Bill Tolson
Colorado
As seen in:
LinkedIn,
Law.com,
betanews,
DZone,
KDnuggets,
SC Magazine UK,
Security Magazine,
DATAVERSITY,
Virtual-Strategy Magazine,
CPO Magazine
and
President, Tolson Communications
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Bill Tolson
Government Records Retention for Teams, Slack, and Text
A government records retention schedule should make public records requests simple. In practice, a request for all communications about a road repair project can turn up email, Microsoft Teams chats, texts, and social media comments, as well as paper files. A good schedule sets retention periods and destruction triggers, but the harder question is whether an agency can enforce those rules across the systems employees use.
How Government Agencies Can Archive Digital Communications
Government communications now extend far beyond email. Every channel — text, Teams, Slack, social media, and voice — creates new public records challenges at the intersection of FOIA, litigation, eDiscovery, and public trust. Agencies may assume that adopting these tools means their records are under control, but fragmented data increases legal exposure.
Building a Defensible Social Media Strategy for Government Agencies
Social media has become one of the most important communication channels for government agencies. Agencies use it to share emergency alerts, promote public meetings, explain services, answer questions, recruit employees, correct misinformation, and reach residents where they already spend time. But social media is no longer just a communications function.
The Case for FOIA-Ready Public Records Management Software
Mobile communications have become a top concern for government legal and compliance teams. Text messages, collaboration chats, and mobile messaging applications have fundamentally changed how public business is conducted. Still, many agencies lack clear governance policies and technical controls needed to manage these communications in a way that supports FOIA compliance and state public records obligations.
Cybersecurity Threats Targeting Government Communications
For years, cybersecurity in the public sector was treated as an IT issue; handed off, revisited at audit time, and largely out of view unless something broke. That approach is no longer enough. Now, cybersecurity underpins service continuity, data protection, and public trust. When systems fail or data is exposed, the impact is immediate and visible. Framing cyber as purely technical misses these operational stakes.
Text Message Archiving for Government Agencies
Text message archiving for government agencies is now a compliance requirement, not a future concern. As more public business moves to text messages and mobile devices, government agencies need a reliable way to capture, retain, and search these communications alongside email and other records. Without it, government agencies risk missed FOIA and open records requests, slower response times, and increased legal and compliance exposure.
US Data Privacy Laws and Regulations in 2026
The Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing consumer protection and privacy standards in the U.S. Although there is no comprehensive federal data privacy law, the FTC uses Section 5 of the FTC Act to prohibit unfair or deceptive practices involving personal data. The FTC investigates privacy violations, issues penalties, and guides businesses on data security and privacy best practices.
Government Records Management in 2026: AI, Cloud & Compliance
As we head into 2026, records programs in state and local government are being forced to modernize faster than most agencies planned due to new website and records requirements. According to the National Association of State Chief Information Officers (NASCIO), artificial intelligence (AI) has overtaken cybersecurity as the top technology priority for government CIOs, a shift that has not occurred in more than 20 years.
US Data Privacy Laws in 2025: New State Rules & Rising Risks
TL;DR: State data privacy laws rapidly expanded in 2025, introducing new requirements for sensitive data, AI profiling, and universal opt-out signals. Businesses need adaptable, privacy-by-design compliance strategies to manage rising multi-state regulatory complexity. US data privacy laws have entered a new era.
Achieving CJIS Compliance in the Cloud Era: A Strategic Imperative for State and Local Agencies
TL;DR: CJIS compliance in the cloud era is a strategic imperative that protects data, ensures accountability, and builds long-term public trust. For leaders in state and local government, especially those tasked with overseeing law enforcement operations, compliance with the FBI’s Criminal Justice Information Services (CJIS) standards is not just another item on a regulatory checklist. It is the backbone of data protection, organizational credibility, and ultimately, public trust.
