Synchronizing Legal Hold Requirements With Consumer Requests for Data Deletion

Because many legal departments may still be siloed in their processes across sections (privacy, litigation, business, etc.), the following four steps can help e-discovery/litigation professionals ensure processes around preserving data are defensible.

1. Step #1: Automate legal hold notifications. Automated systems track who has acknowledged the hold and escalates the notice to a non-compliant custodian's manager without intervention from the hold administrator. That system also tracks which custodians have been interviewed and has an interactive method for asking interview questions so administrators can identify both other candidate custodians and the location of corresponding responsive ESI. With this automation, streamlined actions can be taken to ensure the defensible preservation of custodian data via data collection.
2. Step #2: Maintain an up-to-date Data Map/Inventory. It's more important than ever that Legal has a universal source to evaluate data retention policies, legal hold obligations and data privacy requirements all in one place. Data maps can not only help find requested data quickly but can also offer up a comprehensive overview of any retention obligations (data privacy, data retention, litigation) specific data may have on it, therefore preventing inadvertent deletion or preservation of data.
3. Step #3: Minimize irrelevant ESI. After it's been verified that the data is no longer under a legal hold and doesn't serve a relevant business purpose, it's time to delete it. If there's a serious concern that the data might be relevant later, either don't delete it or review the data that is "quarantined" prior to full deletion. This step is important since the data that may have been requested to be deleted based on a consumer request must now be subsequently deleted after the matter is closed.
4. Step #4: Document the process. Documentation is arguably the most important part of the process because if there's no proof of the process, it's nearly impossible to prove why an individual did or did not do something. Courts look for a reasonable process, rather than a perfect one, and documentation goes a long way to demonstrating reasonableness when complying with these numerous obligations certain data may be under.

Unfortunately, defensibly managing data in accordance with all these legal requirements is only going to get more complex. Numerous states are crafting their own data privacy legislation — many with the same consumer rights features as the CCPA or GDPR. It's imperative that e-discovery/litigation professionals have a plan in place to ensure that data on legal hold is not inadvertently deleted because of other data privacy regulation obligations.

*****

Mike Hamilton is the Director of Marketing at Exterro. With a legal and business background, Mike is experienced and passionate about creating thoughtful, out-of-the-box educational resources that help keep legal teams interested and on top of emerging need to know e-discovery issues.