3 ms·
Is there a legal precedent for minimum time that logs must be kept, say for an email service or messaging service? I'm talking about US policy, if that makes it
by bennyg 13y ago
Is there a legal precedent for minimum time that logs must be kept, say for an email service or messaging service? I'm talking about US policy, if that makes it more clear.
- ra 13y agoGenerally speaking unless you are specifically required to keep records for a regulatory purpose (i.e. tax), you don't have to keep logs at all. Lavabit used to keep logs for a limited time (I think a week?). More concerning are key disclosure laws [1] and their crazy penalties that seem to be creeping in all over the world. [1] https://en.wikipedia.org/wiki/Key_disclosure_law https://en.wikipedia.org/wiki/Key_disclosure_law
- Spooky23 13y agoNo, but you must follow your own policy. You also need to take reasonable measures to preserve relevant data when you have reasonable cause to suspect that litigation or an investigation will begin. Not having a policy can hurt you. If you have no deletion/retention policy, and happen to destroy data for some random reason when a litigation begins, you or your company may be in trouble. Note: IANAL, and different industries or data categories have specific legal requirements or best practices for retaining things.
- keypusher 13y agoIt was likely agreed on (possibly via contract) to meet the compliance policy of the government agency. So I could see breach of contract. I don't know about legal precedent for logs per se, but there is precedent for retention of other files. For instance HIPAA involves some well known regulations around keeping and destroying medical data.