The Future of Government Agency Records Archiving: What to Expect in the Next 5 to 10 Years
The role of agency archives is undergoing rapid change. Once viewed primarily as a compliance obligation or a back-office storage function, records archiving is now an essential infrastructure for maintaining public trust, ensuring digital continuity, and informing strategic decision-making. What was once a static repository is transforming into a living, responsive, and often cloud-based system for managing a growing universe of data.
Smarsh and Google Workspace: A New Era of Compliant Collaboration for Financial Services
Financial firms face a challenge: how to embrace modern tools without opening the door to compliance risk. Smarsh is helping to solve that challenge by empowering firms to move faster, collaborate smarter, and remain audit-ready at every step with a new solution that integrates with Google Workspace. Why it matters Compliance teams must ensure modern collaboration tools like Google Workspace don’t create regulatory gaps.
Digital Communication Archives Aren't Just for Compliance Anymore: 10 Powerful Archive Use Cases
Once considered little more than a safeguard for legal and regulatory purposes, digital communication archives are quietly evolving into some of the most versatile and powerful tools available in a modern business toolbox. Initially established to meet compliance obligations, companies are discovering a wealth of potential benefits hidden within these archives. These repositories, which store years of conversations, decisions, emails, and data, can do much more than satisfy compliance checkboxes.
Laying the Groundwork for Increased (and Compliant) Productivity with Agentic AI
We've previously examined real-world risks associated with agentic AI — autonomous systems capable of making decisions and taking actions without direct human oversight — and how AI logging will play a critical role. Now that we've addressed how to manage those risks, how can businesses ensure compliance with emerging AI liability frameworks? In this post, we explore the strategies, best practices, and regulatory shifts shaping the future of AI liability.
Agentic AI Unleashed: Who Takes the Blame When Mistakes Are Made?
Imagine this: you build an agentic AI assistant that can take actions on its own — a truly autonomous system that goes about its daily business without constant human supervision. Now, picture that same system making decisions that lead to harm. What happens if your AI “goes rogue”? How do we assign liability when an autonomous system causes damage? These questions are starting to buzz around the world as regulators, companies, and legal experts try to catch up with rapid technological advances.
Smarsh Launches Integration with OpenAI’s ChatGPT Enterprise Compliance API
Everyone was excited for the prospect of having their own personal research and writing assistant when ChatGPT landed on the scene last year. However, as we’ve previously covered, those in the financial services sector had questions about the use of generative AI in general — especially how it impacts their compliance and regulatory obligations.
Cyber Risk Management in Financial Services
Cyber risk management is a hot topic these days, garnering increasing attention from regulators, including the financial services industry. As cyberattacks become more prevalent, it’s becoming increasingly important that financial services firms enhance their cybersecurity defenses to best protect themselves against cyber threats.
The Quest for a Comprehensive Federal Privacy Law: ADPPA vs APRA
One possible compromise could involve the preemption clause in ADPPA. Although a consistent national standard is attractive for businesses that operate across state lines, there might be an opportunity for a mixed approach that allows certain aspects of state laws to exist alongside the federal framework. This could mean allowing stronger state laws to continue in specific areas, such as biometric data privacy or data breach notification requirements.
Off-Channel Communications Top 3 Considerations: Define, Capture and Oversight
Another critical consideration of off-channel enforcement has been the “failure to follow up on red flags.” For most firms, this directly points to the processes and procedures for communications oversight across the entire employee population. For FINRA-regulated firms, level 1 supervision policies are defined within written supervisory procedures (WSPs) for ‘associated persons.’ This is defined within FINRA 3110, primarily consisting of broker-dealers and those carrying dual registrations.
Generative AI and Data Privacy: The Challenge of PII Use in Training Data Sets
The rapid advancement of generative AI models, such as large language models and image generators, has ushered in a new era of technological capabilities. However, this progress also raises significant concerns regarding data privacy compliance when personally identifiable information (PII) is included to train these powerful AI systems.
