Employer can keep personal info for years

Q: What happens after I leave the company to the personal information about me my employer has?

A: These days, employers have a host of information on employees, including medical and health insurance records, information in pension and 401(k) plans, and bank account numbers from direct deposit.

Most companies keep this information long after an employee's termination to comply with various federal regulations, said Charles Knapp, a partner at law firm Faegre & Benson LLP in Minneapolis.

In general, companies typically keep personnel and employee benefit files between one and five years and payroll records for three years, Knapp said.

As for the destruction of these files, there is no federal law that regulates how and when an employer needs to delete this information, said Don Harris, president of HR Privacy Solutions Ltd., a consulting firm in Delhi, N.Y. However, at least 13 states have some type of records disposal law that requires employers to create a procedure for the proper disposal of documents containing personal information, he said.

In general, recordkeeping and disposal practices vary widely. More responsible companies archive the information in backup files that are not easily accessible. Others, though, may keep it in current files, which could be susceptible to hacking.

When the employer gets rid of the information, all paper documents should be shredded or burned, and electronic files destroyed.

Smaller businesses or those facing bankruptcy pose the greatest risks, Harris said. They often don't follow any specific procedures, and many throw these documents out like regular garbage.

Various states require companies to report to employees if the security of employee data is breached, but there is no comparable federal law.

"I think responsible employers are trying to move toward keeping data for shorter time," Harris said. "But records management is never at the top of anyone's lists."

Kevin Joerling, a certified records manager at trade group ARMA International, recommends that when you leave a company, ask the human resources department about its recordkeeping and disposal process.

The department should be able to answer these questions: How long are you going to keep the records? Who will have access to those records? How will these records be deleted?

"If you don't get straight answers, continue to ratchet up to higher levels of the organization until you get the information," Joerling said. "There should be no secrets on that information."