Overview
- Multi-National companies employ over 23 million workers in the United States. 48% of private U.S. companies have an international presence. 75% percent of mid-market companies say going global is an integral part of their growth strategy. 1/4 of small businesses indicated they were involved in global business.
Companies are going global, and corporate law and record management departments are confronted with the issue of how to maintain a records management policy that serves their organizations global needs while complying with the various international laws and regulations associated with records management. This QuickCounsel summarizes some distinctions in laws that impact records management in different regions throughout the world. The analysis includes record management issues associated with personally identifiable or sensitive information (PII), the legal status of electronic records; retention requirements associated with corporate filings, customs, labor, and tax; and other considerations such as statute of limitations.
United States and Canada
In both the United States and Canada, electronic records are generally acceptable when records are legally required to be kept.
Companies have a responsibility to protect PII, and must notify those impacted by a potential breach of that PII. In the U.S., the laws promote safe handling of PII by placing liability and notification requirements on the holder if there is a breach. The U.S. approach is essentially a back-end approach, addressing the issue only when a liability or problem occurs, creating a financial burden on the holder of PII to remedy the problem.
The federal governments in both Canada and the United States provide retention requirements for corporate records and customs documents. The federal governments, states, provinces, and territories stipulate retention requirements associated with labor (payroll, unemployment, health and safety), environment, and tax. The United States and Canada also have limitation of action periods for certain causes of actions that companies may choose to consider when determining a retention period.
Western Europe/European Union
For countries within the European Union (EU), one of the most distinguishing record management concepts addresses the issue of handling PII. Unlike the back-end U.S. approach, which addresses the issue only when a liability or problem occurs, the EU regulates the handling of PII on the front end, placing specific requirements on the actual handling of PII. Among the restrictions are requirements that the holder safely dispose of the PII when the company achieves the purpose for which the PII was collected. For example, if PII is used to determine whether a company should issue credit to a person, once the company makes that decision, the company should safely dispose of the PII.
Also, under EU regulations, a company within the EU may not transfer PII to another country that does not comply with EU privacy regulations. In response to this requirement, the United States Department of Commerce established a self-certifying approach ("safe harbor") to bridge the differences between the disparate approaches and provide U.S. companies a streamilined way to meet European Privacy regulations.
Eastern Europe/Former Soviet Bloc Countries
The former Soviet Bloc countries have more developed record retention requirements than other regions. For example, in the United States and in most regions, we are familiar with retention requirements for specific industries, and generally for customs, environment, labor, and tax. In the former Soviet countries, however, almost every type of document has a defined retention period. Many of the former Soviet countries have one law with a list of records and retention requirements. The lists can have close to 2,000 record types with specified retention periods. In addition to areas familiar to record managers in the U.S., the covered records include information technology, building maintenance, correspondence, and various types of contracts. Generally speaking, in the former Soviet countries, if a company has a document (electronic or hard copy), there is a specific retention requirement addressing that specific document.
Some former Soviet Bloc and Eastern European countries also impose long retention times on labor-related records. In the U.S. and in most regions, retention requirements for labor records (excluding certain medical/health records) typically range from three to ten years. In some of the former Soviet Bloc and Eastern European countries, companies are required to maintain many standard employment records for 75, 100, 150 years, or indefinite periods.
Latin and South American Countries
General distinctions in Latin and South America include their approach to electronic records, handling of PII, and their reliance on a general limitation period for record retention. In the .U.S. and in most regions, when a law requires a record, an electronic version of that record satisfies the record requirement unless specified otherwise. Many of the countries in Latin and South America have not accepted electronic versions of records and often require hard copies. Supplemental electronic records are optional.
As discussed above, in Europe, holders of PII are required to dispose of the information when it is no longer needed. In Latin and South America, by contrast, some countries impose specific maximum retention periods for PII, such as two or five years. Companies are free to dispose of the records before that time, but they may not hold on to the information for a longer period.
Latin and South America do not have many retention requirements, but they do have well accepted norms of retention that rely heavily on general limitation of action periods. Mexico is a classic example of this, where companies often defer to a ten-year retention period for many records based on the general ten-year statute of limitation that applies to many different types of actions.
Asia Pacific
The record management requirements of Asian Pacific countries seem to parallel many of the general principles used in other regions. For example, companies may not hold PII longer than necessary, but there are not the EUs heavy restrictions with regard to the transfer of PII to countries with different standards.
Asian Pacific countries generally have accounting regulations that are common to most countries throughout the world, but slightly uncommon in the U.S. In the U.S., there are implied requirements for accounting records through tax assessment laws, but unless a company is specifically regulated (either by industry or the Securities and Exchange Commission), there are no real accounting retention requirements. For most Asian countries and other countries throughout the world, if a company is registered in that country, it is normally obligated to maintain accounting records for ten years. Countries can audit these accounting records for a number of purposes, including investigations into anti-bribery/foreign corruption activities.
Middle East/Central Asia/North Africa
Many of the countries in Middle East, Central Asia, and North Africa have legal concepts based on Islamic laws and traditions known as Sharia Law. Sharia, which comes from the word "path" in Arabic, guides all aspects of Muslim life, including daily routines, familial and religious obligations, and financial dealings. Some countries in this region govern using dual secular and Sharia systems, while others rely more on either Sharia or secular systems. For example, Saudi Arabia relies heavily on Sharia law. As a result, In Saudi Arabia there are few laws specifying retention periods and limitation of action periods do not apply. However, in the United Arab Emirates, the record management policies look similar to those of Western Europe and Asia Pacific.
Another consideration in the Middle East is the impact of the Gulf Cooperation Council (GCC). The GCC is a regional authority, similar in scope (without the currency) to the EU. Current member states include the United Arab Emirates, Bahrain, Saudi Arabia, Oman, Qatar, and Kuwait. For those countries, the GCC impacts retention requirements for customs records: The GCC Customs Union, created in 2003, includes retention requirements associated with the import and export of goods.
Conclusion
Unfortunately, there are no international record management treaties or guidelines. Instead, each country has developed its own requirements based on culture, events, and economic needs. Understanding regional differences can help corporate counsel create international record management policies that meet business needs, and can help prevent corporations from suffering damages due to a record policy that is not compliant with a certain nations laws.
Additional Resources
