Deeper Dive: Preserving Ephemeral Messaging — Capture Data Before Its Ghosts Haunt Your Compliance

Organizations whose mantra is "We just never delete anything" (i.e., organizations simply retaining all information indefinitely) are now facing headwinds, especially when the information contains personal information. As our 2024 DSIR Report makes evident, data incidents continue to plague businesses in all sectors of the economy, exposing information of no business value but with real business risk. Likewise, maintaining information containing sensitive personal information may require disclosures under the California Consumer Privacy Act. That said, indiscriminate deletion is not acceptable either, in part because of the risk of prematurely deleting information relevant to litigation or government investigations. This article considers how an organization might consider handling information generally, through the lens of a specifically troubling subset of information: ephemeral messages.

Federal Regulators Reemphasize Significance of Ephemeral Messaging

Although the way we communicate continues to change rapidly, U.S. regulatory agencies remain steadfast in their commitment to ensure all evidence relevant to their respective investigations is being preserved, and plaintiffs' counsel are not far behind. In March 2023, the U.S. Department of Justice (DOJ) reinforced its concerns about the loss of ephemeral messaging and issued comprehensive guidance instructing organizations to preserve all relevant business communications conducted on personal devices and messaging apps. While acknowledging the important role ephemeral messaging platforms could have in enabling business growth and prosperity, the DOJ also made clear that organizations should tailor policies and procedures to effectively pivot from deletion to preservation in the event of an investigation.