Don’t Let Your CRM System Feed the Lawsuit Beast

Part of my consulting work is as an expert witness, working with lawyers as a forensic CRM analyst. These cases usually involve mergers, reseller agreements, and breaches of contract. But they may also involve wrongful termination, customer privacy issues, trademarks, and compliance issues. For an analyst who knows what they are doing, your CRM system holds a wealth of discoverable clues that can be turning points for lawsuits.

For any modern marketing and selling organization, CRM is as essential as an accounting system. But most organizations don’t realize the value and the scope of the data their CRM represents. You need to understand the policies and the best practices to keep your compliance and legal discovery issues to the absolute minimum. Get this on your agenda pronto.

Financial and Personal Data

At the top of everyone’s list should be the customers’ financial information. The best way to avoid PCI audits and headlines about credit card lists leaking to the internet is to not store that data in the CRM system in the first place. Although your customer service reps (CSR) may need to access that data, the CRM system should hold only pointers (external keys) to the system of record for credit card numbers, bank account numbers, payment history, etc. A good integration broker can bring that information over for real-time display purposes only — this is where a browser UI and Web 2.0 mashups really shine. If you must cache some customer-sensitive information in the CRM system, truncating the fields (“last four digits of your social”) is the least you can do: multiple obfuscation techniques should be used in tandem.

It’s more than just those obvious financial data. In insurance and medical records, add HIPAA. For education and government markets, there’s FERPA. Add your favorite acronym here — it all adds up to the need to protect your customers’ (and in some cases employees’) personal information.

And then there’s Europe. U.S.-based readers may not realize the European Community’s personal information protection rules are much tighter than those out of Washington, and some member countries have even tighter privacy regulations than the EC. Even though these privacy laws are intended to protect the information of “natural persons” (consumers), if you sell B2B you have to be aware of the requirements with respect to your customer’s European employees…and your own. EC Directive (95/46/EC Chapter IV) indicates that the personal information cannot be transported or processed outside of the EC unless the country it’s being processed in has privacy laws at least as stringent as the EC. Lovely. The good news is, there are several ways to resolve this. But you’ll definitely need to consult your attorney regarding compliance strategies.

Spammity-Spam, wonderful Spam!

As I mentioned recently, a CRM system practically runs on e-mail addresses. You need to protect this valuable asset with DLP/ILP policies and products. You also need to make sure that unsubscribe requests are honored — and just having an “e-mail opt out” flag on your CSR screen isn’t enough. We invariably recommend that the e-mail opt-out system (1) be fully integrated across your Web sites, e-mail blaster, and marketing automation system and (2) corrupt e-mail addresses so that they will bounce.

Now let’s look at the other side of CRM e-mail: the threads that the system receives for people, bugs, and transactions. You don’t have to be Scooter Libby or Frank Quattrone to know that e-mails can be a discoverability nightmare. In product defect lawsuits, a key issue is “what did the vendor know, and when did they know it?” Your CRM’s Solutions and Knowledge base areas are usually pretty safe territory. But if the system’s Cases contains lots of inbound and outbound e-mails — which are a big plus for your customer support function — you need to have an iron-clad policy about e-mail deletion (classically, within 6 months to a year after the closure of the Cases). However, don’t play games: the policy needs to apply to all the e-mails, not just select ones you feel nervous about. Consult your attorneys.

Document Retention

Which brings us to the more general area of documents. Most CRM systems allow you to attach documents to contacts, cases, transactions, and nearly any other object in the system. This makes life a lot easier for your marketing, sales, support, finance, and operational areas. But it is uncontrolled (a user can put nearly any kind of file in the system) and typically unmonitored (other than for overall storage quotas). Because the CRM system presents the documents as attachments to its object model, rather than as a file system, you will need to develop specific reports and search methods just to discover what legally discoverable documents you have in the system.

For obvious governance reasons, you need to have a policy about this storage area. Start out with what kinds of content are allowed for each class of attachment, the document retention policy, and a specified purging schedule. Consult your attorneys. One idea we widely recommend is storing certain classes of document (e.g., negotiation notes, draft proposals, bug fixes) in one of your own secured servers. There are several ways of presenting the needed information within the relevant customer/case/transaction record without actually storing it in the CRM system. This can be quite seamless in SaaS CRM systems, and there are some free and low-cost plug-ins that do this for Salesforce.com.

One Last Item

Most CRM systems keep a series of logs (including audit trails) which automatically purge after a year or so. The exact policy of what you want to archive on your own servers is up to you — but take my advice, have a written policy about this and have somebody responsible for enforcing it evenhandedly. And make sure that the records of user log-ins is absolutely on your list. You’ll thank me, come next law suit.

David Taber is the author of the new Prentice Hall book, “Salesforce.com Secrets of Success” and is the CEO of SalesLogistix, a certified Salesforce.com consultancy focused on business process improvement through use of CRM systems. SalesLogistix clients are in North America, Europe, Israel, and India, and David has over 25 years experience in high tech, including 10 years at the VP level or above.

Follow everything from CIO.com on Twitter @CIOonline.