Chapter 8

Know When to Hold ’em

In This Chapter

Understanding the discovery process

Issuing an information hold order

Searching for relevant information

Preserving information

Maintaining an information hold order

Lifting the hold

Information is a business asset that’s used for a variety of purposes, such as processing work functions and decision-making. However, in this chapter, I focus specifically on how information supports an organization in the event of actions such as lawsuits, audits, and governmental inquiries.

In the event of a lawsuit, audit, or inquiry, relevant information must be identified and protected during the duration of the event and, in many cases, after the event has concluded. This chapter provides you with an understanding of how to ensure that these requirements are met.

Discovering Discovery

Discovery is a legal term that refers to the pretrial phase of a lawsuit where opposing sides request information from each other in an attempt to find facts that may be relevant to the case. Over the past decade, the term discovery has become commonly referred to as eDiscovery. The same definition applies, but eDiscovery refers specifically to electronically stored information (ESI, for short) and the process of producing it from electronic repositories and applications. For the purpose of this chapter, I use the term discovery unless specifically talking about electronic discovery.

Discovery is a process that includes several phases. Some of the phases involve records and information management, while others involve interaction solely between attorneys and the court. This chapter provides you with insight into the processes, but focuses primarily on what you need to know as it pertains to records and information management.

In terms of discovery, planning is the key to effective and compliant preservation. Organizations need to know ahead of time what steps must be taken to preserve relevant documentation, instead of attempting to figure it out after the event occurs. Due to the critical nature of preservation, every company should invest in the creation of a preservation plan and ensure that its employees are appropriately trained to follow it. When creating a preservation plan, remember that regardless of the nature of a lawsuit, audit, or governmental inquiry, standard procedures are applicable to each. The following steps should be detailed in the plan:

Communication: The need to preserve relevant documentation should be communicated as soon as possible via the record hold. The record hold should clearly provide instructions to all appropriate recipients. Such instructions should include what documentation is considered to be relevant, as well as any date ranges that are applicable to the content.

Suspend the retention schedule: When an order to preserve has been issued, the retention policies for the impacted relevant documentation should immediately cease and not resume until the legal hold has been lifted. Relevant documentation shouldn’t be destroyed, deleted, or modified. The records manager should be involved in this process. If the organization uses a Records Management software application to programmatically manage record retention, the system will need to be updated to reflect holds on the impacted records. This helps ensure that the records are retained during the duration of the hold order.

Enlist the services of the IT department: The organization should provide the IT department with a list of departments or employees (custodians) who are (or potentially are) the owners of relevant documentation. This allows the IT department to identify applications and repositories that the custodians use and ensure that electronically stored information is not deleted.

Preservation coordinator: Organizations should determine whether a preservation coordinator should be assigned to oversee the protection of relevant documentation.

When an organization receives legal notice indicating that it is party to a lawsuit, or anticipates that it could happen, the wheels of discovery go into motion. Discovery happens prior to a trial and usually includes the following steps:

Disclosure: This step involves each party to the lawsuit providing a comprehensive list of information that he or she feels is relevant to the matter. This may include a list of witnesses and documents.

Interrogatory: An interrogatory is a formal set of written questions that a witness or party to the lawsuit is required to answer under oath.

Admissions of fact: This step involves a written list of facts directed to the other party. The party receiving the list of facts is asked to admit to or deny each item.

Request for production: This is a process where opposing sides request information that they believe may be relevant to the lawsuit.

Deposition: A deposition is the process of gathering sworn testimony from witnesses or parties involved in the lawsuit.

Initiating a Legal Hold

When an organization receives a “request for production,” the organization’s Legal department issues a legal hold. A legal hold is a process a company uses to ensure that relevant or potentially relevant information is preserved and retained in the event of a lawsuit or in anticipation of a lawsuit. Some organizations use different terms to refer to a legal hold, such as information hold order and record hold.

The components of a legal hold

As mentioned previously, a legal hold is normally initiated and communicated by the organization’s Legal department. Typically, it includes the following components:

Recipients: This section lists all recipients who are to receive the hold notice. Each recipient has been identified as a custodian of relevant (or potentially relevant) information.

Date: This is the official date of the legal hold order notification.

