A recent survey found that 69% of American businesses use cloud storage to some extent and that 40% of all enterprise data is now cloud-based. Motor carriers are no exception. The growing use of GPS, electronic logging devices, onboard cameras, and other telematics technology is generating an ever-growing stream of data, much of which ends up in cloud storage. The following article will review some important considerations and potential pitfalls presented by this trend.
Minimum Retention Periods
The Federal Motor Carrier Safety Administration (“FMCSA”) impose a host of record-keeping requirements on regulated carriers. Some of the most common are summarized below:
Driver Qualification Materials
FMCSA Regulation 391.51, which governs, among other things, the retention of driver qualification materials, requires initial qualification documents, including a driver’s application, driving record, and road test certificate, to be retained for 3 years after the driver’s last of employment. Annual additions to the qualification file, like driving record updates and medical certificates, must be maintained for three years from the date each document is issued. Additionally, Pursuant to Regulation 382.401, negative drug and alcohol test results must be retained for 1 year from the date of the test, and positive results must be retained for 5 years.
Hours of Service Logs
Under Regulation 395.8(k), carriers are responsible for maintaining their drivers’ hours of service logs for 6 months from the date of receipt.
Vehicle Records
The retention periods for vehicle records are generally a bit shorter than personnel records. Regulation 396.3(c) specifies that vehicle maintenance documents must be stored for 1 year. Driver inspection records need only be kept for 3 months under Regulation 396.11(c), and roadside vehicle inspection reports must be keep for 1 year under Regulation 396.9(d). Regulation 396.17 requires that periodic inspection reports be kept for longer—14 months from the date of inspection.
Just like carriers that keep their records on-site, carriers that store their data in the cloud are subject to these minimum retention periods. Note, also, that these periods are minimums only, and should be extended for any documents that are potentially relevant to active or anticipated litigation.
Document Deletion
As important as preserving data is ensuring that it is timely and permanently deleted once the applicable FMCSA or self-imposed retention period ends. Failure to do so can leave a carrier’s data unnecessarily exposed to future litigation, regulatory records requests, and even hackers. Unfortunately, for any data that is not stored locally, the carrier must rely on its cloud storage provider to carry out prompt and effective deletions. This is largely a trust exercise and is not particularly easy for the carrier to verify. (Simply because a file appears to be deleted in the storage provider’s user interface does not necessarily mean that every copy of it has been purged from the cloud.)
One way for a carrier to mitigate the risk of lingering unwanted files is to encrypt own data before sending it to the cloud. That way, when the carrier’s retention period expires, it can dispose of the encryption itself, rendering the data inaccessible even if it is not deleted by the cloud storage provider. However, this approach has its own downsides. It is time and labor-intensive, and prevents the storage provider from parsing the data for purposes of fleet management, auditing, and other value-added services.
Location of Documents
Acceptable storage locations for records that must be maintained under the FMCSA regulations are governed by Regulation 390.29, which provides:
(a) A motor carrier with multiple offices or terminals may maintain the records and documents required by this subchapter at its principal place of business, a regional office, or driver work-reporting location unless otherwise specified in this subchapter.
(b) All records and documents required by this subchapter which are maintained at a regional office or driver work-reporting location shall be made available for inspection upon request by a special agent or authorized representative of the Federal Motor Carrier Safety Administration at the motor carrier's principal place of business or other location specified by the agent or representative within 48 hours after a request is made. Saturdays, Sundays, and Federal holidays are excluded from the computation of the 48-hour period of time.
By omission, Regulation 390.29 implies that a carrier without “multiple offices or terminals” must keep all required records at its principal place of business. Additionally, such single-office carriers do not appear to get the benefit of the 48-hour compliance window set forth in Regulation 390.29(b). This was recently adopted by the FMCSA in In re Ram Moving Corp. dba All United Van Lines, FMCSA Docket Nos. 2009-0038 and 2009-0039, an enforcement proceeding against a California-based carrier charged violating, among other things, the FMCSA’s record retention requirements. Issuing final orders against the carrier, the FMCSA held:
Unless it qualified for an exception, Respondent was required to produce the requested records on demand at its principal place of business. As Respondent correctly observed, 49 CFR 390.29 provides that a motor carrier with “multiple offices or terminals” may maintain records or documents required by 49 CFR chapter III, subchapter B at its “principal place of business, a regional office, or a driver work-reporting location.” But Respondent did not establish its eligibility to use this exception. It did not submit evidence demonstrating that it was a motor carrier with multiple offices or terminals, or that its records were maintained at a regional office or driver work-reporting location. In the absence of establishing eligibility for the exception, Respondent was required to produce the documents on demand and was not entitled to a 48 hour extension.
At first glance, Regulation 390.29 would appear to prevent carriers from maintaining required records in the cloud altogether. After all, cloud storage is offsite by definition. However, as In re Ram Moving Corp. suggests, the FCMSA is more concerned with a carrier’s ability to produce electronic records immediately upon request—or within 48 hours if it qualifies for the exception in Regulation 390.29—than with the physical location of the servers storing carrier’s data. Indeed, a review of FMCSA dockets since the advent of cloud computing does not reveal a single instance of penalties being imposed on a carrier for use of remote data storage alone. Thus, while Regulation 390.29 has yet to be modernized to expressly allow cloud storage, it is also not being used as a weapon to fight it.
In the face of this tacit regulatory approval, numerous cloud-based fleet management companies have sprung into existence, offering telematics and “FMCSR-compliant” data retention solutions. Many emphasize electronic hours of service logging, which is expected to become mandatory around 2017. That is far from the only service offered, though. Companies like Zonar, OrbComm, Riar, Tailwind, and SaferWatch all provide fairly comprehensive record-retention packages, spanning most or all of the categories of documents required by the FMCSA.
Take-Aways
When choosing a cloud storage provider for transportation data, it is essential to ensure that it is familiar the FMCSA’s document retention policies and capable of ensuring compliance. It is equally important to ensure that data is purged once the carrier is no longer required to maintain it. While not expressly spelled out in the FMCSA regulations, cloud storage likely does not run afoul of the FMCSA’s rules concerning the location of records.
Adrian T. Lambie is an associate in the San Francisco office of Murphy, Pearson, Bradley & Feeney. He practices general civil litigation in both state and federal courts, with emphases in the areas of professional liability, representing accountants, architects, brokers, design professionals and lawyers. He can be reached at [email protected] or (415) 788-1900.
