Yes, I started using Gmail for personal mail in 2007, and I haven't thrown out any of it since then. I think I even imported some older mail into Gmail at some point. 

Electronic privacy laws need to be updated. But the government has no incentive to do so, because the laws as they stand make it easier to spy.

This brings up one of those recurring issues: The problem law and government have in keeping up with technology. As you say, @Mitch, in the 1980s it may have made sense to think email was 'abandoned' after 180 days. Today, so many of us use email as a filing system; I know I have personal emails that go back several years, in part because it's an easy way for me to know exactly where to find that information if/when I need to look it up. (It's not particularly interesting to anyone else, btw!) 

The Stored Communications Act dates back to the 80s. It was assumed then that if the email was still on the server 180 days later, it had been abandoned. Might have been true then in the days of MS-DOS, but certainly not today. 

Lippencotte, I tend to agree with you. These days, it doesn't hurt to play it safe and to be as clear as possible in your emails. Obviously there's no way to do that (and get away with it) if what you're doing or saying is wrong. This only works for those who really have nothing to hide. 

This does give everyone something to think about. While email doesn't necessarily last 'forever', sometimes it lasts for far too long than you'd like it to. And sometimes, that's when the problems begin.

is that between the national security aspects and the limitations of the mainstream media, we don't actually know what's going on. I've seen a lot of articles, for example, that conflated "20,000-30,000 pages" with "20,000-30,000 emails," and that sort of ignorance makes it difficult to figure out what's really going on.

"Unnecessarily retained records can cause all kinds of problems down the road."

It is sometimes difficult for people to get rid of their records because they think that they might still need them. 

I'm sure you're right, Alison, and a lot of companies are just putting this whole issue aside as too difficult.  They'll regret it when a lawsuit arrives and they find either that responsive electronic records have been deleted, or that they've kept enormous quantities of records which now have to be searched and possibly disclosed.

Yes, Kim, retention policies should be part of every company's governance and risk management process. But from speaking to risk management professionals, I'd say that is not always the case. Far too often, companies either delete emails they should keep or hold onto emails they can destroy, opening themselves up to unnecessary liability. That's why it's so important for legal and IT to work together, especially at those organizations that don't have a specific risk assessment or governance department/individual.

There are also third-party companies that specialize in providing this service. They come in and do a risk assessment, recommend steps to take, offer best practices, and so on. It is, to me, a wise investment.

I guess you learn something new every day.   I know companies and organizations have email and retention policies but I did not realize there are policies set up for personal email accounts.  Thanks for publishing this article.  Gives us all something to think about. 

Enterprises should already have considered how their document retention policies apply to electronic records.  Apart from anythint else, in the case of a lawsuit, e-discovery might be necessary.  It's important to know what you need to keep -- for business, regulatory or legal purposes -- and to make a conscious decision about whether the rest should be retained or disposed of.

Unnecessarily retained records can cause all kinds of problems down the road.