note, that the retention policy on such files might or might not be available to the public.

The trigger on having to retain data for litigation triggers only after the lawsuit has become either apparently unavoidable (e.g. a note hiring a killer), has been threatened ("I'll sue you!"), or served (whichever is sooner). Yet, if you inform a company of your intention to sue a second after they have already destroyed the files properly... tough luck and it is not spoliation of evidence.

Answer 2

While there is no express requirement to preserve records in U.S. law in most cases, many jurisdictions have a safe harbor provision that expressly authorizes the destruction of records in the ordinary course without individualized consideration of the records involved, pursuant to a records retention policy applied regularly, typically after seven years, which is based on the statute of limitations for certain activities like tax audits and most kinds of private lawsuits.

The U.S. Securities and Exchange Commission has a seven year record retention rule for records related to audits and reviews of publicly held companies. See also, e.g., Securities Exchange Act Rule 17a-4 (requiring broker-dealer communications to be archived for a certain period of time). The IRS likewise recommends that certain kinds of records relevant to tax liability be retained for at least seven years. Employment law attorneys for employers commonly recommend that records related to discharging employees be retained for at least seven years. Government agencies and banks often have similar policies. Colorado law requires some records to be retained for three years. Special rules apply to medical records, especially when they involve minors.

This said, if the firm having the records has notice that the records are likely to be the subject of litigation and destroys them anyway, the firm can face very severe sanctions for spoliation of evidence if the records relevant to that litigation are destroyed in the ordinary course after the usual safe harbor time period. There is a legal duty to promptly take action to preserve all records related to potential or pending litigation once someone becomes aware of the potential or pending litigation. When someone violates this duty, this is called spoliation of evidence.

Destroying records when litigation is pending has produced some of the biggest court sanctions in U.S. history. There was a $3 million sanction in one 2016 case. Another led to 15 months in jail. Another produced a nearly $1 billion judgment on the merits from facts inferred as a matter of law as a sanction for destroying records. Destroying records while knowing the litigation is pending is almost suicidal to the firm or individual doing so when it happens.

Usually, there is no penalty or only a nominal fine for failing to retain records that don't end up being relevant to a dispute. But someone can be held accountable for destroying records before a recommended time period, or when there is notice of potential litigation, if a dispute does arise.

Answer 3

You must not delete emails if you know of should know there is an upcoming lawsuit against you, and deleting the emails destroys evidence against you. Thats independent of any policy.

Now if you destroyed email evidence without knowledge that it would be used as evidence, but also without any company policy, then this is suspicious and you might be in trouble. If you kept 9,999 emails and destroyed the one relevant in a court case, and you honestly didn’t know, the judge might not believe you and say “a one in ten thousand chance means guilty beyond reasonable doubt”.

So your company should have a policy. Like “at the earliest possible time at the beginning of every month all emails older than three months are destroyed”. Now you are safe unless someone can prove that he knew or should have known about a court case.

Answer 4

It is common for HR in the USA to destroy messages if they think there is a lawsuit in the near future. That is why in your formal dealings with your employer it is prudent to keep a record of all correspondence.

There certainly is no obligation for companies to keep detailed information so as to make the litigation against them easier.