Matter: This portion of the notice lists the formal name of the lawsuit or event that is causing the hold order.

Relevant documentation: This section lists all records and information (paper and electronic) that are currently deemed relevant or potentially relevant to the matter. It includes, but isn’t limited to, documents, spreadsheets, e-mails, notes, drafts, voice mails, and audio files. The legal hold may also provide specific time frames — all e-mails received or created between January 1, 2008, through December 31, 2010, for example.

Preservation instructions: This section of the legal hold provides instructions to the recipients spelling out that they should cease, until further notice, all destruction or deletion of information listed in the Relevant Documentation section of the legal hold. The hold order instructs recipients not to alter or modify relevant information and to ensure that it’s retained in its native format. Preserving information in its native format helps to ensure that all original metadata (data about data) is retained. In addition, the legal hold may also communicate to recipients the possible disciplinary action for failing to comply with the order.

Confirmation of receipt and hold: Most legal hold notifications require recipients to acknowledge receipt of the order and indicate that they are preserving relevant information in their possession.

Although the hold notice applies specifically to a lawsuit, the same concept and approach can be used to communicate holds related to nonlawsuit matters such as a federal tax audit or a regulatory inquiry. In these cases, the Tax or Compliance department rather than the Legal department normally issues the hold order.

Organizations should educate and train their employees on the legal hold process. The effectiveness of a legal hold is dependent upon how well employees understand and comply with the order. In addition to understanding the hold process, employees need to understand that properly managing the organization’s records and information creates the foundation for an efficient and compliant record hold. Applying records and information management principles ensures that content needed for a lawsuit can be quickly identified, retrieved, and protected.

A legal hold supersedes the organization’s retention schedule. This means that when the information related to the hold has been identified and communicated to the recipients, it’s critical that the information not be destroyed. Even if the retention period for some of or all the information has expired, the information still must be retained. Failure to do so can lead to significant fines and penalties.

When relevant documentation has been identified and located, it is made accessible to the Legal department for review and analysis. In some cases, the information is quarantined or segregated so that it cannot be destroyed or altered. This ensures that the information is appropriately preserved in case it has to be produced for the lawsuit.

In many cases, the information that an organization must hold, preserve, and produce for a lawsuit is comprised of a significant volume of records and nonrecord content that wasn’t destroyed in accordance with the organization’s records and information retention schedule. An effective records and information management program helps ensure that you appropriately retain information and destroy it on a scheduled basis in the normal course of business.

Organizing the search party

During the discovery and legal hold process, Legal departments and attorneys typically work closely with the records manager or with departmental employees who have responsibility for managing records. Records managers and their staff are knowledgeable of the organization’s records. They know which departments are the custodians of the records, where the records are located, and whether the records still exist or have been destroyed. When a legal hold is received, the records manager and all departmental employees who have been identified as potentially being in possession of relevant information should review the nature of the hold and begin the process of searching for the information.

Before starting your record hold information search, remember these things:

Format: Relevant documentation may include information in paper or electronic formats, or both. In addition, electronic information can encompass structured and unstructured data.

Category: The relevant documentation section of a legal hold may list specific company records that are listed in the organization’s record retention schedule. However, in some cases, the communication may include broader categories such as “All information related to employee training.” In this case, relevant documentation may be comprised of official records and nonrecord information. As a reminder, nonrecord information consists of content that is not considered an official company record or listed on the organization’s record retention schedule, but may have business value, such as a spreadsheet or a report.

Location: In the event of a legal hold, all relevant information needs to be located, placed on hold, and preserved. This includes information stored within the organization’s facility as well as any information stored at offsite storage and cloud vendors. (For more on the new wrinkle that is cloud computing, check out Chapter 16.)

Repositories: The records manager should become familiar with the different information repositories used by the organization. This may include file cabinets, document and content management systems, e-mail servers, and shared network drives. For small- to medium-sized businesses, this may be a task the records manager can commit to memory. However, in large organizations, it’s recommended that a data map be created. (Data mapping gets its own coverage in Chapter 16. For now, just know that the purpose of a data map is to list all the repositories of data used by an organization, including application and server names, nature of the data, business purpose, and who owns the application. A data map can be very helpful in locating information during discovery.)

New information: A legal hold will list historical information needed for a lawsuit. However, sometimes it will require that all new content that is generated or received that meets the criteria of the legal hold also be preserved.

If the legal hold requires that specific company records be placed on hold and preserved, the records manager should use the company’s retention schedule to help assist in locating the records. A departmental retention schedule lists all records by department, which can expedite the search process.

Searching in the dark

This section isn’t meant to depress you, but rather to detail common issues that most organizations encounter when conducting discovery searches. Searching for relevant documentation is the most problematic phase of discovery — especially eDiscovery. While the legal hold may clearly communicate the type of information that needs to be located, placed on hold, and preserved, in many cases, the information is difficult to find. If your organization doesn’t use a Records or Content Management software system to manage its information, the search process may be very time consuming and result in not finding content that’s needed.

It’s important for the Compliance, Legal, Records Management, and Risk Management departments to understand what searching challenges the company faces. For example, paper records are routinely removed from file cabinets, placed into boxes, and sent to storage, where they accumulate over time. Some boxes may be labeled in a manner that allows you to quickly and accurately determine the contents, while many boxes may be poorly labeled and must be opened and physically reviewed for relevance. Some departments may maintain a spreadsheet of boxes that they have sent to storage, which can be valuable when attempting to find information; other departments may not keep any storage documentation. (Chapter 11 provides an example of a spreadsheet that can be used in lieu of Records and Content Management software for tracking records sent to storage, as well as insight into how to utilize a storage vendor’s website for this purpose.)

The following approaches can be used for locating paper records:

Record retention schedule: If your organization uses a departmental retention schedule, each department’s records are listed individually. This allows you to quickly identify which departments may have relevant documentation. (Functional and Big Bucket retention schedules don’t provide the same level of detail, but they can provide a starting point for your search.)

Record storage spreadsheets: Departments may keep a spreadsheet or other documentation that lists the boxes of records and their contents that they have sent to storage. The listing can be reviewed to determine whether any information relevant to the lawsuit is in storage.

Record storage vendor website: Many record storage vendors provide their customers with a website that the customers can use to monitor their inventory. The website allows customers to view box storage details such as bar-code number, contents, department, record-classification code, and content date ranges. However, the adage “garbage in, garbage out” applies in this case. If the department didn’t provide box detail information (or provided inadequate information) to the vendor, the website may not be of much use.

Searching for electronic information poses the greatest organizational challenge. This is based on the large amount of electronic content that organizations retain, the numerous repositories used, the lack of filing structure, and the absence of standard file-naming conventions. These issues significantly increase the chances that information required for a lawsuit will never be located. The challenges of searching for electronic information are so great that companies have been created whose sole purpose is to assist organizations with eDiscovery. Such eDiscovery companies use a variety of logic and algorithms to search through repositories of information looking for certain words, phrases, dates, and probabilities.

E-mail — the smoking gun

While searching for electronic content on hard drives and shared network drives is a challenge, in many organizations, it pales in comparison to the challenges of searching and producing e-mails. For some companies, e-mail is the single largest source of information. Employees tend to archive e-mails rather than delete them. When employees reach their e-mail space quota, they save e-mails to a variety of storage devices, such as local and network drives and removable media. In addition, the e-mail application servers are regularly backed up and archived to tape by the IT department. In most organizations, backup and archive tapes contain mountains of e-mails that may have to be reviewed during the discovery process. Organizations spend millions of dollars annually reviewing e-mails for lawsuits.

To compound the discovery issue, e-mail has become the number-one electronic information focus of attorneys. E-mail is considered a “smoking gun.” It has proved to be detrimental in many lawsuits. E-mail is used by many employees, at all levels of an organization, as an informal communication tool. There have been numerous instances of employees communicating a personal opinion or corporate position on a matter, never thinking that the communication may be retrieved and entered into evidence in a lawsuit. Attorneys have become very knowledgeable and savvy of how companies use e-mail and how to use it against them.

Keying in on keywords

Now that you’re schooled on the nature of the search challenges you’ll be facing, it’s time to talk about what you can do to find the information you need. In the absence of eDiscovery and Records, Document, and Content Management software to assist you, your options are limited. However, you do have some tools at your disposal.

To assist you in locating electronic information, it’s recommended that you perform keyword searches. A keyword search allows you to look for a specific word in a folder or filename, as well as in the text of a document or spreadsheet. Keyword searches can be used to find information on hard drives, shared network drives, and removable media. Keyword searching is a function of your computer operating system; no additional software is needed.

A record hold notice contains many potential keywords that can be used when searching for electronic information:

Parties named in the lawsuit

Dates

Subject matter

Following is an example of how you conduct a keyword search on a computer hard drive for the term asbestos in Windows:

1. Click the Start button, located in the lower-left corner of the Windows screen.

The Start menu opens, as shown in Figure 8-1.

2. Type the keyword (asbestos) in the Search Programs and Files field.

This searches the computer’s local hard drive for any files or documents containing the word asbestos.

3. Press Enter.

Your search results are displayed. See Figure 8-2.

Searching made simple

If your company uses a Records, Document, or Content Management software system, congratulations — searching may be a lot easier. These types of software applications provide many benefits that are covered in detail in Chapter 10, but two major benefits are worth mentioning now, just because such benefits are especially suited for helping assist organizations during discovery:

Single repository: Applications such as Content Management systems can provide a single repository where all (or the majority) of an organization’s information can reside. This significantly reduces the number of repositories that have to be searched during discovery.

Metadata: Records, Document, and Content Management systems allow users to assign metadata (information about information) to your information. For example, if you are saving an employee file to the system, you can apply metadata such as employee ID, name, hire date, division, department, and title. Subsequently, you can conduct searches on each attribute or a combination of the metadata attributes. This can significantly reduce the time spent looking for the information you need.

Preserving what you find

The game isn’t over yet — after you find what you’re looking for, it needs to be preserved. Preservation is a critical step in the discovery process. Preservation means keeping the relevant documentation valid and intact. After relevant documentation has been identified and located, it must not be destroyed, deleted, or altered. Preserved information should remain in its native format, such as paper, word processing document, and spreadsheet. The failure to preserve information relevant to an active or pending lawsuit can result in significant fines and penalties.

Maintaining the legal hold

After the legal hold is initially communicated, the issuing department should send all recipients periodic reminders letting them know that the hold is still in place. This approach allows the initiating department to communicate any changes in the scope of the legal hold, including documentation that is no longer considered relevant or additional documentation that must now be preserved.

Periodic legal hold reminders can be distributed by reissuing the original hold notice or through e-mail or an e-mail attachment, a posting on the company’s intranet, pop-up messages, or voice mail. The initiating department should document all periodic reminders to provide proof that the organization executed the proper due diligence to ensure that employees continued to preserve relevant documentation.

We have liftoff

A legal hold is usually lifted after the lawsuit has concluded or when a lawsuit is no longer anticipated. The steps in lifting a legal hold are similar to initiating one. The Legal department will distribute a legal hold rescission notice. This is a formal communication alerting all recipients that the hold is no longer in effect. Legal, audit, and regulatory compliance holds can be in effect for months or years, resulting in the mandatory retention of records and information that may have otherwise have been eligible for destruction. After the hold is lifted, it’s time to take a look at the information that was impacted.

After a hold is lifted, it’s recommended that you take some time to review the information that has been on hold to determine its status. To determine the status of the information, follow these steps:

1. System update: If your organization uses a Records Management software application or vendor website to manage your content, you should ensure that the hold is removed in the system so that programmatic retention monitoring of the records can resume.

2. Evaluation: All content impacted by the hold should be evaluated to determine whether it should be destroyed or deleted. Departmental record custodians, IT, and the Records Management department should conduct the evaluation.

3. Destruction: Based on the evaluation, you should ensure that all impacted content that is eligible to be destroyed is disposed of appropriately.

Content can be placed on multiple holds. This means that multiple lawsuits, audits, or governmental inquiries can impact the same record. In large organizations, it’s common for attorneys to handle specific types of legal matters. For example, one group of attorneys may be responsible for human resources matters, while another group of attorneys may handle issues related to regulatory compliance. The potential exists for each group to be unaware that records they placed on hold may be on a hold for an additional lawsuit, audit, or governmental inquiry. Therefore, when evaluating whether information can be destroyed after a hold is lifted, it’s critical to verify that no other holds apply to the content.