With frequently contrasting regulation, Herbert Smith's James Farrell (pictured) reviews document retention practices across 22 key global jurisdictions

With the proliferation of electronic documents, the globalisation of commerce and disputes and the availability of a wide range of different data storage options, corporations are increasingly turning their attention to document retention practices.

In response to the limited guidance relating to the wide-reaching areas of document management and retention, Herbert Smith, with its alliance partners Gleiss Lutz and Stibbe and a number of 'best friends' firms globally, has recently prepared a review of document retention practices in 22 jurisdictions (Australia, Belgium, Canada, China, England and Wales, France, Germany, Hong Kong, India, Indonesia, Italy, Japan, Luxembourg, Netherlands, Russia, Saudi Arabia, Singapore, Spain, Switzerland, Thailand, United Arab Emirates (UAE), and the US). This article highlights some of the key trends and issues identified in the review.

A tangled web

A common theme across the jurisdictions reviewed was that regulations governing document management and data retention are interspersed across a wide variety of sector-specific sources. No jurisdiction had an effective single regulatory regime governing document retention, or even a repository where regulation concerning document retention was gathered together in one place.

It was surprisingly common in many jurisdictions that even where there was a specific requirement to retain a document, there was neither an indication as to the length of time that it should be retained for, nor an indication of the sanctions for non-compliance.

Europe divided

Considerable disparity between the document retention regulations within European Union member states was observed, even where in theory they should be covered by EU law. A good example is the Data Retention Directive, which requires providers of publicly available electronic communications networks or services – in essence telephone and internet providers – to retain data on user activity. Implementation of the Directive varied widely across the EU, in relation to both retention periods and sanctions for non-compliance.

France and Italy, for example, prescribe a maximum retention period of two years; most countries mandate only one and Luxembourg only six months. In France, an individual could face imprisonment for breach, whereas in the UK, no penalties exist for non-compliance. Certain states (notably Germany and Belgium) are yet to implement the Directive.

james-farrell-herbert-smithOverarching rules

A key question in each jurisdiction is whether there is any overarching legislation or regulation which influences how long documents should be retained. The issue here is what approach should be taken to documents which do not fall within particular classes for which specific retention obligations exists. It was found that no jurisdictions imposed general catch-all requirements. However, there was an almost universal recommendation that companies should be guided by limitation periods for civil claims in considering how long they should keep data, although limitation periods did not impose obligations to retain documents for the relevant period.

While one might expect such a recommendation in common law jurisdictions where disclosure or discovery plays a significant role in dispute resolution, this was also the position adopted by those advising in civil law and other jurisdictions where litigation is less document heavy.

From a practical perspective, a recommendation to retain all documents up to the end of applicable limitation periods may be costly and impractical. Many jurisdictions have long limitation periods – for example, for certain claims in Canada, France, Germany, Indonesia, Luxembourg and Spain the limitation period is 30 years. Retaining documents for the applicable limitation period may also pose risks in the sense that harmful, as opposed to helpful, documents are retained in circumstances where they could otherwise have been lawfully destroyed. The implementation of an appropriate document retention policy can enable businesses to address these issues.

Another key consideration relates to the protection of documents containing legal advice from production in litigation or to regulators afforded by legal privilege. However, exactly what is covered by privilege can vary significantly from jurisdiction to jurisdiction and is something relating to which businesses operating in non-familiar jurisdictions should take local law advice.

Data protection

If the requirement to retain documents under various regulatory and legislative regimes is a key driver for the creation and use of a document management policy, then another is the requirement to delete or to destroy certain data, usually personal data, within prescribed timeframes.

In Europe, this is, of course, governed by the Data Protection Directive. In essence, this prescribes that personal data should be retained only for so long as is necessary for the purpose for which it was processed, and a number of other jurisdictions (including Australia, Canada, Hong Kong and Switzerland) have very similar arrangements.

Other jurisdictions have no formal data protection regime, as such. These include India, Indonesia, Saudi Arabia and UAE (although for documents subject to the jurisdiction of the Dubai International Financial Centre, there is a data protection law based on the UK Data Protection Act). In China and Thailand there is currently no data protection legislation, although both jurisdictions have drafted data protection legislation which is undergoing the statutory approval process.

Some jurisdictions, such as Japan, have less prescriptive data protection regulation and in the US, while there is no comprehensive data protection legislation, there are a number of laws which require destruction of certain records based on sector-specific legislation.

Document storage

Across the various jurisdictions there are regulations governing the format in which documents have to be stored. Not surprisingly, electronic storage is widely permissible – although in many jurisdictions there remain certain classes of key documents which must be stored in hard copy. For instance, in Belgium and France, some original documents must be stored in hard copy to preserve original signatures.

Generally there is little formal guidance as to how companies should prepare document retention policies. In certain jurisdictions, some of the detail of a document retention policy will need to be drafted in compliance with local procedure. For example, in Russia, when a relevant document retention period has expired and a company is able to destroy certain documents, procedures that must be followed before doing so are set out in detail in the relevant regulations. These include an obligation to establish a special standing commission to determine which documents should be retained and which destroyed.

Conclusion

An important aspect of data retention is the ability to maintain control, and therefore confidentiality, over data. There are many legal and regulatory procedures pursuant to which documents may find their way into the hands of third parties, the courts and regulators, thereby entailing the loss of control and confidentiality.

These procedures vary widely from jurisdiction to jurisdiction, which begs the question: where should a business store its data? Businesses should carefully review all options available to them to ensure that storage of documents is appropriate and effective, taking on board their particular commercial needs and risks.

The key objectives of a document retention policy are to enable a business to comply with its regulatory and legal obligations to retain certain documents and to dispose of other, often personal, data. In addition, the policy should facilitate a solution which manages data in a cost-effective and risk-aware manner. Achieving these objectives across multiple jurisdictions adds layers of complexity, but increases the benefits and rewards of having a proper document retention procedure in place.

James Farrell is a partner in the dispute resolution team at Herbert Smith.