What practices can your company implement to facilitate efficient business processes and corporate oversight while also maximizing its ability to quickly and defensibly respond to discovery requests that extend to board information? As you assess current practices and perhaps consider ways to improve them, the following are some questions and tips to help navigate the intersection of corporate governance and information governance in the electronic age.

How does your board receive information necessary to discharge its oversight duties?

• Hard copy board books via postal mail or courier?
• Email (sent to dedicated board email address or commingled with other email)?
• Board portal e-book (internal or external)?
• Tablet application?
• Other?

Regardless of the mechanism, board member data is potentially discoverable, particularly in cases where board member conduct is at issue or board members are key players. In addition and importantly, board information may be subject to applicable records and information governance requirements.

E-books, board portals and mobile devices

Business enterprises use technology to work faster, smarter and more cost effectively. The C-suite is no exception: Access, connectivity and rapid response time are all possible with mobile device technology, laptops, tablets, wireless networks and more. Many directors are also current or retired business executives. They expect timely and ready access to information, and they want it delivered in a manner that helps facilitate executive decision making.

• Multiple hats and information sources.Many directors serve multiple boards in addition to their day jobs. They may have fiduciary duties to and receive information from multiple organizations in connection with their oversight roles. Where does it all go? Do they carry multiple smartphones, laptops or tablets? Does board-related email go to their work email address or get commingled with their personal email accounts? If it goes to their work email, do their workplace policies provide for corporate access to company email accounts, and do that company's records retention policies now apply to your board data? Do board members have segregated email accounts for each of the multiple hats they wear? Is information “pushed” or delivered versus “pulled” from a central source?
• E-books and board portals.Increasingly, companies are moving toward electronic board materials. E-books and board portals offer solutions to help centralize the dissemination of and access to board information. Benefits touted by these solutions include: centralized and secure access to the most current information, centralized document repository and retention features, ability to search prior board documents, ability to access board information anytime and anywhere, integrated email features, cost savings and information governance features. One size does not fit all, and these tools may not be the solution for every board.
• Mobile devices, tablets and laptops.Electronic board materials offer efficiency but introduce complexity. What kinds of devices do board members use to view electronic board materials? Do they have the ability to download and annotate the materials? If materials are delivered via email, is the receiving device company-owned or a personal device, and how might that affect access to other information on that device and privacy with regard to personal information?

Connect the dots—Corporate and information governance

Hopefully, your company will never encounter a situation in which board member data is the subject of a discovery demand. Advance planning and preparation will help minimize burdens, business disruption and potential privacy concerns in the event board member data is in the crosshairs. Implement steps designed to facilitate good business practices and information governance, and to enhance readiness and the ability to defensibly respond to requests for board information if they arise.

Considerations include:

• Implement information governance policies.Define types of board-related information subject to corporate information governance policies and review relevant policies to confirm requirements applicable to the board (including records retention, email, bring your own device (BYOD), company-issued mobile devices, preservation and legal hold, social media). Consider streamlining information governance requirements for the board by developing a specific board-level information governance policy. Benefits include aggregating various corporate information governance policies in a manner that is tailored to address applicable expectations and requirements.
• Address BYOD concerns specifically. If board members may use personal devices in connection with their board service and a specific board-level information governance policy that addresses BYOD isn't in place, consider user guidelines and device registration requirements. As part of any BYOD policy, communicate privacy considerations and inform board members that using their personal devices or computers for board service purposes could put their personal information at risk. Describe what may happen to personal information, including remote wipe or auto-lock.
• Discuss commingled information.Board members should understand that if they save or download board information to personal devices or systems or commingle Board email communications with personal or other business email accounts, such information or communications may come under scrutiny and be discoverable. Communicate privacy implications, and potential for exposure or loss of personal information in the event that imaging or remote wiping becomes necessary.
• Institute policies for e-books and board portals. If your board uses these, consider encryption and security requirements. Set document retention and storage rules and integrate with litigation hold and document collection requirements. Determine what happens to deleted data and backup media. Identify email functionality, retention and features. In addition, set rules regarding the ability to download and annotate documents, and ensure that litigation holds, preservation and collection processes are designed to address electronically stored information if downloading or annotating documents is permitted.
• Avoid storing unique information on personal devices or systems. Implement practices to centralize board information, and to design e-board books and board portals (if used) so that there is nothing on an e-board book or device that is not on a centralized server.
• Communicate, train, acknowledge and improve.Train board members on information governance expectations, risks and requirements; include a written acknowledgement as part of the overall strategy. Conduct periodic assessments to help ensure that information governance practices are keeping pace with governance and business processes, and adjust as necessary.