Deleting Emails

The process of deleting and destroying email is of course closely associated with the subject of retention - destruction being the logical outcome when an agreed retention period has come to an end. As such the guidance in this section should be read in association with the sections on email retention.

However, rather than focusing on when an email should be scheduled for destruction the purpose of this section is to explore the issues surrounding the actual destruction process.

Has Your Deleted Email Really Gone?

It is important that the process of deleting emails is comprehensive, complete and irrevocable. After all, there is little point in ensuring the destruction of one copy (perhaps the one held in the sender's sent items folder) if each of the five recipients has retained their own copies. Even if the intention is for the email in question to have been removed the fact that a copy still exists is enough for it to be disclosable under FOI or as part of a legal discovery exercise. The need for such a comprehensive approach to email destruction is one reason why the author of this resource favours the introduction of an automated email deletion process after a relatively short period of time - even with its attendant cultural and procedural problems. However even this will not be sufficient if users are routinely storing their emails 'offline' either individually or collectively as monthly .pst folders to escape the automatic deletion process.

As stated above, email deletion must also be irrevocable. The guidance from the Information Commissioner's Office is explicit in its assertion that:

"Information located in desktop recycle bins is clearly subject to the FOIA as this continues to be held and is easily accessible. Once deleted from the recycle bin the information will also continue to be held unless the electronic record is completely erased from the computer system."

The issue becomes slightly greyer when it comes to the subject of email stored on back-up servers as the following quote from the same source indicates:

"Information in a deleted file or in a back-up, whether a server, disc or tape, may be regarded as being held by a public authority for the purposes of the FOIA depending on the particular circumstances of the individual case. (Our position on this issue has been modified in the light of the Information Tribunal decision in Mr P Harper v The Information Commissioner EA/2005/0001)."

For the avoidance of doubt it is therefore recommended that procedures be put in place to ensure that the contents of back-up tapes and servers are also subject to pre-defined, agreed and documented retention controls. This will help prevent both potentially expensive trawling of vast volumes of data potentially stored in multiple locations and the possible disclosure of messages thought long departed.