Can Your Records Management Programs Handle Ediscovery? By Dana R. Baughns and John Horoschak

Transcription

1 Can Your Records Management Programs Handle Edscovery? By Dana R. Baughns and John Horoschak

2 The long recesson, exponental growth n electronc data, and the expanson of court cases on what corporatons and ther n-house counsel must do, have forced n-house counsel to mprove the management of the ltgaton edscovery phase n an extremely cost-conscous manner. Once somethng that outsde counsel worred about, and somethng n-house counsel only worred about when there was an actve ltgaton matter, n-house counsel now face ncreased judcal scrutny related to edscovery. Varous court rulngs have taken ther am at n-house counsel, and many local court rulngs promulgated across the country show that the excessve burden of edscovery and reasonable accessblty to data have been overstated. As a result, many corporatons have elected to take control of ther edscovery process. Rather than relyng on ther law frms and vendors to handle these requrements, many corporatons are ntegratng edscovery nto ther corporate governance, rsk and complance strateges n ACC Docket 91 May 2011

3 Corporatons now have key legal professonals nvestng tme, energy and money nto the development of corporate-wde edscovery strateges focused on the left sde of the electronc dscovery reference model (EDRM), to cut costs and ensure defensblty. These strateges nclude creatng or enhancng records management programs, and nvestng n technology to brng edscovery n lne wth other busness processes to decrease overall rsk, reduce costs related to ltgaton support and fulfll regulatory complance mandates. The left sde of the EDRM ncludes nformaton management, dentfcaton, collecton and preservaton. Ths artcle wll focus on relevant areas of nformaton management and dentfcaton. As defned by the EDRM, nformaton management ncludes records management, complance and IT nfrastructure. Ths correlates to Early Case Assessment and edscovery. Accordng to the EDRM, dentfcaton ncludes dentfyng potental sources of relevant nformaton, developng the dentfcaton strategy and plan, establshng the dentfcaton team, and dentfyng and certfyng potentally relevant edscovery sources. Dana R. Baughns s assstant general counsel for Allegs Group, Inc., and her prmary responsblty s managng labor and employment matters for the Allegs famly of companes. She can be contacted at dbaughns@ allegsgroup.com. John Horoschak s a sales executve wth doelegal. He has served the legal communty n a sales capacty for over 10 years. Prevously, Horoschak practced law n Oho, assstng corporate clents wth regulatory complance matters. He can be contacted at jhoroschak@ doelegal.com. Informaton management records management Records management s the frst step n an overall approach to mtgatng rsk to a corporaton, contanng the costs related to edscovery and meetng regulatory complance requrements. It has become crtcally mportant for corporatons to mplement and mantan effectve records management programs. Whle many busnesses understand the necessty of a records management program to assst n complyng wth edscovery mandates, very few busnesses have a grasp on what steps to take to begn the process of developng a formalzed corporate-wde records management program. Maryland-based Allegs Group, Inc., s a large, prvately held staffng company. Includng all of ts afflate company locatons and ts corporate headquarters n Hanover, Md., Allegs Group, Inc., has more than 300 offces worldwde. Allegs Group s global ftprnt ncludes provdng recrutng, staffng and human captal busness servces n the Unted States, Canada, Mexco, Puerto Rco, Europe, Mddle East and Asa markets. The task of revampng ts current record retenton polcy to create a comprehensve records management program for Allegs Group and ts afflate companes was ntmdatng. Lke many other busnesses, the company struggled wth developng a more comprehensve and consstent process of determnng how to dentfy the record ftprnt of ts afflate companes. Gven the cross-secton of departments n several afflate companes, the task of determnng what, where, why, when and how records are created, stored and destroyed was dauntng. But fear not; the task s not nsurmountable. In fact, f you are stll ntently readng ths artcle ths secton n partcular congratulatons, you have already taken the frst step n the rght drecton. The gudng precept, should you contnue on ths msson, s to understand the record ftprnt of your busness and to develop a management program for t. An effectve records management program wll generally consst of three components: records management polcy, a correspondng records retenton schedule and a records ndex. Understandng the necessty of these three components detaled n the 10 steps below wll make t ncreasngly easer to navgate the process of creatng a records management program. Apprecate the challenge and assemble a team: As wth most corporate-wde projects, you must frst assemble a team of able-boded, although probably secretly unwllng, people to drag through the process wth you. Your team should at least consst of representatves from the legal, nformaton technology (IT), human resources and the accountng departments. Apprecate the challenge of havng executves and IT professonals joned for a common purpose, when ther respectve phlosophy regardng record management s dvergent. Most executves prefer to save every emal for ready reference, whle most IT professonals prefer to focus on creatng space on the network by elmnatng nonessental or dated emals. Notwthstandng these dfferng vewponts, representaton and nput from the above-mentoned busness unts wll assst wth understandng the record ftprnt of your organzaton and ncrease the success of your records management program. Set deadlnes: Set a deadlne to complete the project. Most szable corporatons wll need at least a year to properly mplement a records management program. Defne records: Be sure everyone on your team understands how records are defned, because every record created may not necessarly be wthn the purvew of the records management program. In ths context, records are generally defned as nformaton captured to meet busness, operatonal, legal and regulatory requrements of the company, and may be ACC Docket 92 May 2011

