Electronic Data Records Law | How to Win E-Discovery

Data Protection versus Record Retention

PCI-DSS | Telephone

Like the so-called right to be forgotten, requirements of the Payment Card Industry Data Security Standard (the PCI) can clash with record retention needs.  The PCI sets industry standards for credit card merchants to secure card data.

A student in my SANS legal course related the following story.  PCI Section 3.2.2 states:  “Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.”  His company, a credit card merchant, takes card payments over the
telephone in live voice transactions between customers and the company’s representatives.  For each transaction, the company audio records the entire voice exchange.  Naturally, the company takes from the customer the card verification code covered by PCI 3.2.2.  As the customer vocalizes that code, the company makes an audio recording of the code.

The company noted that to record the code is a violation of the literal words of PCI 3.2.2.  However, the company also noted that legal and business imperatives call for it to retain the full audio record.  That record is needed in the event of a dispute with a customer.  A customer might try to repudiate a transaction, claiming it never happened.  Without the record, the company would lack strong evidence that the customer entered the transaction.  

Further, that audio record protects the company from other problems such as internal fraud by employees and allegations of tax evasion.  (Example: A tax authority might investigate whether the company understated its profit, assets or revenue by mis-recording the value of its rights, assets or accounts receivable applicable to credit card transactions, including recurring and contingent transactions.  Those audio records help the company prove that it properly accounted for transactions.)

Therefore, with the advice of counsel, the company decided it would store the card verification codes in audio records contrary to PCI 3.2.2.  The company would also take alternative measures to protect the data on those records from misuse or wrongful disclosure.

Dear reader: What do you think about this story?

-–Benjamin Wright, Practicing Attorney and SANS Institute Instructor on the Law of Data Security and Investigations (including e-records and e-discovery)

Documentation for Swap Contracts

Electronic Records of OTC Derivatives Contracts

New financial regulations, when coupled with advancing technology, will force the retention of massive electronic commerce records.  Hear what the authorities are saying about the regulation of financial derivatives:

First:  Famed economist Hernando de Soto says poor documentation for $1 quadrillion worth of financial derivatives is wreaking havoc on the world economy. "Toxic Assets Were Hidden Assets," Wall Street Journal, 3/25/09, pA13.  He calls for much better documentation of derivatives contracts.

Second:  Former SEC Chairman Harvey Pitt recommends much new record-keeping and reporting by entities like hedge funds that have not previously been regulated. “Former SEC chief says gather, share more data,” USA Today, 3/27/09 p3B.

Third:  To prevent more of the “toxic” assets poisoning today’s financial system, Treasury Secretary Geithner says, “We will require that all non-standardized derivatives contracts be reported to trade repositories and be subject to robust standards for documentation and confirmation of trades, netting, collateral and margin practices, and close-out practices.”

What’s the definition of a “non-standardized derivatives contract?”  It’s really just a negotiated contract that allocates risk between two or more parties.  It can cover most any kind of risk or possibility, from the risk of a lawsuit to the potential for rain in the Australian Outback.  (A derivative can even be "embedded" in an routine commercial contract, such as a sale agreement or a mining agreement.)  The scope of this field is breathtaking.  Non-standardized derivatives contracts have become a very large, thinly-monitored part of our financial world. 

So what’s a complete record of one of these derivatives contracts look like?  Would it be a stack of paper, stapled together, with signatures at the end?  It could indeed be such a stack of paper. 

But . . . let’s think deeper about how contracts are documented these days.  As the methods for written business communication – letter, telex, fax, e-mail, instant message and so on -- have grown progressively more cheap and easy, the challenges for documenting complex contracts have risen.

If the derivatives contract were entered in the 1970s, using the practices of the day, a stack of paper, stapled together, would most likely be the form it would have taken.  It might have been supplemented with a few paper letters and, once-in-a-blue-moon, a telex or two.  (Some court cases enforced telex similar to paper correspondence.)

Then in the 1980s faxes became popular, and the contract might have been a stack of stapled paper, supplemented or amended by several faxes. (We learned years ago that faxes can be legally-binding records, just like paper-written letters.)  

Next, in the 1990s e-mail started to become a common form of business communication.  Numerous judicial decisions have held e-mail to be legally-binding “signed writings” essentially equivalent to paper letters.  

See JSO Associates, Inc. v Price (informal e-mails can constitute signed writings agreeing to hire a broker to sell securities and pay a commission) and Cloud Corp. v. Hasbro (formal paper contract that says it can be amended only by a signed writing is amended by informal e-mails).

The e-mails in a contractual relationship can be very numerous.  And they often are not as clearly written as old-fashioned, formal paper contracts were.

Today non-standard derivatives contracts (a.k.a. "swaps," or "custom," "customized," "tailored," "bespoke" or "bilateral" derivatives) can be negotiated, documented, amended, supplemented and interpreted by a dizzying array of electronic communications.  Fax and e-mail are probably most common, but instant messages, phone text messages, chat rooms, message boards, social networking channels and voicemail-converted-to-text are rising in usage among busy traders.  (Dedicated online marketplaces like Agora-X and 360T provide organized electronic environments for communication and negotiation of over-the-counter derivatives instruments.  A brochure for 360T says its secure marketplace supports "Real-time online chat with any requesting counterparty individual.")

In the derivatives world, "novation" (substitution of one counterparty for another) commonly occurs by e-mail.

All this communication can be critical to full documentation for a modern financial contract.  In the Lehman Brothers bankruptcy, for example, the administrator digs through mountains of e-mail to figure out what the firm’s rights and obligations were in the over-the-counter derivatives market.