Canada: BYOD & The Board Of Directors — Part Three: Elements Of A Board Information Governance Policy

Last Updated: April 2 2013
Article by Timothy Banks

This is the third post in a series on BYOD (bring-your-own-device) and the obligations of directors relating to the protection of corporate confidential information. The first post examined the issue from the perspective of the director's statutory fiduciary duty and duty of care. The second post made the case for a board information governance policy. This post examines the content of a board information governance policy.

The elements of a board information governance policy will vary with the nature of the corporation, the sensitivity of the information, the importance of the information to the corporation, the technical skills of the directors, and the willingness and financial ability of the corporation to invest in technological solutions. The following is a non-exhaustive list of possible topics for inclusion in a policy.

SCOPE OF THE POLICY

a. Scope of confidential information

A board information governance policy should define the scope of confidential information. At a minimum, this will include all material, non-public information about the corporation and all personal information collected or used by the corporation. However, the corporation may also owe express or implied duties of confidentiality to third parties, such as suppliers, business partners, shareholders and clients, among others. It is desirable to include this type of information under the policy as well.

b. Application of the policy

A board information governance policy should also describe the types of communications and records that are governed by the policy. Does the policy only apply to communications between corporate officers and the directors or to all records relating to the director's duties or to specific classes of records? Although the focus of this post is on electronic communications, a board information governance policy may also address printed material.

INFORMATION TECHNOLOGY AND SECURITY

a. Security requirements on director-owned devices

A board information governance policy might define for directors the minimum security requirements for director-owned or third-party-owned devices. The policy could also provide directors with a point-person who can assist the director in implementing those requirements or assessing compliance with them.

The content of the security requirements should be determined in consultation with the corporation's technology department. Consideration may be given to requiring that all devices be protected by strong passwords and remote wiping technology. The policy may require operating systems of a particular version or higher with anti-virus protection of a particular version or higher.

In situations where the board is expected to receive extremely sensitive information, the corporation may require the director to agree to permit the corporation to install software allowing the corporation to control the device and wipe the device remotely. A corporation may require that directors receiving or storing highly sensitive information or personal information of employees do so only on encrypted devices.

b. Use of personal or third-party email accounts

The board information governance policy might provide guidance on the use of personal or third-party (e.g. the director's employer) email accounts. The corporation should consider whether the use of personal or third-party accounts is consistent with the corporation's record retention and information security policies.

If personal or third-party email accounts are permitted by the corporation, consideration should be given to establishing clear guidelines regarding the terms of service for those accounts, back-up requirements and disaster recovery protocols.

If non-personal third-party accounts are being used, such as an account provided by the director's employer or another organization in which the director is involved, special attention should be given to determining whether the policies related to those accounts are in conflict with the corporation's interests. It is not uncommon for employers to claim the right of ownership and the right of inspection of all communications conducted through the employer-provided email account.

RECORDS MANAGEMENT

a. Commingling of information

A board information governance policy should establish the corporation's expectations regarding the commingling of corporate information with the director's personal information or information related to the director's employment or duties in connection with other corporations.

In addition to assessing whether commingling presents problems relating to the corporation's records retention programs, consideration might be given to whether commingling creates an unacceptable risk of inadvertent disclosure.

The corporation should also consider electronic discovery issues in the event that the corporation's information must be extracted for litigation. This is not simply an inconvenience issue. Is the corporation prepared to have its records reviewed in the course of another company extracting information related to litigation involving that other company?

b. Records retention and destruction obligations

A board information governance policy may address special records retention and destruction obligations relating to board materials and communications.

For example, what is the corporation's policy regarding corporate records in the possession or control of the director at the end of his or her service? Are all records to be destroyed? If the director will retain the records, is it necessary for the corporation have an express agreement with the director to maintain those records for a minimum period of time and to provide the corporation with access to the records as may be required?

Another special issue may be records relating to committee work, including special committees appointed to review major transactions. Not infrequently the corporate secretary and management directors will be excluded from the work of these committees. Consideration should be given to whether and how those records will be retained without interfering with the independence of the work of those committees. If those records are to be retained, how will they be retained if the directors are using personal or third-party information technology and email accounts?

Even the basic application of a corporate records retention policy may involve special adaptation to the board. For example, if a director is using an email system controlled by a third party, such as the director's employer, is the records retention policy applied to that email system in conflict with the corporation's records retention schedule. Will directors during and subsequent to their service be asked to destroy records in accordance with a records retention schedule? Should any special consideration be given to records relating to the board's conduct during major corporate transactions, such as mergers and acquisitions or dispositions?

c. Litigation hold obligations

A board information governance policy might clarify the director's obligations with respect to the preservation of electronic records in the event of litigation. The policy may require directors using their own devices and personal email accounts to provide access to those devices and accounts for the purposes of preserving and gathering information that is relevant to the litigation. A board information governance policy will also describe the limits on that access. For example, it may be unreasonable to demand access if the director has been sued by the corporation or in situations where the corporation refuses to provide a defence to the director or is otherwise adverse in interest to the director.

Additional issues should be addressed if directors are permitted to use email accounts and information systems that are not controlled by the directors, such as those controlled by the director's employer. Will the director be responsible for ensuring that the third party will provide access to those systems for the purpose of preserving and gathering relevant electronic information?