4 Recognzed for best-n-class value, clent servce, and legal sklls by those who matter most: our clents. USA 2010 LEADING FIRM Ranked n the top 10 of 500 Named to the BTI Clent Natonally ranked health frms on the BTI Clent Servce Servce All-Star Team for clent care, franchsng, and sports A-Team lst for strong clent servce excellence, based law practces, and regonal focus, breadth of servce, solely on unprompted feedback recognton n 23 practce nnovaton, and value for the by corporate counsel at areas by Chambers USA: dollar (The BTI Consultng Group, large and Fortune 1000 Amerca s Leadng Busness Wellesley, Massachusetts, 2011) companes (2010) Lawyers (2010) Named to CIO magazne s Frst-ter rank natonally for Recently, 167 attorneys were M&A and botech law, and a selected by ther peers for prestgous CIO-100 top-10 frm for total number of ncluson n The Best Lawyers lst, comprsng global frst-ter metropoltan rankngs n Amerca 2011 (Copyrght companes demonstratng on the U.S. News Best 2010 by Wdward/Whte, technologcal nnovaton Lawyers 2010 Best Law Inc., Aken, South Carolna) (2010) Frms lst At Foley, we ve made t our msson to fnd out exactly what our clents want and delver t ncludng cost predctablty, effcency, and responsveness. The result? Exceptonal value, superor clent-focused servce, excellence across more than 60 practces, and award-wnnng technology that streamlnes matter management. Our efforts haven t gone unnotced. We re partcularly proud of and thankful for the recognton that comes from those we value most our clents. To learn more about how Foley can help add value to your busness, contact Ralf Böer n our Chcago or Mlwaukee offce at rboer@foley.com. BOSTON BRUSSELS CHICAGO DETROIT JACKSONVILLE LOS ANGELES MADISON MIAMI MILWAUKEE NEW YORK ORLANDO SACRAMENTO SAN DIEGO SAN DIEGO/DEL MAR SAN FRANCISCO SHANGHAI SILICON VALLEY TALLAHASSEE TAMPA TOKYO WASHINGTON, D.C F o l e y & L a rd n e r L L P A t t o r n e y A d v e r t s e m e n t P r o r re s u l t s d o n o t g u a r a n t e e a s m l a r o u t c o m e N. C l a r k S t re e t, S u t e , C h c a g o, I L