SEC's Message to Advisers
The Securities and Exchange Commission (SEC) has sent a clear message to the investment advisory industry with its latest enforcement actions related to the Marketing Rule. Five firms were charged and fined over $200,000 for a range of violations, underscoring the agency's commitment to ensuring advisers adhere to the rule's strict compliance requirements. At the heart of these cases were issues surrounding the use of hypothetical performance data in firm advertising and marketing materials.
Strategic Partnerships Highlighted at SmarshCONNECT 2024
A special thanks to all our customers and partners who joined us in NYC for SmarshCONNECT 2024! We appreciate your time and valuable insights; both fuel our shared success. Each year, Smarsh hosts SmarshCONNECT, bringing together customers, technology leaders and industry experts to unlock insights into the new era of communications, technology and compliance.
Managing AI to Ensure Compliance with Data Privacy Laws
Artificial intelligence (AI) is a powerful technology that can enhance business performance, innovation, and customer satisfaction. However, AI also poses significant challenges to data privacy and compliance, as it involves collecting, processing, and analyzing large amounts of personal and sensitive data.
Smarsh and TeleMessage Enhance Mobile Messaging and Voice Capture
We’re thrilled to announce that TeleMessage is now a Smarsh company. TeleMessage technology solutions are an integral component of our combined, industry-leading mobile and voice compliance offerings, and we’re excited to welcome the TeleMessage team into the Smarsh organization.
Off-Channel Enforcement Update: The Value of Self-Reporting Becomes Clearer
The SEC continues its mission to change behaviors in financial services regarding the use of unapproved communications tools. Last week, the regulatory agency announced its most recent enforcement actions and recordkeeping violations settlements: $81 million in total penalties across 16 financial services firms.
Taming the Data Flood: How Data Consolidation Empowers Businesses
Organizations are grappling with numerous data governance and information management challenges as vast amounts of digital data flood into organizations at a record pace. These challenges are fueled by the new regulatory retention requirements, rising ransomware and malware attacks and the growing adoption of generative AI.
2023 Regulatory Trends, Reading Between the Fines
The complex regulatory landscape continues to shift for financial services firms. Evolving enforcement trends, new regulatory expectations, and emerging legal challenges dominated discussions in the recent “2023 Regulatory Trends: Reading Between the Lines” webinar presented by industry experts Brian Rubin and Andrew Mount of Eversheds Sutherland and Tiffany Magri of Smarsh.
A Close Look Back at 2023 and What's on the Horizon for 2024
As we bid farewell to 2023, we turn our gaze toward the horizon of 2024. The financial services landscape stands at the intersection of a transformative digital era and the reflections of the disruptions witnessed in the past year. Against the backdrop of global market dynamics, a surge of off-channel fines, and heightened regulatory pressures, compliance teams find themselves navigating existing regulatory frameworks and the ever-shifting currents of a digital environment.
What’s the State of Canada’s Data Privacy Bill C-27?
In today’s constantly evolving digital landscape, individuals' personally identifiable information (PII) has become a significant target for cyber thieves. Since the EU’s General Data Protection Regulation (GDPR) became law in 2018, many organizations have worried about what the future would hold for companies as more and more governments passed different data privacy laws.
Still No Federal Data Privacy Law: What Happened to the ADPPA?
The new age of data protection laws began on May 25, 2018, with the passing of the EU’s General Data Protection Regulation (GDPR) law. The GDPR is a comprehensive data privacy and security law that established a strict framework for the collection, processing, storage and transfer of personal data from EU citizens.
Best Practices for Mobile App Compliance
From the webinar: Mobile Apps are the New Email - Is Your Firm Compliant? by Steve Boyd, Director, Head of Miami, Optima Partners and Tiffany Magri, Senior Regulatory Advisor, Smarsh. As more firms begin to allow the use of mobile communication channels, the need for robust books and records and supervisory controls is paramount. Firms understand that these tools are critical for meeting regulatory compliance obligations and reducing the risk of an enforcement action.
