Exchange 2007 Assists Regulatory Compliance

Exchange 2007 is the first version of Microsoft’s e-mail server software that makes it more practical for organizations to conform to regulatory requirements governing information retention and privacy. It can also reduce litigation risks caused by undeleted e-mails and attachments. These new features will appeal most to corporate executives and could provide a strong incentive to upgrade Exchange. However, the compliance features could cause resentment among end users who feel a loss of privacy or freedom.

A Regulatory and Legal Minefield

In the years since Exchange 2003 shipped, the legal landscape for storing and handling e-mail and other electronic documents has changed dramatically. This change has been driven by two main factors:

Government regulations. Many new regulations governing records retention and the handling of sensitive and confidential data have been imposed on companies worldwide. These regulations apply to electronic records in addition to paper records. For example, a U.S. Securities and Exchange Commission rule requires brokers, dealers, and exchange members to retain original copies of all communications for a period of no less than three years, with communications less than two years old kept in an easily accessible location. The U.S. Health Insurance Portability and Accountability Act (HIPAA) mandates that companies and health care organizations safeguard the security and privacy of employee and patient medical records. The European Union (EU) Data Protection Directive of 2002 sets legal standards for processing personal data and protection of privacy, imposes stringent restrictions on which personal information can be collected and stored, and dictates rules for passing personal data to non-EU countries. Noncompliance with these regulations can carry a high cost, ranging from fines to even prison terms for egregious neglect by corporate officers.