Information Governance Questions to Explore During and After Coronapocalypse
It’s no news to anyone at this point that work has drastically changed in response to COVID-19. Working from home, designating essential employees, wearing masks, checking temperatures, and making other adaptations are common and expected. Most organizations have made changes to their workforce and to many of their policies as a result. In the short-term, crisis-response mindset, it may be easy to overlook some of the long-term implications of how work is being (or will be) conducted during and after “Coronapocalypse,” but information governance and records retention must quickly catch up with these modifications. Otherwise, companies may find themselves dealing with a crisis of another kind down the road. Over the course of these next few posts, we will explore some of the issues that we are currently seeing, and some considerations that the future of work will require.
Part One: Remote Work
The most immediate issues that we are seeing relate to employees who have shifted to remote work on the fly — some with little notice and no formal training about best practices. Employees are doing their best to get their jobs done, but in doing so, there is increased commingling of personal and work information and records. Do any of these situations sound familiar?
- My company laptop won’t print to my home printer, so I emailed the document to my personal email account so that I could print and sign it.
- The only computer that I have at home is shared with my family, so while my son is doing his school video call, I can only work on my iPad.
- I needed to share some files with a client, so I put them in Microsoft’s OneDrive (or Google Drive, DropBox, etc.).
- My supervisor has been texting me work assignments on my personal phone number since I don’t have access to company email.
Many of these newly remote employees have not received formal training about best practices for remote work or about how remote work impacts records retention. Even as restrictions begin to ease in some locations, remote work or a hybrid of in-office and remote workforces may be here to stay. So what are some of the questions that companies should begin addressing now?
- Does the company already have a policy on use of personal devices for company work?
- Should the use of personal devices be limited? Can it be done practically, and if not, then what does that mean for how information governance and records retention policies should be changed?
- Are important company records secure? No matter where the records originate, the business need — and in some cases, the regulatory or legal obligation — to maintain those records does not change.
- What are the proper and functional procedures for ensuring that business information can be stored, and ultimately located, whenever needed?
Companies must consider how to handle this commingling of company and personal information on computers, phones, and other devices. The answers for each organization will vary depending upon the IT infrastructure and systems that are in place, but every organization should make specific plans for how to either stop the mix, or at very least, to document what is happening and how to track company information — both for the short and long term.
Employees should receive guidance on current information governance and records policies as a part of this shift to remote work. Regular follow-ups to document where employees are storing or transmitting business records should occur. If possible, employees should be directed to segregate completely and to store company records only in regular company locations. If not possible, then employees need to be educated about their responsibilities for handling company information securely. Employees should also be informed that if they do save or transmit business files on their personal devices, those devices could potentially become a part of a company litigation hold or an eDiscovery collection process.
Please visit our Coronavirus: Preparation & Response series for additional resources we hope will be helpful.
This information is provided by Vinson & Elkins LLP for educational and informational purposes only and is not intended, nor should it be construed, as legal advice.