Keeping Employee Files Forever Could Cost You
Employee files are not harmless simply because they are sitting in a filing cabinet, shared drive, or cloud-based system. Every document an employer retains may contain sensitive information, become part of a future legal dispute, or increase the financial impact of a data breach.
Many employers keep records indefinitely because it feels safer than destroying them. In reality, keeping unnecessary records can create its own liability. Outdated medical documents, background reports, Social Security numbers, banking information, disciplinary notes, emails, and former employee files may expose the organization to privacy claims, statutory penalties, discovery costs, and significant data-breach expenses.
The goal is not to destroy employee records as quickly as possible. It is to know what must be retained, how long it must be retained, where it should be stored, and when it can be securely destroyed. A consistent and legally compliant retention process protects employee information while reducing unnecessary exposure for the employer.
What Is the Potential Liability for Employers?
Keeping employee files longer than legally or operationally necessary creates more than a storage problem. It can increase the employer’s financial exposure in several ways.
Data-Breach Exposure
Every retained employee record containing Social Security numbers, banking information, driver’s license numbers, medical information, or other personal data increases the amount of information that may be compromised during a cyberattack, accidental disclosure, or internal security breach.
For certain data breaches covered by California law, eligible individuals may seek statutory damages ranging from $100 to $750 per consumer, per incident, or actual damages if greater.
Depending on whether the law applies:
100 affected employees could represent $10,000 to $75,000 in potential statutory damages.
500 affected employees could represent $50,000 to $375,000.
1,000 affected employees could represent $100,000 to $750,000.
These amounts do not include attorneys’ fees, forensic investigations, employee notifications, credit monitoring, system restoration, business interruption, regulatory investigations, or reputational harm.
Employee Record-Request Penalties
Destroying records too early creates a different type of exposure. California employees and former employees have legal rights to inspect or receive copies of certain personnel and payroll records.
Failure to timely provide required payroll records may result in a $750 penalty. Employers may also face legal action, court orders requiring production, and attorneys’ fees.
Missing or incomplete records can also make it difficult for an employer to defend decisions involving:
Compensation and hours worked
Discipline and termination
Leave and accommodation
Harassment or discrimination complaints
Performance evaluations
Training and policy acknowledgments
Workplace injuries and safety matters
Background-Check and Consumer-Report Liability
Employment background checks are consumer reports subject to federal privacy and disposal requirements. When the applicable retention period ends, employers must dispose of these reports securely.
Depending on the violation, the Fair Credit Reporting Act may permit recovery of actual damages, statutory damages, punitive damages, costs, and attorneys’ fees.
Confidentiality and Medical-Information Claims
Medical certifications, accommodation documentation, leave records, drug-testing information, and fitness-for-duty records must be treated as confidential and maintained separately from the general personnel file.
Improper access or disclosure may contribute to disability-discrimination, medical-confidentiality, privacy, or related claims. Even when an employer ultimately prevails, investigating and defending these claims can be expensive.
Old Records Can Become Evidence
Records retained beyond their required or useful life may become subject to discovery in a lawsuit. Informal supervisor notes, outdated allegations, inconsistent evaluations, duplicate files, emails, and poorly written documentation can be taken out of context or used to challenge the employer’s explanation for a decision.
Keeping unnecessary records does not automatically create liability. However, once retained, those records may need to be searched, reviewed, preserved, and produced during litigation, adding legal expenses and potentially increasing settlement pressure.
Inconsistent Destruction Can Look Suspicious
Employers should never selectively destroy unfavorable documents while retaining helpful ones. Doing so after a complaint, demand, investigation, or anticipated lawsuit may lead to allegations that evidence was intentionally destroyed.
Possible consequences include:
Court sanctions
Adverse evidentiary rulings
Increased attorneys’ fees
Loss of credibility
Greater settlement pressure
Difficulty defending the underlying employment decision
The safer approach is to establish a written retention schedule, apply it consistently, and immediately suspend destruction whenever a dispute, investigation, or claim is pending or reasonably anticipated.
Not Every Employee Record Has the Same Retention Period
Employers should not apply one destruction date to every document. Different records are governed by different federal and California requirements.
General examples include:
Personnel and applicant records: California generally requires applications, personnel records, and employment-referral records to be maintained for at least four years from the date the record was created or received. Personnel files for applicants and terminated employees generally must be retained for at least four years after the applicable employment action.
