Email retention just got harder thanks to functionality introduced by Google for personal Gmail and GSuite users. With a nod to apps like WhatsApp and Signal which allow chats to disappear, Google is allowing its users to send confidential emails that are protecting with a passcode and will be deleted after a set period of time (aka ephemeral messaging). The implications for companies and litigants are significant as it potentially interferes with document retention policies, violates litigation holds and results in extra time and money spent attempting to retrieve data that may be lost forever.
Google Functionality
When a user with a personal Gmail account composes a message, there is an icon at the bottom that looks like a lock with a clock. Clicking that enables the user to turn Confidential Mode On/Off. Sending an email in confidential mode means the recipient will receive the email, but only see the sender and the subject line. In order to read the email text, the recipient is prompted to click a link to receive a passcode via text message. After a specific period (set by the sender), the message will also expire and disappear. If both sender and recipient use Gmail, then the message will delete itself from both accounts. If the recipient uses a different email platform, the link in the email will cease to work once the email expires.
For GSuite users, the administrator can select which users if any are permitted to use confidential mode. If a user has permission, he/she can choose to enable it or not on individual emails just like the personal Gmail user. If the company has GSuite Vault or a third-party vault/journaling function that works with GSuite (ex. Smarsh), emails may be preserved, but not universally as explained below. For those who don’t have GSuite, the problem is much bigger.
eDiscovery and Document Retention Concerns
There are 3 main scenarios that arise involving Google confidential emails.
- The GSuite user sends a confidential email within his/her company.
If Google Vault is enabled by the company, the confidential email will be retained in the Vault and be fully searchable. However, if a third-party journaling program is enabled, only the sender’s information and the subject line is retained; the email text is lost. If the company has no vault, then the email is deleted in the sender’s and recipient’s account.
- The GSuite user sends a confidential email to someone outside the company.
If the sender has Google Vault enabled, the email will be retained in its entirety on the sender’s side. As indicated above, a third-party vault will only retain the sender and subject line information. If there is no vault, all information is deleted in the sender’s account.
- A non-Google email user receives a confidential email from a Google email user.
Once the email expires, a non-Google email user will only be able to retain the sender information and subject line.
Protecting Your Company
In the case of GSuite accounts, the first step is to tightly control who has permission to send confidential emails and when it can be enabled. In addition, companies should either use Google Vault to ensure these emails are still retained on their end or disable confidential mode for everyone. Companies should also block their GSuite users from receiving confidential messages from other GSuite users since they cannot be fully retained.
Companies who use another email platform (Outlook, Office365, etc.) cannot take the steps above. To date, other platforms cannot send confidential emails so blocking employees from sending such emails is not a concern. However, they can receive confidential emails. Unfortunately, there is no way for non-Google platforms to retain these emails with a journaling system. There is also no way to block them from being received. Google confidential emails look like any other email so a filter will not necessarily be effective. As a result, companies are left with a serious concern because they cannot retain these emails as required by their document retention policy or even worse, by a litigation hold. Some emails may be recoverable, but it is not a certainty.
Businesses need to be aware of these risks and plan appropriately. If you need assistance with your data collection and retention, contact us for a consultation.
