Corporate Email and Compliance - What You Need to Know

Corporate Email & Regulatory Compliance – What You Need to Know

Despite the existence of numerous new channels such as messaging services and social intranets, tried-and-tested email remains the number one communication tool in a business context. Business emails often contain sensitive information, and compliance issues can quickly arise. However, what exactly does compliance mean in the context of business email communication?

Source: www.pixabay.com, TeroVesalainen

Compliance, essentially, refers to the adherence to rules such as laws, administrative regulations, decrees, and even internal policies implemented by a company.

The consequences of non-compliance can range from internal disciplinary actions such as verbal or written warnings and termination, to third-party legal liability procedures (e.g., claims for damages) and state-led criminal proceedings (e.g., fines or imprisonment). There can also be serious consequences of losing credibility.

In the context of emails, compliance covers two areas:

• Legal compliance, which means that a company's management must ensure that the company and its business activities comply with all applicable laws, rules, and regulations. In addition to local regulations, a company must also comply with rules and regulations that affect its cross-border activities.
• A compliance management system includes all measures taken to ensure compliance with compliance rules, such as regular training sessions for authorized personnel members and the consistent monitoring and documentation of applications.

Compliance, Regulatory Compliance, and Email Compliance

Compliance, regulatory compliance, and email compliance are often used interchangeably and are generally grouped under the standard term "compliance." So, what role does compliance play in the context of business emails? Below, we shed light on four categories of rules/policies that may be important for business emails and provide a detailed explanation for each with a practical example:

1. Compliance with national and, where applicable, sector-specific regulations

Explanation: National and sector-specific regulations are numerous and varied. They include rules and regulations from sectors such as healthcare, environment, food industry, insurance and finance, judiciary system, and taxation. Here are a few examples related to email management:

• In the US healthcare sector, HIPAA (Health Insurance Portability and Accountability Act) and in the US finance sector, FINRA (Financial Industry Regulatory Authority)
• In the US, for listed companies, SOX (Sarbanes-Oxley Act)
• In Germany, AO (Tax Code) and HGB (Commercial Code)

Case Example: HIPAA

A doctor in the US wants to send X-ray images and patient data collected in their clinic to a patient via email. What laws must the doctor be aware of? HIPAA, among other things, requires that security measures are implemented to ensure the adequate protection of personal health information. In this case, for example, archiving emails or creating backups of emails containing health information could be a sensible option. The purpose of both measures is to prevent unauthorized access to the patient's electronic health record (EHR) and to prevent accidental or intentional deletion. Encryption of data during storage and transmission can also be helpful.

2. Compliance with international regulations (e.g., EU directives and regulations such as GDPR)

Explanation: First, EU directives address the national legislature responsible for transposing them into national law. In contrast, an EU regulation is directly effective in member states, meaning it does not require a transposition act. The General Data Protection Regulation (GDPR) is such an EU regulation. Regarding business emails, since these emails may contain personal data, companies must ensure that the four rights of data subjects are fulfilled:

• Right to access (GDPR Article 15)
• Right to object (GDPR Article 21)
• Right to erasure (GDPR Article 17)
• Right to data portability (GDPR Article 20)

However, one must be cautious here: These four rights may conflict with other laws and regulations. For example, Germany's tax and commercial laws (AO and HGB) require that an email archive be complete, but according to the EU data protection laws (GDPR), personal data may need to be deleted from an archive. The use of personal emails in the workplace, such as emails from the works council or company doctors, or data relating to applicants, may also be problematic.

Case Example: General Data Protection Regulation (GDPR)

An EU citizen and a large online retailer's customer requests the deletion of all their personal data. The search function of an email archiving solution can help the retailer quickly find and then delete emails containing the data subject's personal data. But be careful! Depending on the situation, it must be decided whether the data is actually deleted due to the potential of violating other laws.

3. Compliance with internal company policies

Explanation: These rules and regulations are voluntarily introduced by a company; although they are binding for employees, they have no legal effect outside the company. Since these policies are specific to individual companies, only a few examples are listed below:

• Email retention policies
• Email mailbox quotas
• Email mailbox permissions
• Email usage policies (e.g., personal use of corporate email accounts is not allowed)

Case Example: Usage Policies

A company decides to prohibit the personal use of corporate email accounts. Employees are asked to strictly comply with the policy and send personal emails only via personal mailboxes.

4. Compliance with data privacy laws such as the EU GDPR or CCPA (California Consumer Privacy Act)

Explanation: In each of the above three categories, data privacy features are present: in addition to internal company policies, there are international, national, and sector-specific data privacy laws. Data privacy first emerged as a concept in the context of a German constitutional court decision, referring to the protection of "informational self-determination." This right refers to individuals' ability to protect their private lives by preventing the unauthorized collection, storage, and sharing of personal information by companies, organizations, etc. Like GDPR, CCPA also contains provisions aimed at protecting individuals when their personal data is processed. Unlike GDPR, however, CCPA can also include data related to households and devices. CCPA defines any commercial information as activities conducted on the Internet or other electronic networks, such as a consumer's purchase history and habits, browser histories, and interactions with applications and websites. Therefore, CCPA targets all preferences, behaviors, and characteristics that contribute to creating a personal profile of a consumer. The key elements of CCPA are:

• Right to deletion
• Right to access personal data held by a company
• Right to data portability
• Right to opt-out of the sale of personal data
• Right to non-discrimination

Case Example: Consumer's Right to Access Personal Data under CCPA

While placing special orders, subscribing to newsletters, and visiting websites, a large company's California customer leaves a personal data trail behind. The customer now wants the company to fully disclose what data it has collected about them. The company is obligated to inform the customer about the categories of information and individual data elements collected. It must provide this information without delay, free of charge (via mail or email), and in an easily understandable format. This includes all personal information, whether actively or passively collected. Important: The company must disclose the purpose of processing the data at the time of collection or when collecting the data.

* *

What Role Does Email Archiving Play?

Source: www.istockphoto.com, ugde

How can a company comply with the above-mentioned rules, laws, and policies?

The above requirements cannot be met merely by backing up emails. A professional email archiving solution such as MailStore Server can help a company comply with and apply the requirements for managing emails. MailStore Server offers a range of special compliance features. These features should be part of a comprehensive compliance concept where email archiving is an inseparable component. In addition, an email archiving solution can be helpful in certain eBulma scenarios where a specific permission is granted to an auditor to review the archived mailboxes.

However, every company should be aware that a software solution alone is not sufficient to meet all requirements. Especially internal processes such as processing emails must be adapted accordingly. A solid email governance strategy is definitely recommended, and an email archiving solution can be the foundation of such a policy.

More Information

You will find an introduction and regular webinars with live demos of our MailStore Server solution. If you would like to try the solution yourself, we can offer you a 30-day free trial version. If you have any questions during the trial period, do not hesitate to contact our technical support team or customer service.

Source: Email Management - What is Email Compliance for Regulatory Purposes? (mailstore.com)