Managing Legal Holds

The duty to preserve ESI has been complicated by the precipitous growth, complexity and evolving nature of digital information. ESI is inherently ephemeral, dispersed, easily duplicated and increasingly voluminous. According to analyst firm International Data Corporation (IDC), the digital universe is expected to double every two years between now and 2020. The impact of this data explosion is profound as relatively minor matters can involve terabytes of ESI from scores of potential custodians and data sources, such as personal computers, shared databases, cloud servers and mobile devices. Failing to preserve relevant ESI can carry significant legal consequences, such as monetary penalties, adverse inference instructions, preclusion of evidence, and, in extreme cases, default judgments or case dismissals.

Legal Hold Case Law

The use of legal holds as a means to fulfill preservation obligations gained widespread acceptance after Judge Shira A. Scheindlin's landmark opinions in Zubulake v. UBS Warburg LLC (2003-2004). The court established three foundational legal hold requirements that have been largely embraced at both the federal and state level: 1) Triggering Event: Issuing a litigation hold at the outset of the litigation or when litigation is reasonably anticipated; 2) Communication: Sending out legal hold notices directly and periodically to key players, informing them of their preservation duty; and 3) Confirmation: Reiterating the litigation hold instructions regularly and monitoring compliance.

Though it has been nearly a decade since Judge Scheindlin's landmark opinions in Zubulake, recent case law indicates organizations are still struggling to meet even the most basic and well-established of legal requirements: Scentsy Inc. v. B.R. Chase LLC (D. Idaho Oct. 2, 2012) (sanctions issued based on delayed legal hold issuance, verbal-only hold instructions to some custodians, and failure to suspend e-mail destruction schedule); United States ex rel. Baker v. Cmty. Health Sys., Inc. (D.N.M. Oct. 3, 2012) (sanctions issued to plaintiff stemming from failure to issue a timely legal hold, identify relevant custodians, and adequately monitor the hold process); and Regas Christou v. Beatport, LLC (D. Colo. Jan. 23, 2013) (spoliation sanctions issued to defendant based on failure to preserve cell phone text messages).

Legal Hold Defensibility

Effective legal hold management is not just rooted in policy; it's also very dependent on process. Some organizations believe that by simply setting forth broad time frames and general best practices, adverse consequences can be avoided. It has become increasingly apparent that in today's climate, organizations must have a narrowly tailored and well-documented legal hold process that specifies, in detail, the protocols for notification, follow-up, and tracking to withstand judicial scrutiny.

Beyond the more routine components of legal hold management, organizations must be cognizant of situational nuances that warrant more scrupulous legal hold measures.

1. Overlapping or “Cascading” Legal Holds. Large corporations often face hundreds, if not thousands, of active matters at a given time, with multiple legal holds attached to each matter. The overlapping, or “cascading,” legal hold dilemma presents something of a Catch-22 to corporate legal teams. Acting too hastily to release a custodian from hold without ensuring his or her data is not implicated in another matter can lead to evidence spoliation. On the other hand, taking an overly cautious approach results in the unnecessary preservation of ESI after a matter has closed and increases the risk of having it pulled into future matters.

2. Employee Transitions or Terminations. Protocols must be in place to account for custodians on hold that may leave the company or change positions during the duration of the hold. For example, most organizations waste little time before recycling a departed employee's systems. Safeguards must be put in place to prevent the deletion of the departed employee's data still subject to any active legal holds.

3. Cross-Border Compliance. International e-discovery and the need to comply with foreign data protection and privacy laws has become a significant e-discovery challenge. Generally, the United States' legal system places greater emphasis on obtaining evidence than those of other nations and has arguably the most aggressive discovery requirements of any nation in the world. The simple act of issuing a standard legal hold to a foreign-based custodian may itself violate data protection and privacy laws of another country. This risk can be mitigated by tailoring the hold to be consistent with national or multinational statutes, such as the E.U. Data Privacy Directive, as well as regional or local rules.

Legal Hold Best Practices

Following are five best practices for establishing a defensible and efficient legal hold process:

1. Establish cross-departmental communication channels. Legal holds implicate an organization's people, processes and technologies. Consequently communication channels to promote effective intersect business units across the entire organization, including legal, IT, records management, human resources and compliance. It is important that legal hold requirements are communicated early and often to the business units and that each understands its specific role in the process.

2. Create a data map. Legal teams need a way to quickly identify which systems or repositories contain relevant information, be alerted to changes in those systems, and ensure that proactive steps are taken to avoid destruction of the data within them. A data map serves as a shared inventory of what ESI is stored, where and what obligations apply by information and asset. An effective data map is much more than just a list of systems across an organization ' it clearly communicates associated retention schedules for each system, how information within each system is used by various business units, how systems relate to one another, and what types of data are generated within each system. This allows legal teams to immediately determine where relevant ESI is stored and how it's managed, and communicate that information to IT to ensure the ESI is properly preserved.

