Privacy & Information Security Law Blog

On March 3, 2023, the U.S. Department of Justice (“DOJ”) released an update to its Evaluation of Corporate Compliance Programs guidance (“ECCP Guidance”). The ECCP Guidance serves as a guidance document for prosecutors when evaluating a corporate compliance program. Among other updates, the ECCP Guidance now includes new guidance for assessing how companies govern employees’ use of personal devices, communication platforms and messaging applications.

Specifically, pursuant to the ECCP Guidance, DOJ now will consider when evaluating corporate compliance programs and investigating potential misconduct, a company’s policies and procedures related to the use of personal devices and communications platforms and messaging applications, including ephemeral messaging applications. For example, DOJ will consider (1) how policies relating to personal devices and communications platforms are “tailored to the [company’s] risk profile and specific business needs”; (2) how the policies (and other mechanisms) ensure that business-related data and communications are “accessible and amendable to preservation”; (3) how the policies have been communicated to employees; and (4) whether and how the company has enforced the policies on a regular and consistent basis. 

Read more about the ECCP Guidance.