The Problem—The Information Explosion Meets Electronic Discovery
The explosion in the amount of electronic business records, now nearly 20 trillion documents a year, is a byproduct of technology-driven gains in productivity. Unfortunately, the way these proliferating records are often mishandled is a disaster waiting to happen. E-mail is now the majority of evidence in litigation, but a recent survey of corporate counsel showed that 59% of surveyed companies lack e-mail retention policies and 62% doubt their electronic records are accurate and reliable. Courts are setting high standards for the retention and production of electronic records in litigation, and imposing crippling sanctions for failures to meet them. Last years $1.45 billion verdict against financial giant Morgan Stanley, a result of its inability to preserve and produce e-mails and its efforts to conceal those shortcomings, is only one example.
The possibility of punishment is just one downside to not having a comprehensive records retention plan well in advance of litigation. Even if a business is lucky enough to avoid sanctions, the expense of electronic discovery when records are too voluminous or in disarray can be so prohibitive that it becomes pivotal in determining whether to litigate at all.
Litigation is not the only reason businesses need better control over recordkeeping. Knowledge of and control over business records is essential for companies subject to regulatory records retention requirements, including SEC and IRS rules and the Sarbanes-Oxley Act. It also happens to increase efficiency and reduce costs.
The Solution—Practical Pre-Litigation Records Retention Planning
To help avoid sanctions, reduce electronic discovery expenses and get recordkeeping under control, more businesses are not waiting for litigation to deal with electronic discovery. They are formulating and putting into place records retention plans well prior to even the threat of litigation. This new proactive approach acknowledges three simple but immutable facts:
- Litigation is inevitable
- It will involve electronic discovery
- Compliance will be mandatory
Records retention planning for litigation not yet on the horizon may seem to be a project without goals or limits. The key to success is designing and following through on a flexible and realistic plan that takes into account legal requirements and the needs of the business.
Step 1—Assemble a Team
Begin by identifying the people who will be responsible for designing the records retention plan and who are responsible for the records covered by it. The size and makeup of the team will depend on the size and diversity of the business. Any business unit that generates a significant amount of electronic or hard copy records should be considered for representation, especially those likely to be involved in litigation, including legal, finance and accounting, sales and marketing, human resources, executives and managers and, of course, information technology. Overall responsibility for the plan should be assigned to legal officers.
Outside counsel knowledgeable about electronic discovery and records retention requirements can help identify appropriate team members and formulate the plan. An outside technical consultant should also be considered, particularly if IT personnel are relatively unsophisticated in recordkeeping regulations or electronic discovery duties. For example, recent decisions have required production of metadata associated with electronic files. Moving or copying such files without following accepted procedures to ensure integrity and a proper document trail can result in prohibited modifications. A consultant may also help to identify technical flaws in how a records retention plan is being implemented, such as user or system profiles that allow overwriting of e-mails the business intends to retain.
Step 2—Create a Schedule
As with most projects, a records retention plan without an implementation schedule is just that—a plan. The team should prescribe a firm and realistic schedule for meeting each of the milestones in their plan. The schedule should give sufficient time for implementation, evaluation of results and any adjustments that need to be made, but should be short enough to convey the importance of the project. Litigation will not wait. As the project progresses, the team should consider periodic e-mail schedule reminders that note upcoming milestones.
Step 3—Assess What You Have
Next, the team members should catalog the records created and maintained by the business, by business unit if appropriate, and the various types of electronic media on which they are maintained, including servers, desktop and notebook computers, portable drives and PDAs. The devil here is in the details. Matters as mundane as the number, location and contents of file cabinets should be considered, to allow as comprehensive a records assessment as possible. A helpful tool is a report detailing the nature, type and location of the records being assessed.
Step 4—Determine What To Keep and Why
Once the records are catalogued, the team members need to come up with a practical rationale for determining which records to retain and for how long. This is the core of the plan. Each category of records should be analyzed in light of the goals of the business and a decision made as to whether the business needs, on an ongoing basis, to maintain those records. As the widely cited Sedona Conference Working Group on Best Practices for Electronic Document Retention and Production has noted, no single standard can meet each organizations unique needs. A helpful question to ask is whether there is a current business, legal or regulatory need or requirement for the retention of a particular category of records. If the answer is no, consideration should be given to disposing of the records, particularly if retaining them carries a substantial cost. If the answer is yes, the question becomes one of duration. Applicable regulations may spell out retention periods. Contracts and related documents may need to be analyzed in light of potentially applicable statutes of limitation. In addition, the records retention team should consider the relative benefits of a single, uniform retention period or differing, category-specific retention periods.
Step 5—Implement the Plan
With a schedule and plan in place, the next step is implementation. IT personnel should implement the plan on enterprise-wide systems such as databases and e-mail servers and follow up with ongoing compliance monitoring. The plan will also need to be implemented as to records maintained by individual business units and employees. Since this will require employee cooperation, the requirements for compliance should be distributed and reinforced, and periodic training courses on compliance should be considered. Methods of further encouraging compliance, such as employee incentives, limits on available electronic and physical space for employee or business unit and spot checks of compliance by IT and administrative personnel, should also be considered.
Step 6—Institute a Litigation Hold Procedure
Many recent cases, including the well-known Zubulake decisions, stress that businesses must suspend ordinary procedures for the disposal of records, including e-mails and backup tapes, once there is reason to believe they are relevant to potential litigation. For this reason, and because a failure to heed that warning can have disastrous consequences, a comprehensive litigation hold procedure should be part of the records retention plan. This procedure is typically the responsibility of a legal department or officer. The business should consider advising employees periodically that in the event a litigation hold notice issues, they must maintain the records identified in the notice until advised otherwise.
A form of litigation hold notice that can be modified as necessary in the event of litigation should be designed. When litigation is on the horizon, the responsible officer or department should issue the notice and send out periodic reminders of the litigation hold requirements. Compliance should also be monitored.
Step 7—Document the Plan
One lesson of the recent decisions sanctioning businesses for inadequate records retention procedures is that good faith efforts to comply with electronic discovery and recordkeeping requirements can be an important factor. For this reason, each step in the records retention planning and implementation process should be documented by the records retention team. This information may need to be submitted to a court to show that the business undertook reasonable efforts to design and put in place a plan intended to comply with legal requirements.
Step 8—Reevaluate Regularly
All businesses evolve. Employee turnover and corporate restructuring are facts of life. Accordingly, each business should periodically confirm that its business units are still appropriately represented on its records retention team, and the team should periodically reassess whether their plan remains current and effective and covers all appropriate records. If necessary, the plan should be modified to cover new operations or changes in infrastructure. Throughout, the plan should continue to be simple, straightforward and flexible. Keeping these goals in mind will make your records retention plan an effective tool for electronic discovery compliance in the future.
For more information on creating and implementing a records retention plan, contact Dan P. Sedor (310.785.3554; DSedor@jmbm.com).