Outsourcing Your Email Provision

Trinity College Dublin hit the headlines earlier this year with the announcement that they are to outsource their entire institutional email service to Google. Other institutions seem set to follow suit and realise the significant cost savings which may go with the outsourcing of your email service..

It is outside of the remit of this resource to offer any judgement on the nature or degree of financial savings that can be realised, or the technical implications which are associated with making such a move. Instead what follows are some aspects to consider prior to embarking on this course of action which may affect the way in which your institution is able to manage the emails it uses.

It is important that the institution realises that although it may be outsourcing the technology and service provision it cannot simply divest itself of responsibility for email management by outsourcing its liabilities to a 3rd party. The concept of vicarious responsibility will still apply and the institution is still liable for the emails created or stored by its users. Recognition of this fact colours many of the remainder of the issues to be considered, revolving as they do around the need to continue to meet these responsibilities even when you are not in day to day control of service provision.

Consideration should therefore be given to the following issues:

• Are you aware of the type and nature of personal data collected by the service provider about your users? Is this in line with your legal responsibilities, is it ethically defensible and has it been communicated to your users?
• Are you aware of who will own the copyright contained within the messages stored by the service provider? Have you considered the implications if copyright is to rest with the service provider?
• Are you aware of and comfortable with the level of back-up and disaster recovery measures being offered for your email?
• Are you aware of how long the emails created or received by your users will be routinely retained by the service provider?
• Are you able to define and enact your own retention actions on the emails stored by the service provider according to the messages content?
• Are you comfortable with the level of preservation measures available and their ability to provide continual access to emails for long periods of time (for example over 50 years)
• Will you be able to extract and move all of the emails your users have created at any point in the future to another service provider (or back in house)?
• How quick and easy will it be for the institution to update or remove a user's system privileges?
• Have you considered how this hosted service will interact with other institutional systems? How easy will it be for users to associate the contents of emails held by the service provider with related information held within the institution? What impact may this have in terms of resource discovery and management?

Careful thought should be given as to whether outsourcing is the right move for the institution if the proposed service provider is unable to provide satisfactory answers to any of the above - regardless of any perceived immediate technical or financial benefits.