More and more industries are frequently conducting business in multiple forms of electronic communications, including text messaging.
Accordingly, most regulators in these industries have implemented a plethora of regulations requiring businesses and organizations to capture and retain text messages, chats, instant messages, email, audio and video calls, and other types of electronic communications to ensure transparency among their members, and protect any of the stored information from loss, theft, and being accessed for unregulated use.
Here’s a cross-industry list of important electronic communications retention requirements in the U.S., Europe, and Canada, based on the latest Data Retention Requirement guide by the Osterman Research.
1. Consumer Products
Regulation: 16 CFR 315.5- Prescriber verification
Who Needs to Comply: Contact Lens Retailers
Content to Be Archived:
- Record of all direct communications, prescriptions presented to the seller by the patient or prescriber, verification requests by the seller.
- For communications from the prescriber: telephone log describing the information communicated; copies of faxes or e-mails and the time and date it was received; record of the prescriber‘s regular Saturday business hoursand the basis for the seller’s actual knowledge thereof.
Retention Period: Three years or longer
Reference: https://www.law.cornell.edu/cfr/text/16/315.5
2. Education
Regulation: Family Educational Rights and Privacy Act (FERPA)
Who Needs to Comply: All schools that receive funds under an applicable program of the U.S. Department of Education.
Content to Be Archived: Records of communications relating to a student’s education from electronic channels such as email, instant messaging, social media, text/SMS, audio, video. Website, and blogs.
Retention Period: No such records retention schedule exists within FERPA or its implementing regulations from the U.S. Department of Education’s Family Policy Compliance Office (FPCO).
Reference: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
3. Energy
Regulation: 18 CFR Part 35 & Part 284, NRC 9.6 Communication
Who Needs to Comply: Transmission Providers
Content to Be Archived: All emails, voicemails, text messages and other communication between transmission providers’ transmission function employees and marketing function employees.
Retention Period: Five years
Reference: https://www.ecfr.gov/cgi-bin/text-idx?SID=860f3db633b732c52378235e5bd27af6&mc=true&node=pt18.1.358&rgn=div5
https://www.ecfr.gov/cgi-bin/text-idx?SID=cebb6afb34ef37fb73d3316243f442e9&mc=true&node=pt18.1.35&rgn=div5#sp18.1.35.b
http://www.nrc.gov/reading-rm/doc-collections/cfr/part009/part009-0006.html
4. Federal Government
Regulation: Freedom of Information Act
Who Needs to Comply: Government Agencies and Departments
Content to Be Archived: Records of electronic communication including text messages, emails, social media content, instant messages, voice calls, and iOS and Android device messages.
Retention Period: For as long as they are needed.
Reference: https://www.foia.gov/
5. Financial Services (US)
Regulation: FINRA Regulatory Notice 07-59, FINRA Regulatory Notice 10-06, FINRA Regulatory Notice 11-32, FINRA Regulatory Notice 11-39, FINRA Regulatory Notice 17-18, FINRA Rule 3110, FINRA Rule 2210, FINRA Rule 3170, FINRA Rule 4511.
Who Needs to Comply: Financial Services Firms, Registered Representatives.
Content to Be Archived: Various electronic records, including consumer-focused emails, message boards, electronic faxes, text messages, social media communications, tape or digital recordings of voice conversations.
Retention Period: At least six years
Reference: http://finra.complinet.com/
6. Financial Services (Canada)
Regulation: IIROC Notice 11-0349
Who Needs to Comply: Financial Services Firms
Content to Be Archived: Records of business activities, financial affairs, client transactions and communications. Content on social media web sites, Facebook, Twitter, blogs, chat room, text messages and all email content are subject to retention requirements.
Retention Period: Records must be kept in a durable medium for 7 years following its creation.
Reference: http://www.iiroc.ca/Documents/2011/dbed7d6a-ed1c-4a8b-b3d9-bef60412aa27_en.pdf
7. Financial Services (EU)
Regulation: Markets in Financial Instruments Directive (MiFID) II
Who Needs to Comply: Financial Services Firms
Content to Be Archived: Records of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission, and execution of client orders.
Retention Period: 5 years
8. Healthcare
Regulation: Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Who Needs to Comply: Covered Entities and Business Associates
Content to Be Archived: A covered entity must retain and protect records of health information captured from electronic channels such as email, instant messaging, social media, text/SMS, audio, video, website, blogs.
Retention Period: Six years
Reference: https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
9. State and Local Government
Regulation: Open Records Acts/Sunshine Laws
Who Needs to Comply: All State and Local Government Bodies
Content to Be Archived: Records of government bodies, including work-related communications such as text messages, social media posts, chats, and emails.
Retention Period: Vary per state
Reference: https://www.rcfp.org/federal-open-government-guide
Contact us at TeleMessage today to learn how your business can comply with the ever-changing text message archiving regulations.
