Ignorance of Data Retention Law is No Defense October 29, 2008 Presentation DESE Revised October 29, 2008 Compliments o

2. Important Notice This presentation is NOT intended to provide legal advice!

3. New Federal Rules December 1, 2006 -- US Supreme Ct Adopts New Federal Rules of Civil Procedure on �Electronically stored information.� New rules only apply to federal cases BUT states often model their own rules after federal rules

4. eDiscovery Rules What do they do generally? Allow discovery of school electronic documents Will cause states and schools to develop data retention rules and plans When do they come into play? Federal civil suits: Cases brought under federal laws that deal with, e.g.: employment discrimination (ADA) health and safety (OSHA) student services (IDEA) contract disputes (where federal jurisdiction exists)

5. eDiscovery � What Must Be Produced? Federal rules contain NO definition of data. States are filling in the blanks. Thus, eDiscovery may include: E-mail Voice mail (Hawaii) Servers and individual PC hard drives and disks (Mass) Work related data from private computers and private ISP email accounts (Wisconsin) Mobile computing devices such as palmtops, personal digital assistants (PDA�s), and smart phones (Wisconsin)

6. eDiscovery � Failure to Produce What happens if you fail to produce electronic records? Monetary fines Exclusion of evidence Adverse Inference Instruction to Jury, i.e. jury can presume that material not produced would be damaging Summary judgment or case dismissal

7. New Rules Explained Rule 16 Pretrial Conferences Opposing parties meet and discuss a discovery plan and evaluate the protection and production of electronic data. Rule 26a Initial Disclosures Upon filing of a civil action, schools must immediately disclose to the other party a copy of or a description by category and location of all relevant electronically stored information. Disclosure might have to occur as early as 30 days.

8. New Rules Explained II Rule 34 Production of Electronically Stored Information Any party can serve a discovery request on another party for electronically stored information, including writings and data compilations. Schools must produce such information in a form in which it is usually kept or in forms that are reasonably useful.

9. Undue Burden: Limited Protection for Schools Rule 26b2 Limits on Disclosures Schools need not provide electronically stored information if that information is not reasonably accessible because of undue burden or cost. If other party insists on disclosure, court may compel disclosure after engaging in a series of balancing tests

10. Undue Burden II Rule 26b2 continued Courts can weigh the following factors to determine reasonableness of discovery request: Whether information is unreasonably cumulative or duplicative or obtainable from another source (e.g. witness testimony) Whether the amount of money at issue is worth cost of obtaining this information

11. School Data Retention Policy as Safe Harbor Rule 37 Sanctions for Failing to Provide Absent exceptional circumstances, courts may not impose sanctions if electronically stored information has been lost as the result of the routine operation of electronic information system, as long as that operation is in good faith. NOTE: Suggests that regular operation of data retention policy, where electronic info is discarded, may provide safe harbor for schools, if the info is discarded consistent with state policy.

12. Safe Harbor II How Much Protection Does Safe Harbor Offer? Just having a data retention policy is not enough. Must be reasonable and not operated or developed to avoid discovery. New York Law Journal cites a number of factors courts will consider: 1) Whether the party adopted a policy of destroying core electronic information central to its business more frequently than documents less critical to business operations

13. Safe Harbor III New York Law Journal, continued: 2) Whether at the time of the destruction the litigant reasonably anticipated that the documents might be needed for future reference 3) Whether the destruction occurred after the party was put on notice of a potential claim in which the documents would be relevant in a subsequent proceeding or after a discovery demand or evidence preservation demand was made 4) The time and circumstances of the destruction

14. Safe Harbor IV New York Law Journal, continued: 5) Whether the party was at fault 6) Whether the documents destroyed were required by law to be maintained because of industry record keeping requirements in order to confirm compliance with agency regulations

15. How Long to Retain Data? Federal rules do not specify Many states have their own rules Massachusetts:

16. How Long to Retain Data?

17. How Long to Retain Data?

18. How Long to Retain Data?

19. The Situation in Some Districts�

20. The Records Side. . . Records were not stored in one location for a student; multiple resources required for record retrieval A fire at the courthouse destroyed many records School registrars were filling records requests Procedures existed, but was no centralization or electronic means of storage, retrieval, or destruction

21. The Records Side. . . Business records for departments, i.e., finance, facilities, human resources, etc., were located in storage rooms. However, many were stored in various spaces (closets, rooms, vaults, hallways) in other offices and buildings. Each department took care of storage and destruction. Policies, procedures, inventories, and documentation of destruction according to required retention schedules were in need of updating and modification.

