Part One: Remote Work

The most immediate issues that we are seeing relate to employees who have shifted to remote work on the fly — some with little notice and no formal training about best practices. Employees are doing their best to get their jobs done, but in doing so, there is increased commingling of personal and work information and records. Do any of these situations sound familiar?

• My company laptop won’t print to my home printer, so I emailed the document to my personal email account so that I could print and sign it.
• The only computer that I have at home is shared with my family, so while my son is doing his school video call, I can only work on my iPad.
• I needed to share some files with a client, so I put them in Microsoft’s OneDrive (or Google Drive, DropBox, etc.).
• My supervisor has been texting me work assignments on my personal phone number since I don’t have access to company email.

Many of these newly remote employees have not received formal training about best practices for remote work or about how remote work impacts records retention. Even as restrictions begin to ease in some locations, remote work or a hybrid of in-office and remote workforces may be here to stay. So what are some of the questions that companies should begin addressing now?

• Does the company already have a policy on use of personal devices for company work?
• Should the use of personal devices be limited? Can it be done practically, and if not, then what does that mean for how information governance and records retention policies should be changed?
• Are important company records secure? No matter where the records originate, the business need — and in some cases, the regulatory or legal obligation — to maintain those records does not change.
• What are the proper and functional procedures for ensuring that business information can be stored, and ultimately located, whenever needed?

Companies must consider how to handle this commingling of company and personal information on computers, phones, and other devices. The answers for each organization will vary depending upon the IT infrastructure and systems that are in place, but every organization should make specific plans for how to either stop the mix, or at very least, to document what is happening and how to track company information — both for the short and long term.

Employees should receive guidance on current information governance and records policies as a part of this shift to remote work. Regular follow-ups to document where employees are storing or transmitting business records should occur. If possible, employees should be directed to segregate completely and to store company records only in regular company locations. If not possible, then employees need to be educated about their responsibilities for handling company information securely. Employees should also be informed that if they do save or transmit business files on their personal devices, those devices could potentially become a part of a company litigation hold or an eDiscovery collection process.