Business Email and Regulatory Compliance – What You Need to Know

Despite the availability of a plethora of new channels such as messaging services and social intranets, the tried-and-tested email is still the no. 1 means of communication in the business context. Business-relevant emails often contain sensitive information and the issue of compliance quickly raises its head. But what does compliance exactly mean in the context of business email communication?

Compliance is essentially about adhering to rules, be they laws, administrative provisions, decrees – even internal policies implemented by a company.

The consequences of not complying range from internal company sanctions such as verbal cautions, written warnings and dismissal, to third-party civil liability proceedings (e.g. claims for damages) and state-led criminal prosecutions (e.g. fines or imprisonment). A loss of reputation can have serious consequences, too.

In the context of emails, the term compliance covers two areas:

1. Legal compliance means that a company’s management must ensure that all laws, rules and regulations applicable to the company and its business activities are observed. Besides local provisions, a company must often also adhere to rules and regulations affecting a company’s cross-border activities.
2. A compliance management system incorporates all the measures introduced to ensure that compliance provisions are adhered to, including regular training sessions for competent staff members, and consistent monitoring and documentation of practices.

Compliance, Regulatory Compliance and Email Compliance

Compliance, regulatory compliance and email compliance are often used synonymously and are subsumed under the standard term “compliance” in the following. So what is the role played by compliance in the context of business emails?
In the following, we shed light on four categories of provisions/policies that can be important for business emails and give a detailed explanation of each by means of a practical example:

1. Compliance with national and, where applicable, industry-specific provisions

Explanation: national and industry-specific provisions are many and varied. They include provisions from the healthcare sector, the environmental sector, the food industry, the insurance and financial sectors, the judicial system, and from tax legislation. Here are a couple of examples of relevance to email management:

• HIPAA (Health Insurance Portability and Accountability Act) for the US healthcare industry and FINRA (Financial Industry Regulatory Authority) for the US financial sector
• SOX (Sarbanes-Oxley Act) for companies listed in the USA
• AO (Tax Code) and HGB (Commercial Code) in Germany

2. Compliance with international provisions (e.g. EU directives and regulations such as the GDPR)

Explanation: in the first instance, European Union directives address the national legislator, who is then obliged to transpose the relevant provisions into national law.
In contrast, a regulation of the European Union is effective directly in the member states, i.e. it does not require an act of transposition. The General Data Protection Regulation (GDPR) is one such EU regulation. With regard to business emails, companies must ensure that the following four rights of data subjects are met, as these emails can contain personal data:

• The right of access (Article 15 GDPR)
• The right to object (Article 21 GDPR)
• The right to erasure (Article 17 GDPR)
• The right to data portability (Article 20 GDPR)

However, care must be exercised here: These four rights can bring companies into conflict with other laws and regulations. For example, Germany’s tax and commercial laws (the AO and the HGB) stipulate that an email archive must be complete, yet according to the EU laws on data privacy (GDPR) it might be necessary to erase personal data from an archive. The use of private emails in the workplace, emails from the works council or the company medical doctor, or data on candidates can also be a problem.

3. Compliance with internal company policies

Explanation: these rules and regulations are introduced voluntarily by a company; although they are binding upon staff members, they have no material effect outside the firm. As these policies are specific to individual companies, only a few examples are listed below:

• Email Retention policies
• Email Mailbox quotas
• Email Mailbox permissions
• Email Usage policies (e.g. private usage of corporate email accounts not permitted)

4. Compliance with laws on data privacy, e.g. EU GDPR or CCPA (California Consumer Privacy Act)

Explanation: data privacy features in each of the three above-mentioned categories: there are international, national, and industry-specific data privacy laws, in addition to internal company policies. Data privacy is concerned with protecting “informational self-determination”, a concept first introduced in the context of a German constitutional ruling. This right addresses the ability of individuals to protect their private lives by preventing the unauthorized collection, storage and sharing of personal details by companies, institutions, etc. Like the EU GDPR, the CCPA contains provisions to protect natural persons when their personal data is processed. Unlike the GDPR, the CCPA could also extend to data on households and devices. The CCPA defines information as any commercial information relating to a consumer’s buying history and habits, and activities conducted on the Internet or other electronic networks as documented by browser histories and interactions with apps and websites. The CCPA thus targets personal data, i.e. all the preferences, behaviors and attributes of a consumer that go towards building a personal profile. The core elements of the CCPA are:

• Right to deletion
• Right to access personal data held by a company
• Right to data portability
• Right to opt out of the sale of personal information
• Right to non-discrimination

What Role Does Email Archiving Play?

How can a company comply with the above-mentioned provisions, laws and policies?

The above requirements cannot be met simply by backing up emails. A professional email archiving solution such as MailStore Server can help a company comply with and implement requirements governing emails. MailStore Server offers a series of special compliance features. These features should form part of a comprehensive compliance concept of which the archiving of business emails is an integral component. In addition, an email archiving solution can be helpful in certain eDiscovery scenarios, for example where an auditor is given permission to read the archive so that he or she can browse through the archived mailboxes.

However, every company should be aware that deploying a software solution is not enough on its own to comply with all requirements. In particular, internal processes such as the handling of emails needs to be adapted. A sound email governance strategy is definitely to be recommended and an email archiving solution can become a mainstay of such a policy.

Further Information

You will find an introduction to our MailStore Server solution plus a live demo in our regular webinars. If you would like to try out the solution yourself, we can offer you a free, 30-day trial version. If you have any questions during the trial period, feel free to contact our technical support team and our customer service.