Can I maintain personnel files electronically and destroy the originals?

There is no law that specifically prohibits electronic retention of personnel files, but there are many rules regarding how the files must or can be reproduced, as well as destroyed. 

Electronic Records

You want to ensure a legible, printed copy can be produced if necessary and guarantee the security of the computer system in which the records are held. Your policy concerning who may access the personnel files must be enforced in the same manner if the files are “virtual,” by limiting the number of passwords available and monitoring who accesses the files. 

You also must ensure employees are able to access their personnel files without invading the privacy of their coworkers — creating separate, password-protected personnel files is necessary.

Most tax forms are available in an electronic format so they can be retained in that format as well. As far as time records are concerned, California’s Labor Commissioner has taken the position that the recording and storage of time records by electronic means, under certain circumstances, will meet the requirements of California law. Basic conditions are: 

• The employer continues to bear the burden of proof regarding the accuracy of the information; 
• In the event of a mechanical or electronic failure, the employer will have the burden of proving the number of hours worked; and 
• The employer must provide a legible printed copy of the records in response to the request of the Labor Commissioner or the employee.

Destruction of Records

According to the Fair and Accurate Credit Transactions Act, you must shred or burn personnel documents containing personal information. This protects current, past and prospective employees’ personal information, such as Social Security numbers, addresses, telephone numbers and any other information that is reported to an employer by a consumer reporting agency. 

If this information is stored electronically, it must be destroyed before being discarded. If the data are stored on the hard drive of a computer that is being sold or donated to another party, the data must be removed in a way that makes them unrecoverable — simply deleting the records is insufficient. Consult with your information technology department or a specialist to ensure complete destruction of the records.

If you use an outside party to dispose of records, conduct due diligence in hiring a document destruction contractor. Due diligence could include: 

• Reviewing an independent audit of a disposal company’s operations and/or its compliance with this rule; 
• Obtaining information about the disposal company from several references; 
• Requiring that the disposal company be certified by a recognized trade association; and
• Reviewing and evaluating the disposal company’s information security policies or procedures.