22. E-Discovery Resources required to retrieve paper records from those file boxes and/or to restore e-files is far more than a managed system Open Records Request for just one staff member�s email can use thousands of dollars in district resources!  What if records are requested for multiple staff members?

23. Recommendations What should you do?

24. Recommendations II

25. Tools, Issues, and Implementation Work to develop: Policy � technology and record keeping policies (keep current) Standards � impacting technology selection and record keeping Technical Infrastructure data sharing, data transfer, and data assurance requirements in-house, hosted, or hybrid strategy Implementation � Standards and Procedures Training of staff Monitor ongoing compliance

26. E-Discovery Establish an E-Discovery Plan Inventory of Electronic Data-Processing and Data Storage Devices Litigation Hold Letter Identify Key People Assign personnel for monitoring discovery process

27. Recommendations III Work with IT, Records, and district document retention requirements Develop a Comprehensive Document Retention Procedure Should cover retaining all e-communications, no matter who created and no matter where stored Must identify which records are to be kept Must include retention schedules Must cover litigation stops and securing of preserved data in the event of lawsuits Must consider likelihood that e-communications could be relevant to any litigation Must be in compliance with all state and federal regulations (FERPA, HIPPA, IDEA, NCLB, etc.)

28. Recommendations III (continued) Work with IT, Records, and Legal to (continued): Identify long-term access and maintenance requirements. Integrate lifecycle records management into all recordkeeping systems Employ technology neutral standards Consider the use of hybrid technologies (digital and film) Develop a Training Plan for your staff

29. How Should You Begin? Legal: Consult with your attorney; legal counsel is imperative! Ensure support from district administration Develop and implement policies and procedures which ensure compliance with records and information management�All government offices must establish written policies regarding their email systems.� (Massachusetts SPR Bulletin No. 1-99, Revised and Reissued May 21, 2003)

30. How Should You Begin? II Technical: Consult with your technology solutions advisors/vendors Plan and implement a technical solution that meets your current as well as your future needs Plan storage capacity carefully; consider ease of growth Consider the future when choosing a media type; migration to another media type could be expensive and time-consuming

31. How Should You Begin? III Training/Accountability/Documentation: Train all leaders and staff�Government offices must ensure that all personnel who will be handling email are properly trained to insure compliance with this policy.� (Massachusetts SPR Bulletin No. 1-99, Revised and Reissued May 21, 2003) Maintain accountability Assign responsibilities Monitor your processes Document compliance with your own policies and procedures

32. Recommendations What else do you need to know?

33. �Backups� Do Not Equal �Archives� Backups: Provide a recent copy for recovery in the event of disaster Give you a snapshot of your existing email structure at the time of backup Require significant hours when looking for a needle in a haystack Mail can be lost between backups Archiving: Provides extensive Search and Retrieval functionality Can provide secure off-site storage Maintains data integrity

34. In-House vs. Hosted Email Archiving In-House Archiving Hardware and software is purchased by the District Installed in your data center and managed by you Hosted Email Archiving All sent and received mail is uploaded to a service provider The mail is indexed for fast searching Web based access to archives is provided

35. In-House Archiving Advantages: All data is kept in-house Ability to customize may be greater Long term cost may be less Disadvantages: Upfront costs, including hardware and software Employee resources Longer implementation time

36. Hosted Archiving Advantages: No large out of pocket initial investment Management is not your headache Secure Off-site Storage Disadvantages: Reluctance to trust a company with your data Could be more or less expensive over time Concerns about bandwidth

37. Thank you for participating Good luck and Thank you!