After more than three years of development, the Canadian General Standards Board recently released a standard that outlines how to ensure records generated from electronic information systems are reliable, authentic and trustworthy.
The CGSB standard on electronic records as documentary evidence was created to help organizations maximize the admissibility of electronic documents in a courtroom setting. It outlines policies, procedures, practices and documentation required to establish the integrity and authenticity of electronic records.
“The essential ingredient to demonstrate you have a good electronic records management program is to maintain your records accurately and demonstrate the integrity of your records-keeping practices,” said Vigi Gurushanta, chair of the all-volunteer standards committee and principal of Toronto-based consulting firm Imerge Consulting Inc.
PIPEDA a driver for standard
The push towards global e-commerce and the creation of statutes, standards and legal requirements such as the Personal Information and Electronic Documents Act (PIPEDA) drove the introduction of the standard, as has the adoption of an electronic evidence section in both federal and provincial evidence acts.
“Over the last 10 years, governments across the country and federally have done a really good job at amending their evidence laws to make it much more comfortable to keep records electronically,” said George Takach, partner with Toronto-based law firm McCarthy Tetrault. “As you move from the paper-based world to the electronic, the law has had a difficult time keeping up.”
Takach said businesses of all sizes should invest in good record-keeping systems so that if they do find themselves in a legal bind, they are able to quickly and easily access their records.
“There’s a double-edged sword to it,” said Takach. “On the positive side it gives you really good guidance as to how you create a record management system. The downside is from this day forward if you don’t have this gold-plated policy and you don’t comply with the standard, it’s now possible that somebody’s going to stand up in court against you and say you didn’t comply.”
Data recovery firm ActionFront, which has an office in Toronto, does recovery work for various police organizations including the RCMP, the OPP, the FBI and local state departments in the U.S. Data recovery and forensic computing, which is offered by such firms as Deloitte, are often lumped together but are quite different, according to ActionFront president Ron Austin.
“Electronic forensics is to go and find data on an electronic media and to be able to produce it as reliable evidence so you can show who created it and that it hasn’t been modified by anybody since that time record,” explained Austin. “Data recovery is providing access to that data that is on inaccessible media.”
Austin added that some data recovery companies that are looking for ways to increase their bottom line will sometimes also pose as forensic experts. That could spell disaster for a company if they couldn’t prove the contents of the data weren’t modified when the data was recovered.
Although many businesses may not even know about the standard or don’t want to spend the money on a records management system, they should, advised Takach. “If you want to do business electronically you need to play by the rules,” he said.
The standard has also been endorsed by the Canada Revenue Agency to ensure the reliability, integrity and authenticity of electronic records as guidance to electronic business systems users and those who are required to keep electronic records to assist in establishing the legal validity of an electronic record.