5 n electronc (e.g., text, mages, calendar fles, databases, spreadsheets, audo fles, anmaton, webstes, computer programs, malware, socal meda, etc.), hardcopy or other forms (e.g., legacy mcroflm). Draft a polcy: Draft a polcy that addresses the purpose, scope, roles and responsbltes, retenton standards, and record destructon processes of your records management program for US-based operatons, as well as foregn operatons, whch are becomng the focus of many plantffs due to dfferng legal standards. Include polces that address: data management when an employee leaves the company; back-up tapes, recyclng PCs, servers, user hard drves, faled hard drves and legacy data systems; off-ste company storage facltes and thrd-party storage; new technologes such as dgtal voce mal stores, portable devces and cell phones, ncludng nstant messagng, voce mals and attachments; and whether employees can store fles on removable meda (floppes, CD-ROMs, DVDs, zp and thumb drves). Create a schedule: Create a records retenton schedule lstng applcable broad categores of records and ther legally recommended and/or requred retenton perods. Create a record ndex: Create a record ndex to assst wth dentfyng what records are created, retaned and destroyed n each substantve busness unt or department. The ndex should nclude a value classfcaton for each record. Is the nature of the record legal, operatonal, fnancal or hstorcal? The ndex should also dentfy the record custodan and how each record s mantaned. For example, s the record format electronc, paper or both? Evaluate record ndex: Evaluate the record ndex to determne f your busness needs requre a longer retenton perod for certan records. Fnalze: Formalze your records management polcy, records retenton schedule and each respectve records ndex. Change management: Develop applcable change management processes, tranng to accompany the records management program and an audtng process. Launch and revst regularly: Launch the records management program, montor the progress and revst the records management program every sx months to ensure complance. Add new polces and procedures, nclude any newly developed technology for managng the program, and add new team members from specfc busness unts to ensure the records management program endures and remans up-to-date for the corporaton n perpetuty. Identfcaton data mappng Part and parcel n havng a record management program s dentfyng and understandng your company s records ftprnt. Once a corporaton has defned the nformaton t needs to meet busness, operatonal, legal and regulatory requrements, managng ths nformaton effectvely when ltgaton s reasonably antcpated may feel overwhelmng, and the costs related to managng the data can be sgnfcant. Accordng to the EDRM, data can be contaned on many types of servers (fle servers, collaboraton servers, emal servers) and many nterrelated data management systems (document management systems, fnancal systems, dsaster recovery and backup systems). Servers hold not only general company data, but also user-specfc data (home drectores or departmental shared drectores) that encompasses a myrad of devces that users employ to utlze that data, ncludng desktop computers, photocopers, calendars, Instant Messagng (IM), text, cell phones, smart phones and memory cards. Addtonally, corporatons must plan for nactve data archves contaned on varous meda, such as hard drves, servers, recycle bns, tape backups, flash drves, CD-ROMs and DVDs. All of ths s further complcated by the fact that legacy data, potentally across all these categores, may exst from prevous company systems wthn the relevant tme perod, as well as the fact that the necessary hardware, software or techncal expertse to access such legacy data may no longer exst wthn the target company. Takng proper steps to dentfy potentally responsve data s the frst step n managng and reducng rsk, ltgaton preparedness and edscovery. The process by whch a corporaton ndexes ther data and nformaton s known as data mappng. A project that may take three to 12 months, data mappng n a broad sense s the process of understandng and documentng a drectory of a corporaton s data by category, locaton and custodan, ncludng how and n what format the data s stored, how t s accessed, and the assocated records retenton polces and procedures assocated wth the data as outlned n the corporaton s records management program. Data mappng s a requrement as set forth n the Federal Rules of Cvl Procedure (FRCP). Specfcally, Rule 26(a) (1)(A) drectly states the need for a data map by specfyng that partes must provde each other wth a copy or a descrpton by category and locaton of all documents, electroncally stored nformaton, and tangble thngs that the dsclosng party has n ts possesson, custody, or control, and may use to support ts clams or defenses. 1 Addtonally, nformaton must be provded on each ndvdual lkely to have dscoverable nformaton. ACC Docket 94 May 2011