3. Leverage custodian interviews. Legal teams are expected to conduct a reasonable investigation and evaluation of the relevant facts and circumstances surrounding that matter to precisely scope the legal hold. One of the ways attorneys can rapidly turn up necessary information for legal hold scoping is by interviewing key custodians. Custodian interviews help to uncover all individuals inside or outside the company who might possess relevant documents. They also help identify sources of potentially relevant ESI. It is most effective to present custodians with a list of potential data sources where responsive ESI might reside, such as e-mail, portable media, social media sites, text messages, etc. Information gleaned can be incorporated into future legal hold notices and reminders, so that all custodians are aware of what specific data sources to be mindful of when fulfilling their preservation obligations.

4. Automate the legal hold notification, reminder and escalation process. A defensible legal hold process represents a series of activities from triggering event to final legal hold release, a lifecycle consisting of several overlapping tasks. Relying on manual, ad hoc processes for managing each of these steps during the course of one matter is taxing enough; performing these tasks across dozens or even hundreds of simultaneous matters is nearly impossible. Automating the legal hold process has become less of a matter of efficiency than an act of necessity. Advancing legal hold technology can increase efficiency by minimizing manual work and eliminates the need to move between various spreadsheets and systems to execute and oversee the process.

5. Document the legal hold process. Organizations must be able demonstrate to the court what processes were implemented during the legal hold process. Were they done in a reasonable, good faith manner, even if evidence was lost? Leveraging technology to document the mechanics of the process (the who, what, when, where and why of various tasks) will help ensure that all actions, such as issuance of the hold, reminder e-mails and custodian survey results, were recorded in compliance with judicial expectations.

Conclusion

By following the five best practices outlined in this article, in-house legal teams will put themselves into a much more defensible position for demonstrating that that appropriate steps were taken when the obligation to preserve all potentially relevant ESI was triggered.

Scott Giordano is an attorney with more than 16 years of legal, technology and risk management consulting experience. He serves as Exterro's subject matter expert on the intersection of law and technology as it applies to e-discovery, information governance, compliance and risk management issues.

Organizations have a common law duty to preserve all potentially relevant electronically stored information (ESI) when litigation becomes reasonably foreseeable. While defensible ESI preservation is one of the most critical phases of e-discovery, many legal professionals cringe when they hear the term “legal hold” since the management (and enforcement) process is often perceived as a necessary evil fraught with inefficiency and frustration.

This is not a new issue, but with so much recent news and attention being focused on the latter stages e-discovery, the importance of putting in place a defensible, scalable legal hold process has been somewhat overshadowed. The reality is that many in-house legal teams remain limited by reactive legal hold approaches that feature e-mail and spreadsheets as management tools and are defined by an over reliance on manual processes. What's more, preservation-related failures account for the highest percentage of sanctions that are issued.

The Evolving Nature of Preservation Requirements

The duty to preserve ESI has been complicated by the precipitous growth, complexity and evolving nature of digital information. ESI is inherently ephemeral, dispersed, easily duplicated and increasingly voluminous. According to analyst firm International Data Corporation (IDC), the digital universe is expected to double every two years between now and 2020. The impact of this data explosion is profound as relatively minor matters can involve terabytes of ESI from scores of potential custodians and data sources, such as personal computers, shared databases, cloud servers and mobile devices. Failing to preserve relevant ESI can carry significant legal consequences, such as monetary penalties, adverse inference instructions, preclusion of evidence, and, in extreme cases, default judgments or case dismissals.

Legal Hold Case Law

The use of legal holds as a means to fulfill preservation obligations gained widespread acceptance after Judge Shira A. Scheindlin's landmark opinions in Zubulake v. UBS Warburg LLC (2003-2004). The court established three foundational legal hold requirements that have been largely embraced at both the federal and state level: 1) Triggering Event: Issuing a litigation hold at the outset of the litigation or when litigation is reasonably anticipated; 2) Communication: Sending out legal hold notices directly and periodically to key players, informing them of their preservation duty; and 3) Confirmation: Reiterating the litigation hold instructions regularly and monitoring compliance.

Though it has been nearly a decade since Judge Scheindlin's landmark opinions in Zubulake, recent case law indicates organizations are still struggling to meet even the most basic and well-established of legal requirements: Scentsy Inc. v. B.R. Chase LLC (D. Idaho Oct. 2, 2012) (sanctions issued based on delayed legal hold issuance, verbal-only hold instructions to some custodians, and failure to suspend e-mail destruction schedule); United States ex rel. Baker v. Cmty. Health Sys., Inc. (D.N.M. Oct. 3, 2012) (sanctions issued to plaintiff stemming from failure to issue a timely legal hold, identify relevant custodians, and adequately monitor the hold process); and Regas Christou v. Beatport, LLC (D. Colo. Jan. 23, 2013) (spoliation sanctions issued to defendant based on failure to preserve cell phone text messages).