COMMUNICATIONS PROTOCOLS

a. Special Classes of Communications

A board information governance policy may also set out protocols for handling particular types of communications. Prior to developing these protocols, the corporation may wish to employ a risk analysis of the likelihood and consequences of a breach of confidence relating to particular classes of communications.

A protocol for quarterly financial information might require password protected or encrypted formats. Directors may be prohibited from communicating about undisclosed financial results by email unless password protected or encrypted. Similarly, information relating to proposed executive compensation may be sufficiently sensitive to warrant special procedures. Communications and documents relating to a merger, a major acquisition or disposition, or litigation might be restricted to secure portals through which directors could access information and communicate with one another.

Protocols may also restrict communications to certain electronic addresses. For example, the board information governance policy may require directors to use designated email addresses for communication and not resort to text messages, instant messaging services or PIN messages or forwarding email from a work account to a personal account at the cottage. These alternative methods of communication may be convenient when dealing with a major, urgent event, but may also create security, record retention and litigation management problems precisely when those issues matter most to the corporation.

INFORMATIONAL CONFLICTS OF INTEREST

a. Sharing information with corporate parents or subsidiaries

A board information governance policy could also address potential conflicts of interest relating to information. For example, in the case of cross-appointments between parents and subsidiaries, what are the duties of directors regarding corporate information? Appellate courts in Canada have yet to wrestle to the ground the problems created by information sharing in a corporate group, although one appellate court has commented in a judicial aside that it seemed impractical to say that the directors of a subsidiary can never tell its secrets to the parent company. Nevertheless, should there be official, documented channels of communication in order to manage issues where there may be emerging conflicts of interest or where sharing of information might result in a loss of privilege?

b. Sharing information with nominating or appointing shareholders

There is significant potential for informational conflicts of interest in the relationship between a director and his nominating or appointing shareholder. Leaving aside securities laws issues relating to selective disclosure, the basic corporate rule appears to be that the director is required to maintain confidentiality. This may, of course, lead to a conflict between the director's duties to the corporation and the director's duties to his or her nominating shareholder.

A board information governance policy may address this situation directly for the mutual protection of the director, the corporation and the shareholder. The policy may require official, documented channels of communication. The policy may also address whether in these circumstances it is appropriate for the director to use email accounts, devices or information systems owned or controlled by the shareholder, in order to avoid the perception of impropriety.

BUILDING BOARD CAPACITY AND COMPLIANCE

a. Assistance and Education

Although directors may have a statutory duty to supervise the management of the corporation, non-management directors may not know who within the organization to call to get assistance or how to obtain information on technological issues associated with complying with their duties to protect the corporation's information.

Consideration might be given to providing directors with direct access to a knowledgeable information technology and security professional who can assist the director in securing his or her devices and home networks and troubleshoot issues that the director has. The simple act of setting up a separate email folder on a smartphone or assisting the director in installing personal, remote wiping software may greatly enhance the security of the corporation's information.

Depending on the technical sophistication of the directors and the technology and security complexity of the corporation's information governance and records retention standards, corporations may also wish to consider providing education to directors upon first appointment and periodically thereafter.

b. Breach Disclosure

Directors should also have a clear understanding of their obligations with respect to what the corporation considers to be a breach of confidentiality as well as the director's duty to report a breach. Directors should understand the protocol for losing a tablet, laptop or smartphone containing corporate confidential information.

c. Self-Audit and Review

Board self-evaluation might include consideration of whether directors and the corporation are complying with the board information governance policy. Periodic review of the board's actual practices against the information governance policy is advisable not only to enhance compliance but also to ensure that the information governance policy is practical and does not become an unintended liability in litigation as a result of not being followed.

For more information, visit our Data Governance Law blog at www.datagovernancelaw.com

About Fraser Milner Casgrain LLP (FMC)

FMC is one of Canada's leading business and litigation law firms with more than 500 lawyers in six full-service offices located in the country's key business centres. We focus on providing outstanding service and value to our clients, and we strive to excel as a workplace of choice for our people. Regardless of where you choose to do business in Canada, our strong team of professionals possess knowledge and expertise on regional, national and cross-border matters. FMC's well-earned reputation for consistently delivering the highest quality legal services and counsel to our clients is complemented by an ongoing commitment to diversity and inclusion to broaden our insight and perspective on our clients' needs. Visit: www.fmc-law.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Events from this Firm
17 Oct 2018, Webinar, Toronto, Canada

Dentons and SheEO are coming together for an evening of #radicalgenerosity on October 17, 2018. Meet Vicki Saunders, Founder of SheEO, and learn about how SheEO is changing the landscape for female entrepreneurs.

17 Oct 2018, Webinar, Toronto, Canada

With the continued focus on Bill 148’s significant changes to the Employment Standards Act, Dentons’ Toronto Employment and Labour group is pleased to launch a new webinar series focusing on Bill 148.

17 Oct 2018, Seminar, Québec, Canada

Dentons is pleased to invite you to join us for a breakfast seminar as part of the Les Matinées Dentons series on issues relevant to you and your business.

Similar Articles
Relevancy Powered by MondaqAI
 
In association with
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions