If you were sued tomorrow, would you have an electronic data retention plan?
May 20, 2015
By Kristin Cifolelli, courtesy of SBAM Approved Partner ASE
An immeasurable amount of electronic data flows through an organization every day. It is transmitted through email and instant messages, through social media, and the internet. Some of the typical places it gets stored include hard drives, shared drives, the cloud, SharePoint, mobile devices, and backup tape drives just to name some examples. As technology continues to evolve and expand, so does the amount of electronic data, as well as the various ways and types of devices that can transmit, store and delete it.
Many HR people think that electronic data retention policies are an IT issue. But when the threat of litigation arises, most likely potential evidence is going to be found in the organization’s vast amount of stored electronic data. In order to effectively respond to pending litigation, HR has to know ahead of time what, where and for how long their electronic information is stored. Therefore it is critical for HR to work hand-in-hand with IT to develop an electronic data retention policy.
When organizations face litigation or reasonably anticipate facing it, they have a duty to preserve all potentially related evidence including information stored electronically. The Federal Rules of Civil Procedure, amended in 2006, govern how information is exchanged with opponents in a lawsuit. They now include preservation requirements for electronic data, and they change the way the discovery rules are applied to electronically stored information (“ESI”) when it comes to investigations and lawsuits (e-discovery).
In response to potential or actual litigation, employers must issue a “litigation hold,” whereby all of the normal document destruction processes are suspended and procedures are put into place to preserve the relevant evidence. This involves issuing a written notice to key employees forbidding them from deleting or modifying related evidence. HR should meet with these individuals to discuss the parameters of the litigation hold to ensure they understand its importance. All the key evidence should be gathered using technical experts if necessary.
For organizations that need to develop an electronic data retention strategy, best practice is to be pro-active and to have a plan in place before there is a need to locate and preserve data. This will save organizations a significant amount of time, stress, and money and lower the burden around data management. In terms of where to get started, the following steps will help build a strong foundation:
- Establish an information governance strategy – Organizations should begin by forming a team made up of key stakeholders charged with developing a strategy for electronic data retention and preservation. The team should make determinations around what data must be kept, for how long, where it will be stored and what can be deleted, and ensuring it ties with any legal record-keeping obligations. The team should include members of IT, HR, operations, and other departments that are heavy users of data or social media (such as marketing). The strategy should be reviewed by outside legal counsel to ensure compliance with e-discovery and other record keeping requirements, and ultimately approved by management. Many organizations take the “save everything” approach, but as the volume of data continues to expand they will have to take a more selective approach.
- Document and implement your electronic record retention policy – Once the data retention strategy is in place, the next step is to get a better understanding of how data moves through the organization. Data mapping is a process of documenting how data is received, where it is retained, how it is being retained and/or replicated, and how it is being destroyed. Based on the mapping process, a well-documented records retention policy should be developed and implemented throughout the organization. If litigation arises and key records have been destroyed, the policy will support the action. Conversely, if presented with a litigation hold, having a policy in place ahead of time will to simplify the process to prevent any routine data destruction and preserve the needed information.
- Educate employees about data responsibilities – Lastly, employees should be educated around the importance of following the organization’s record retention policy. Managers should receive training around how to respond to a litigation hold since they are often identified in a lawsuit.
Developing and implementing the retention policy is only half the battle. New devices, technology, social networking applications and forms of electronic communication are constantly being developed and introduced into the work environment. The electronic data retention team should meet regularly, to analyze any new technology to determine the impact on the organization and to modify the data retention processes and policy as necessary.
The key lesson for HR is not to wait for a lawsuit to happen but to put a plan in place proactively with processes that are consistent, repeatable, and defensible.