6 What I know: I know we manufacture an ncredbly dverse range of tres from 13-pound passenger tres to 48-pound lght truck tres. I know a typcal tre has sx pounds of steel that, f lad end to end, would be almost two mles long. I know we provde exceptonal value to our customers. I know we are proud of our products, our customers and our busness partners. I know our busness partners nclude our attorneys. I know our attorneys provde exceptonal value to us. I know that I can count on Bradley Arant Boult Cummngs to do just that. That s what I know. JAMES E. KLINE VICE-PRESIDENT, GENERAL COUNSEL & SECRETARY COOPER TIRE & RUBBER COMPANY ALABAMA D I S T R I C T O F C O LU M B I A MISSISSIPPI N O R T H CA R O L I N A No representaton s made that the qualty of the legal servces to be performed s greater than the qualty of legal servces performed by other lawyers. Contact: John B. Grener, Esq., 1819 Ffth Avenue North, Brmngham, Alabama TENNESSEE

7 Several opnons have been wrtten dscussng the consequences of neglgent and grossly neglgent management of data durng dscovery. However, there s a paucty of case law specfcally referencng neffectve, ncomplete or completely lackng data mappng. If data mappng s not performed, or performed nadequately, the ncomplete producton may lead to court sanctons and possble negatve nferences aganst the corporaton and ther counsel. Wth advances n technology, many corporatons are ntegratng automated data mappng applcatons, especally n large enterprse organzatons, to decrease the workload, ncrease the accuracy of the data map and reduce costs when ntegrated wth edscovery solutons. Data mappng s key for establshng a defensble poston of complance wth varous agency recordkeepng requrements. Corporatons are under sgnfcant fnancal constrants n terms of resources, and a data mappng project wll lkely requre cost justfcaton. In-house counsel wll need to make ths pont so that the resources wll be provded. The project wll help n-house counsel develop a defensble dscovery process for ltgaton matters and may save the organzaton sgnfcant money related to edscovery costs. Dependng on how much data can be elmnated before data collecton, processng, revewng and producton, the savngs may be consderable. The tme to nvest n a data mappng project s before a complex dscovery order requres an organzaton to use outsde counsel to manage the process. Costs ncrease when a corporaton must locate relevant documents, emals (stored n multple locatons), paper fles, phone records, and back-up tapes for several custodans, geographcally dspersed wthn a short perod of tme. The dscovery costs range from custodan data dentfcaton, collecton, processng revew and producton. As the completon deadlne becomes more dffcult to meet, the opportunty to strategcally evaluate the data before producton to opposng counsel decreases. If data from the same custodans s requred for a new case, and there s no underlyng data map, collecton process and data retenton of the collected data, the costly process may need to be repeated. Data collecton practces are more defensble f they adhere to a standard, n-use polcy that ncludes accurate data mappng. A standardzed approach demonstrates to a court an accurate repeatable process less lkely to mss mportant custodan nformaton. The process may also help wth electronc data and paper document storage cost reducton efforts. When the data map s complete, data that s not subject to a ltgaton hold or regulatory record keepng requrements may be dsposed n accordance wth the document management polcy. Ths reduces the lablty of mantanng documents wth potentally harmful content that may subject to a future ltgaton hold, collecton and producton. Reducng the volume of data exposed to the edscovery process could save an organzaton mllons n collecton, processng, document revew and producton. Reduce tme pressures of document producton. The data can be revewed before collecton to gan a greater understandng of these rsks before the dscusson. Quck dentfcaton of potentally harmful search crtera can be an effectve strategy tl durng dscovery negotatons. Creatng a data map s the frst step n determnng where your data resdes. What s a data map? A data map s a chart or graph that helps a corporaton determne at a glance where data s located, the data type, the meda used to store the data, whch departments the data supports, etc. On a more granular level, t dentfes whch groups of employees use what software and operatng systems, where the data s stored long term, and f the data has a destructon date. Data mappng nvolves the followng key steps: 1. defnng the project scope, 2. dentfyng team members, 3. gatherng data, 4. analyzng the data, 5. accountng for back-up tapes, 6. wrtng the data mappng document, and 7. revewng and updatng the fnalzed report. Data mappng steps Defnng the project scope Defnng the project scope depends on the nature of your corporaton s busness and the tls your employees use. Some employees share nformaton n a dalog form or bdrectonal data flow, whle others only receve nformaton n a undrectonal data flow. Ths characterstc wll mpact how effectve ltgaton holds are ssued and custodan data s collected. The complexty of how employees generate data should also be consdered. Healthcare and pharmaceutcal organzatons may need to track many locatons of every employee data from smart phones, hand wrtten patent status reports, and lab research notebks to the locatons of archved emals. For retal or manufacturng busnesses, locatng employee data may be more straght-forward. Questons to consder are: What types of servers are used for whch employee groups? Where are the servers located? What happens to the data of the server n the long term,.e., s t destroyed or moved to a back-up system? ACC Docket 96 May 2011

