Corporate Email and Regulatory Compliance – What You Need to Know

Despite the existence of numerous new channels such as messaging services and social intranets, tried and tested email remains the number one communication tool in a business context. Business emails often contain sensitive information, and compliance issues can quickly arise. But what does compliance exactly mean in the context of business email communication?

Source: www.pixabay.com, TeroVesalainen

Compliance, essentially, refers to adhering to rules such as laws, administrative orders, decrees, and even internal policies implemented by a company.

The consequences of non-compliance can range from internal disciplinary actions such as verbal or written warnings and termination to third-party legal liability procedures (e.g., claims for compensation) and state-led criminal proceedings (e.g., fines or imprisonment). There can also be serious consequences of losing credibility.

In the context of emails, compliance covers two areas:

• Legal compliance, which means that a company's management must ensure that all applicable laws, rules, and regulations for the company and its commercial activities are followed. In addition to local regulations, a company is generally also required to comply with rules and regulations that affect its cross-border activities.
• A compliance management system includes all measures taken to ensure compliance with compliance rules, including regular training sessions for authorized personnel members and the consistent monitoring and documentation of applications.

Compliance, Regulatory Compliance, and Email Compliance

Compliance, regulatory compliance, and email compliance are often used interchangeably and are generally grouped under the standard term "compliance." So, what role does compliance play in the context of business emails? Below, we shed light on four categories of rules/policies that may be important for business emails and provide a detailed explanation of each with a practical example:

1. Compliance with national and, where applicable, sector-specific regulations

Explanation: National and sector-specific regulations are numerous and varied. They include regulations from sectors such as healthcare, environment, food industry, insurance and finance, judiciary system, and tax law. Here are a few examples related to email management:

• For the healthcare sector in the United States, HIPAA (Health Insurance Portability and Accountability Act) and for the finance sector in the United States, FINRA (Financial Industry Regulatory Authority)
• For companies listed in the United States, SOX (Sarbanes-Oxley Act)
• In Germany, AO (Tax Code) and HGB (Commercial Code)

Case example: HIPAA

A doctor in the United States wants to send X-ray images and patient data collected in their clinic to a patient via email. What are the legal requirements that the doctor needs to be aware of? HIPAA, among other things, requires the implementation of security measures to ensure that personal health information is adequately protected. In this situation, for example, archiving emails or creating backups of emails containing health information could be a sensible option. The purpose of both measures is to prevent unauthorized access to the patient's electronic health record (EHR) and to prevent accidental or intentional deletion. Encryption of data during storage and transmission can also be helpful.

2. Compliance with international regulations (e.g., EU directives and regulations such as GDPR)

Explanation: First, EU directives address the national legislature, which is then required to transpose them into national law. In contrast, an EU regulation directly applies in member states and does not require a transposition act. The General Data Protection Regulation (GDPR) is such an EU regulation. Regarding business emails, since these emails can contain personal data, companies must ensure that the four rights of data subjects are fulfilled:

• Right to access (GDPR Article 15)
• Right to object (GDPR Article 21)
• Right to erasure (GDPR Article 17)
• Right to data portability (GDPR Article 20)

However, caution is needed here: These four rights can put companies in conflict with other laws and regulations. For example, Germany's tax and commercial laws (AO and HGB) require that an email archive be complete, but according to the EU data protection laws (GDPR), personal data may need to be deleted from an archive. The use of personal emails in the workplace, such as emails from the works council or company doctors or data related to candidates, can also be problematic.

Case example: General Data Protection Regulation (GDPR)

A European Union citizen and a major online retailer's customer requests that the company delete all their personal data. A search function of an email archiving solution can help the retailer quickly find and delete emails containing the data subject's personal information. However, be careful! Depending on the situation, it must be decided whether those data are actually deleted due to the potential of violating other laws.

3. Compliance with internal company policies

Explanation: These rules and regulations are voluntarily introduced by a company; although they are binding for employees, they have no external legal effect. Since these policies are specific to individual companies, only a few examples are listed below:

• Email retention policies
• Email mailbox quotas
• Email mailbox permissions
• Email usage policies (e.g., personal use of corporate email accounts is not allowed)

Case example: Usage Policies

A company decides to prohibit the use of corporate email accounts for personal purposes. Employees are asked to strictly comply with the policy and send personal emails only via personal mailboxes.

4. Compliance with data privacy laws such as the EU GDPR or CCPA (California Consumer Privacy Act)

Explanation: In each of the three categories mentioned above, data privacy features: in addition to internal company policies, there are international, national, and sector-specific data privacy laws. Data privacy is a concept that originated in the context of a German constitutional court decision and refers to the protection of individuals' private lives by preventing unauthorized collection, storage, and sharing of personal information by companies, organizations, etc. Like GDPR, CCPA also includes rules aimed at protecting individuals when personal data is processed. Unlike GDPR, however, CCPA can also include data related to households and devices. CCPA defines personal information as any commercial information related to activities conducted on the Internet or other electronic networks, such as a consumer's purchase history and habits, browser histories, and interactions with applications and websites. For this reason, CCPA targets all preferences, behaviors, and attributes that contribute to creating a personal profile of a consumer. The key elements of CCPA are:

• Right to deletion
• Right to access personal data held by a company
• Right to data portability
• Right to opt out of the sale of personal data
• Right to non-discrimination

Case example: Consumer's right to access personal data under CCPA

When placing special orders, subscribing to newsletters, and visiting websites, a large company's California customer leaves behind a personal data trail. The customer now wants the company to explain exactly what data has been collected about them. The company is obliged to inform the customer about the categories of information and the individual data elements collected. This information must be provided without delay, free of charge (via post or email), and in an easily understandable format. This includes all personal information, whether it was actively or passively collected. Important: The company must explain the purpose of processing the data either before or during the collection of the data.

What Role Does Email Archiving Play?

Source: www.istockphoto.com, ugde

How can a company comply with the above-mentioned rules, laws, and policies?

The above requirements cannot be met simply by backing up emails. A professional email archiving solution such as MailStore Server can help a company comply with and apply the requirements for managing emails. MailStore Server offers a range of special compliance features. These features should be part of a comprehensive compliance concept in which email archiving is an inseparable component. In addition, an email archiving solution can help in specific eBulma scenarios where the archive is given read access to an auditor, for example.

However, every company should be aware that a software solution alone is not sufficient to meet all requirements. In particular, internal processes such as the processing of emails must be adapted. A solid email governance strategy is definitely recommended, and an email archiving solution can serve as the foundation for such a policy.

More information

You will find an introduction and regular webinars with live demos of our MailStore Server solution. If you want to try the solution yourself, we can offer you a 30-day free trial version. If you have any problems during the trial period, do not hesitate to contact our technical support team or customer service.

Source: Email Management – What Is Email Compliance For Regulatory Purposes? (mailstore.com)