Legal Hold Defensibility

Effective legal hold management is not just rooted in policy; it's also very dependent on process. Some organizations believe that by simply setting forth broad time frames and general best practices, adverse consequences can be avoided. It has become increasingly apparent that in today's climate, organizations must have a narrowly tailored and well-documented legal hold process that specifies, in detail, the protocols for notification, follow-up, and tracking to withstand judicial scrutiny.

Beyond the more routine components of legal hold management, organizations must be cognizant of situational nuances that warrant more scrupulous legal hold measures.

1. Overlapping or “Cascading” Legal Holds. Large corporations often face hundreds, if not thousands, of active matters at a given time, with multiple legal holds attached to each matter. The overlapping, or “cascading,” legal hold dilemma presents something of a Catch-22 to corporate legal teams. Acting too hastily to release a custodian from hold without ensuring his or her data is not implicated in another matter can lead to evidence spoliation. On the other hand, taking an overly cautious approach results in the unnecessary preservation of ESI after a matter has closed and increases the risk of having it pulled into future matters.

2. Employee Transitions or Terminations. Protocols must be in place to account for custodians on hold that may leave the company or change positions during the duration of the hold. For example, most organizations waste little time before recycling a departed employee's systems. Safeguards must be put in place to prevent the deletion of the departed employee's data still subject to any active legal holds.

3. Cross-Border Compliance. International e-discovery and the need to comply with foreign data protection and privacy laws has become a significant e-discovery challenge. Generally, the United States' legal system places greater emphasis on obtaining evidence than those of other nations and has arguably the most aggressive discovery requirements of any nation in the world. The simple act of issuing a standard legal hold to a foreign-based custodian may itself violate data protection and privacy laws of another country. This risk can be mitigated by tailoring the hold to be consistent with national or multinational statutes, such as the E.U. Data Privacy Directive, as well as regional or local rules.

Legal Hold Best Practices

Following are five best practices for establishing a defensible and efficient legal hold process:

1. Establish cross-departmental communication channels. Legal holds implicate an organization's people, processes and technologies. Consequently communication channels to promote effective intersect business units across the entire organization, including legal, IT, records management, human resources and compliance. It is important that legal hold requirements are communicated early and often to the business units and that each understands its specific role in the process.

2. Create a data map. Legal teams need a way to quickly identify which systems or repositories contain relevant information, be alerted to changes in those systems, and ensure that proactive steps are taken to avoid destruction of the data within them. A data map serves as a shared inventory of what ESI is stored, where and what obligations apply by information and asset. An effective data map is much more than just a list of systems across an organization ' it clearly communicates associated retention schedules for each system, how information within each system is used by various business units, how systems relate to one another, and what types of data are generated within each system. This allows legal teams to immediately determine where relevant ESI is stored and how it's managed, and communicate that information to IT to ensure the ESI is properly preserved.

3. Leverage custodian interviews. Legal teams are expected to conduct a reasonable investigation and evaluation of the relevant facts and circumstances surrounding that matter to precisely scope the legal hold. One of the ways attorneys can rapidly turn up necessary information for legal hold scoping is by interviewing key custodians. Custodian interviews help to uncover all individuals inside or outside the company who might possess relevant documents. They also help identify sources of potentially relevant ESI. It is most effective to present custodians with a list of potential data sources where responsive ESI might reside, such as e-mail, portable media, social media sites, text messages, etc. Information gleaned can be incorporated into future legal hold notices and reminders, so that all custodians are aware of what specific data sources to be mindful of when fulfilling their preservation obligations.

4. Automate the legal hold notification, reminder and escalation process. A defensible legal hold process represents a series of activities from triggering event to final legal hold release, a lifecycle consisting of several overlapping tasks. Relying on manual, ad hoc processes for managing each of these steps during the course of one matter is taxing enough; performing these tasks across dozens or even hundreds of simultaneous matters is nearly impossible. Automating the legal hold process has become less of a matter of efficiency than an act of necessity. Advancing legal hold technology can increase efficiency by minimizing manual work and eliminates the need to move between various spreadsheets and systems to execute and oversee the process.

5. Document the legal hold process. Organizations must be able demonstrate to the court what processes were implemented during the legal hold process. Were they done in a reasonable, good faith manner, even if evidence was lost? Leveraging technology to document the mechanics of the process (the who, what, when, where and why of various tasks) will help ensure that all actions, such as issuance of the hold, reminder e-mails and custodian survey results, were recorded in compliance with judicial expectations.

Conclusion

By following the five best practices outlined in this article, in-house legal teams will put themselves into a much more defensible position for demonstrating that that appropriate steps were taken when the obligation to preserve all potentially relevant ESI was triggered.

Scott Giordano is an attorney with more than 16 years of legal, technology and risk management consulting experience. He serves as Exterro's subject matter expert on the intersection of law and technology as it applies to e-discovery, information governance, compliance and risk management issues.