8 DISCOVERY & DISPUTE SERVICES CENTER Innovatve. Effcent. Responsve. McDermott stands behnd the commtment to helpng clents address the demands of dscovery n the electronc age, from retenton through revew. Boston Brussels Chcago Düsseldorf Houston London Los Angeles Mam Mlan Munch New York Orange County Rome Slcon Valley Washngton, D.C. Strategc allance wth MWE Chna Law Offces (Shangha) McDermott Wll & Emery conducts ts practce through separate legal enttes n each of the countres where t has offces. Ths communcaton may be consdered attorney advertsng. Prevous results are not a guarantee of future outcome.

9 Lke the cross-department nvolvement requred for the records management program, n-house counsel wll also need to nvolve people from key departments n the data mappng project. What s the logc behnd your current data storage process? How do you demonstrate a defensble nternal organzatonal search for responsve data n ltgaton? Do archvng, storng methods and data locatons vary by department wthn the organzaton? Do you use any hosted or cloud-based servces? Where s your data located? How secure s ths data? Is the organzaton Statements on Audtng Standards (SAS) 70 complant? Has the thrd party been thoroughly evaluated by your securty and IT groups durng your engagement process? Has anyone from your organzaton vsted the actual locaton where your data s stored? If so, are perodc nspectons planned to ensure your data s secure years after the ntal contract engagement? What s your current emal archvng process? An entre artcle could be devoted to ths queston, but here are a few consderatons: How many places are emals stored? Do you have an archvng polcy? Is t enforced? Do you allow employees to save emals and other data to PCs, laptops or other portable devces such as thumb drves? Does the company use an emal archve soluton? Wth most archve solutons, as emal and nstant messages are sent and receved, each message s bfurcated and coped nto an archve before t reaches whatever nstant messagng nfrastructure s n place (Exchange, Notes, GroupWse, etc.). An archve has a broad mpact on the corporate IT nfrastructure. Does the company use daly back-ups for emal? Back-ups are a pont-n-tme snapshot of emal data, and are not ntended to provde a complance soluton of any sort, especally because of ongong deleton of messages by users. Companes relyng on back-up meda for records management purposes usually spend substantal money on forensc experts to recover emal from back-ups. Does the company use storage optmzaton where archvng solutons extract mal tems from producton malboxes, and replace them wth stub messages from the emal server, to reduce the storage burden on producton mal servers? Identfyng team members Whle n-house counsel wll be admnstratng ltgaton holds as descrbed n the company s records management, they wll need to sgn up other team members n the company. Lke the cross-department nvolvement requred for the records management program, n-house counsel wll also need to nvolve people from key departments n the data mappng project. IT should be able to help wth hardware, software, server types and locatons, and the varous data formats used throughout your organzaton. Human resources may be able to assst wth the organzatonal herarchy and how nformaton flows between dfferent groups, and may also have a senstvty to specfc regulatory prvacy concerns,.e., Health Inusrance Portablty and Accountablty (HIPAA) Act requrements. Busness unt managers can also help dentfy systems they use that may contan relevant data and employees who may have relevant nformaton. Gatherng data To gather the data, n-house counsel wll need to work wth IT and each of the other team members. Whle not all data sources apply to every ltgaton hold and custodan, here are lkely sources and meda to consder when gatherng data: Emal where s t stored? Where does the number 15 come from? John Collns of the Ingersoll Frm suggests there are potentally 15 unque locatons for emal storage. Servers, tapes and hard drves Servers and locatons of all servers contanng custodan or potental custodan data Smart phones, IM and voce data Thrd-party provders data stored wth a cloudbased provder What steps have you taken to make sure you can get your data out of the cloud quckly; n a useable format? Has someone n your organzaton vetted your cloud provder s securty and ablty to delver your data to you when you need t? ACC Docket 98 May 2011