Payroll and wage records: California employers generally must maintain wage statements, hours worked, wage rates, job classifications, and related payroll records for at least three years.
Federal wage-and-hour records: The Fair Labor Standards Act generally requires payroll records to be retained for at least three years. Records used to calculate wages, including timecards, work schedules, and wage-rate tables, generally must be retained for two years.
Form I-9: Employers must retain each Form I-9 for three years after the employee’s date of hire or one year after employment ends, whichever is later.
OSHA injury and illness records: Covered employers generally must retain OSHA Forms 300, 300A, and 301 for five years after the end of the calendar year the records cover.
Certain occupational exposure and medical records: Some records governed by occupational-safety regulations may carry significantly longer retention periods, including the duration of employment plus 30 years.
These are general examples and not a complete retention schedule. Industry-specific requirements, benefit plans, government contracts, collective bargaining agreements, and state-specific laws may require different or longer retention periods.
Medical Information Requires Separate Handling
Medical information should not be placed in an employee’s general personnel file.
Medical certifications, accommodation documentation, leave records containing medical information, fitness-for-duty information, workers’ compensation medical documentation, and similar records should be maintained in a separate confidential file with access limited to individuals who have a legitimate business need to know.
Separating medical information helps protect employee privacy and allows employers to apply the appropriate retention requirements without unnecessarily preserving or disclosing sensitive information.
Stop Destruction When a Claim Is Pending or Anticipated
A routine destruction schedule must be suspended when the employer receives notice of, or reasonably anticipates:
A lawsuit or attorney demand
A discrimination, harassment, retaliation, or wage claim
A government investigation, audit, subpoena, or records request
A workers’ compensation dispute
A workplace injury or safety investigation
An employee or applicant complaint
Another situation in which the records may become evidence
This is commonly addressed through a litigation hold or legal hold. Relevant paper files, emails, text messages, electronic records, security footage, timekeeping information, and manager notes should be preserved until the matter is fully resolved and the hold is formally released.
An employer should never destroy records simply because the normal retention period expired when those records relate to an existing or reasonably anticipated dispute.
Secure Destruction Is Part of the Process
Employee records should never be placed in an ordinary trash or recycling bin.
Paper records containing confidential information should be cross-cut shredded, pulverized, or destroyed through a reputable document-destruction service. Electronic records should be deleted in a manner that prevents them from being reconstructed or recovered through ordinary means.
Employers should also confirm that payroll providers, benefits administrators, background-check companies, cloud-storage vendors, and other service providers follow appropriate retention and destruction practices.
A Practical Records-Retention Process
Employers should establish a written records-retention and destruction policy that:
Identifies the different categories of employment records.
Assigns a minimum retention period to each category.
States when each retention period begins.
Identifies where paper and electronic records are stored.
Restricts access based on job responsibility.
Separates personnel, payroll, medical, immigration, investigation, and safety records.
Provides for litigation holds when claims or investigations arise.
Establishes a consistent schedule for reviewing and destroying expired records.
Documents when records were destroyed and who authorized the destruction.
Requires secure destruction of confidential paper and electronic information.
Avoid selective destruction. Records should be destroyed consistently according to an established schedule, not because a particular document is unfavorable, embarrassing, or potentially problematic.
The Bottom Line
Employers face risk on both sides of the retention issue. Destroying records too soon may result in penalties, prevent the employer from responding to an employee records request, or weaken the defense of an employment claim. Keeping records indefinitely may increase privacy exposure, data-breach costs, litigation expenses, and the volume of information that must be reviewed and produced during a lawsuit.
A written retention schedule provides the necessary balance. Employers should retain records for the required period, keep confidential and medical information properly separated, suspend destruction when a claim or investigation is anticipated, and securely destroy records once the legal and legitimate business need has ended.
Do not wait for an employee request, data breach, agency investigation, or lawsuit to discover that your records are incomplete, disorganized, or unnecessarily exposed.
Need help creating a compliant records-retention schedule or reviewing your employee files and recordkeeping practices?
Reach us at info@HRMadeClear.com or visit HRMadeClear.com.
This article is provided for general informational purposes and does not constitute legal advice. Employers should consult qualified legal counsel regarding specific retention requirements or pending legal matters.
Comments