Best Practices for Ensuring Compliance with Mobile Apps
From the webinar: Mobile Apps are the New Email - Is Your Firm Compliant? by Steve Boyd, Director, Head of Miami, Optima Partners and Tiffany Magri, Senior Regulatory Advisor, Smarsh. As more firms begin to allow the use of mobile communication channels, the need for robust books and records and supervisory controls is paramount. Firms understand that these tools are critical for meeting regulatory compliance obligations and reducing the risk of an enforcement action.
Insights from the SIFMA C&L Regional Event in Charlotte
In the quickly evolving landscape of artificial intelligence (AI), financial firms have been met with new compliance challenges. Against this backdrop, professionals from the financial industry converged at the SIFMA C&L Regional event in Charlotte to discuss responsible implementation, regulatory compliance, and the potential benefits AI offers while mitigating potential risks with a focus on generative AI technology.
Navigating the Dynamic AI Landscape: Insights from the SIFMA C&L Regional Event in Charlotte
In the quickly evolving landscape of artificial intelligence (AI), financial firms have been met with new challenges. Against this backdrop, professionals from the financial industry converged at the SIFMA C&L Regional event in Charlotte to discuss responsible implementation, regulatory compliance, and the potential benefits AI offers while mitigating potential risks with a focus on generative AI technology.
Navigating the Impact of Data Privacy Laws on Information Management
This write-up is a companion piece to my previous blog, “The Evolving Data Privacy Landscape: Trends in Data Privacy Laws.” This post will tie the emerging data privacy law requirements discussed in the last blog into the new data privacy laws that will affect how organizations change their information management. Data privacy laws are becoming increasingly prevalent and disruptive for businesses across many industries.
CFTC Steps Up Mobility Enforcement in Swaps Market
The Commodities Futures Trading Commission (CFTC) issued charges against a global investment bank for failing to properly retain audio files recorded from mobile devices related to their swaps business. Previous attempts to address the issue via a variety of third-party and home-grown technologies failed, resulting in the loss of thousands of calls. The relatively small $5.5 million fine reflects the bank’s cooperation with the CFTC and actions to remediate the issue.
Best Practices in Public Record Response
Content based on the webinar: Public Record Response - Best Practices in 20 Minutes by Bryan Pierre, Public Administration Program Manager, TD Synnex Public Sector and Robert Cruz, VP, Information Governance Solutions, Smarsh. Government agencies today communicate and engage with their constituents in new and innovative ways. However, agencies must still respond to public records requests in compliance with the Freedom of Information Act (FIOA) and state Sunshine laws.
The Evolving Data Privacy Landscape: Trends in Data Privacy Laws
In today's data-hungry world where personally identifiable information (PII) is constantly collected, processed, shared, and sold — data privacy has become a paramount concern to individuals, companies and governments. Individuals are becoming increasingly aware of the need to protect their PII. Companies are becoming aware of the risks of holding and properly securing PII, and lawmakers are responding to voters by enacting sweeping data privacy laws.
Data Privacy Laws; An Inflection Point for Information Managers
Bill Tolson Bill Tolson Advisor, Consultant - Data Privacy I Data Security I Information Management I eDiscovery I Compliance Published Mar 9, 2023 I have written about this topic several times, but with recent changes, I wanted to jump into it again. The basic premise is that with the rising numbers of data privacy bills becoming law, the Information Management/Records Management profession will face managing much greater amounts of corporate data.
Episode 35: Information Management in an Evolving Data Privacy Environment
Never miss an episode Subscribe Now Listen to "Episode 35: The State of Information Management in an Evolving Data Privacy Environment" on Spreaker. Description: In this episode we review the challenges Information Managers have with managing the current US state data privacy laws and the future state privacy laws introduced into legislation this year.