10 More straghtforward solutons. Our 475 lawyers worldwde collaborate wth clents to handle the full range of busness ssues, transactons, and ltgaton. The result? More Together faegre.com For more nformaton, please vst USA UK Chna

11 Revstng the data map perodcally (annually at a mnmum) may help mnmze the labor and potental cost of dentfyng and restorng antquated data. Handwrtten notes that may be reasonably antcpated n a dscovery request Research lab worker notebks Nurse patent records R & D workers notes electronc, voce or handwrtten Laptops, personal computers and tablets Thumb drves, CDs, thrd-party clouds Analyzng the data To analyze the data, you wll need to consder the followng: Who are the employees creatng the data? How long have they been wth the organzaton? What departments do they work n? What software do they use? Do they create data stored n a cloud? How do you access cloud data from a thrd party? Where s the data physcally located? Your offces, off shore, employees basements, other? How does data from one potental custodan relate to other potental custodans? If you are requred to produce data under a ltgaton dscovery order, would you be able to successfully do so wthn typcal dscovery tme constrants? The followng scenaro llustrates the mportance of ths step: The legal department or IT department has a document retenton (destructon) polcy that lmts each employee s data storage space on the server. The wellntentoned employee stores proprety data on a laptop or PC to comply wth the server space lmt, and backsup the data to a thumb drve to work at home, perhaps over a weekend. The employee downloads company nformaton, and stores t on a home PC wth the famly personal nformaton and socal meda data. In ths stuaton, data mappng and custodan data collecton may have become more challengng and costly. Back-up tapes An analyss and understandng of the back-up tapes used by an organzaton s a rather unque subset of data mappng. Whle t s crtcal to obtan a lst of all servers and ndvdual hard drves that are backed up, who performed the back-up, and whether there was a change n the hardware or software used, t s also mportant to determne how back-ups are performed, how often they take place, where the back-up tapes are located, and whether the back-up process s a full copy or an ncremental back-up. Addtonally, the nature of back-up tapes must be apprecated. Snce tapes record data based on chronology and not the fle type or content, determnng what s on the tape s not self-evdent. The older the back-up tape, the more lkely the software verson or operatng platform orgnally used when the tape was created s not readly avalable. It s not unusual for a large establshed organzaton to have 10,000+ tapes datng back 15 or more years. If you have back-up tapes from the 1990s, do you really want to know what s on them? Are thoughts of Love Canal or Ern Brockovch comng to mnd? As back-up tapes are used, a corporaton should determne f back-up tapes should be restored based on the rsk of dscoverng a possble lablty. However, f the data on the back-up tape s NOT subject to a ltgaton hold, or there s not a duty to dsclose the nformaton on the tape, they may be destroyed or recycled n accordance to your current document retenton/destructon polcy. The other opton s to do nothng wth the backup tapes unless a court orders ther restoraton, whch may never occur. Wrtng the data mappng document major sectons Once the data has been mapped, n-house counsel wll want to facltate the wrtng of a formal data map, whch should be updated from tme to tme. The followng s a sample table of contents for a data map: Executve summary Master nventory Ter I Granular level Where can employees save emal or other data (word documents, other fle types)? Server, smart phone, PC, laptop, flash/thumb drve Where s the data stored after t s created? Is your current emal destructon polcy enforced? ACC Docket 100 May 2011

12 Repr nt edw t hper m ss onoft heaut hor sandt heassoc at onofcor por at e Counsel as tor g nal l yappear ed:danar.baughnsandjohnhor oschak, CanYourRecor dsmanagementpr ogr amshandl eed scover y?, ACC Docketvol umenumber,may01 1:Pages90101.Copyr ght 201 1,t he Assoc at onofcor por at ecounsel. Al l r ght sr eser ved.i fyouar e nt er est ed nj o n ngacc,pl easegot o: www. acc. com,cal l x360,orema lmember sh p@acc. com.