Battening Down the Hatches: Preserving Information

Creating and managing records is an important part of business. Keeping records helps companies meet important directives: accountability, efficiency, protection of rights, legal compliance, and the ability to reconstruct the past. As business moves more rapidly to the cloud, the amount of information to track, maintain, and destroy has increased exponentially. When a business is involved in litigation, record-keeping becomes even more important. Consumers, employees, and suppliers conduct business in an almost entirely online fashion. The shift to data-driven business and a greater emphasis on corporate responsibility creates even greater imperatives and nuances to the world of information management. Having a practical and strategic preservation protocol is critical for both day-to-day operations and litigation success.

Day to Day Preservation Strategies

In creating an operational information preservation strategy, we suggest that businesses inventory (1) the categories of information they need to retain; (2) where that information is located; and (3) who controls that information.

What information you have

Operational and legal principles dictate different levels of preservation for different types of information. Types of information may include:

• Consumer information. Consumers and other members of the public routinely provide personal and confidential information to companies through their websites and email. Companies must comply with privacy protection principles and preserve this information in a technologically and systemically secure fashion. Destroying the information is equally important: companies should not retain personal information of consumers longer than is needed. A robust deletion protocol is an important part of a healthy preservation strategy.
• Trade secrets. Companies must protect and preserve their valuable trade secrets to receive even basic legal protection. Trade secret laws typically analyze the extent to which a company safeguards its trade secrets to determine whether the information is, in fact, secret. Failure to implement procedural and technological safeguards can jeopardize the status of what is often a company’s most valuable asset.
• Financial information. Many federal and state laws have specific requirements for the maintenance of a company’s financial information.
• Corporate records. Corporate records can include a company’s governance documents, IRS filings, filings with the Secretary of State, bylaws, minutes, and information about directors and officers. Depending on the industry and type of company, state and federal law may dictate certain retention periods and when the public must have access to such information.
• Routine business communications and documentation. The retention of email communications and other routine business documents will depend on the type of information it contains. For general routine information, a practical consistent destruction policy can prevent potentially costly storage build-up.
• Contracts. Final, execution copies of all contracts entered by the corporation should be retained for the length of the contract and then for several years afterward. In Idaho, the statute of limitations for breach of a written contract is five years; companies should keep contracts for at least a few years longer.
• Employment records. State and federal statutes require corporations to keep certain recruitment, employment, and personnel information. Companies should also keep personnel files that reflect performance reviews, personal files, application files, and other personnel records. If an employment dispute or litigation arises, this information can be critical to a positive outcome.
• Insurance. Insurance policies, insurance records, claims, accident reports, and similar files may become relevant years after policies expire. Some types of insurance policies may continue to provide coverage after they “expire” if something happened during the coverage period that gives rise to a loss after the period ends.

 
Where the information is

Remote working creates multiple access and storage points for a company’s electronically-stored information (ESI). A healthy preservation strategy accounts for all of these points: workstations, cloud storage, handheld devices, external storage systems, laptops, tablets, network servers, voicemail systems, leased storage space, and backup tapes. Even a simple protocol for maintaining email can have significant operational and legal benefits.
 
Who controls the information

A robust preservation strategy considers who and which departments create, receive, and maintain what types of information. Mapping your company’s information structure and communication protocols can help you develop a tailored, practical protocol.

Litigation Strategies

Preserving information becomes even more critical when your company is involved in litigation.

Duty to preserve

A legal duty to preserve “relevant” information arises whenever litigation becomes “reasonably foreseeable.” In such cases, preservation becomes a specific response to a specific dispute or challenge. A company facing reasonably foreseeable litigation must  immediately identify the types of information that may be implicated, the persons and departments who may retain or have access to such information, the best method to segregate and preserve existing information, and a strategy for segregating and preserving new information that may be created or obtained. This may include preservation of backup tapes, metadata, and even ongoing day-to-day routine communications. A written and specific litigation hold should promptly be issued to all potential holders of such information.
 
Information structure.

In federal court, and increasingly in state court, one of the first things a party must do in litigation is communicate with its adversary about its information structure. Parties must, or should, identify key persons with access to relevant information; how that information is stored; what types of information should be provided to the other side; and the best mechanism for providing information, which may involve a third-party vendor.

Aggressive collection

Often the biggest risk companies face in litigation comes from failing to collect the right information for the lawsuit. Understandably, businesses do not want to turnover their internal documents and ESI to a known adversary and, potentially, to the public. But a reticent approach to document discovery ultimately will cost a company money and time.

Consequences for noncompliance

Failing to preserve ESI or produce relevant information during a lawsuit can lead to disastrous outcomes, including an adverse factual inference, sanctions, or, in extreme cases, a judgment entered against the company.

In sum, developing a strategic and careful day-to-day information preservation strategy and following best practices for litigation can meaningfully reduce risk and expense and allow companies to focus on doing business. 

Photo by Element5 Digital