Episode 33: Effectively Managing Data in the Age of Emerging Privacy Laws
Transcript Bill Tolson: Welcome to Archive 360's Information Management 360 Podcast. This week's episode is titled effectively managing data in the age of emerging privacy laws with Mark Diamond. My name is Bill Tolson, and I'm the vice president of compliance and e-Discovery at Archive 360. Joining me today, as I said, is Mark Diamond, President and CEO of Contoural Incorporated. Mark, can you talk a little bit about your company and its areas of focus? Mark Diamond: Thank you very much, Bill.
Data Minimization: A Key Requirement for Effective Cybersecurity
The accumulation of unmanaged corporate data has reached an inflection point for data security and information management professionals. It is estimated that by 2025, 463 exabytes of data will be created daily, and by 2025, the "cloud" will house 200 zettabytes, up from 4.4 ZB in 2019 and 44 ZB by 2020. The bottom line is, in general, data is multiplying, and corporate data is accumulating at an unprecedented rate.
SEC Rule 17a-4 Amended: Taking the WORM Requirement Out of our Misery
The Securities Exchange Act of 1934 established record maintenance and preservation requirements applicable to all broker-dealers via Rule 17a-4. In 1997, the SEC adopted a rule that required all “books and records” (records) to be preserved exclusively in a non-rewriteable, non-erasable format to ensure that electronic records could be accurately reproduced for later reference by maintaining the records in an unalterable or immutable form.
A national data privacy law might arrive sooner than expected
For those of us waiting for a national data privacy law — and those numbers might be rising — there’s good news. The U.S. House Energy and Commerce Committee recently amended and passed HR 8152, the American Data Privacy and Protection Act (ADPPA). This legislation has already made it further than any other federal privacy law and faster than many expected. Now comes the hard part.
Data Privacy Conundrum: When Different States Play by Different Rules. . .
It’s been less than two and a half years since the California Consumer Privacy Act, also known as CCPA, went into effect, but the influence of that signature legislation is already incalculable. Like General Data Privacy Regulation (GDPR), the European mandate that came before it, this set of wide-ranging regulations has fundamentally changed the conversation on data privacy and reset the clock on what government can and should do to protect consumers’ personal information.
CPRA: The Next Big Mandate (Is Right Around the Corner)
Tackling yet another set of mandates can induce a feeling of dread. It’s just more bad news, right? We already have an alphabet soup of regulations specifically around privacy: the mighty GDPR (General Data Protection Regulation) in Europe; industry-specific guidelines like HIPAA (Health Insurance Portability and Accountability Act) in healthcare; and the more recent rise of state-centric legislation like CCPA (California Consumer Privacy Act) in California.
Why In Place Information Management Is Not A Complete Solution
Every year, companies face the inevitable prospect of adding additional terabytes of new storage resources to their numerous, overloaded, and expensive enterprise storage repositories to keep up with the constantly growing storage requirements. These storage repositories include application-specific repositories, on-premises email archives, department share drives, individual employee "home" drives, SAN/NAS devices, employee cloud accounts, SharePoint systems, to name just a few.
A Backup is not an Archive …
I first wrote about the differences between backups and archives almost 20 years ago. At the time, organizations were struggling to get to grips with the requirements to retain electronic records and the new-fangled world of e-discovery. So why are we still talking about this? And, more importantly, what’s changed? One word – cloud! And the right to be forgotten – more about that later.
A Secret No Longer: Data Anonymization Redux Needed as Industry Learns that Anonymization Not the Same as Erasure
A major privacy fault line has just been revealed as “anonymized data” is now exposed to be not so anonymous after all. An article published by the New York Times reports that new technology can frustrate present efforts to keep data private in a July 23, 2019 article, Your Data Were ‘Anonymized’? These Scientists Can Still Identify You.
What Does GDPR Compliance Have in Common with Sex Education?
And now that I have your attention… there really is a link between the two incongruous topics in the headline. Archive360’s Bill Tolson explains. Perhaps you remember sitting through a class in high school billed as “sex education,” yet finding it dealt so indirectly with the topic that it was difficult, if not impossible, to discern the pertinent details that would help you understand what you really needed to know in this area.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Bill
Contact Bill, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack