430 likes | 484 Views
Record Management, Electronic Discovery, and the Changing Legal Landscape. Dino Tsibouris dino @tsibouris.com (614) 360-1160 www.tsibouris.com. More Trouble for Morgan Stanley E-mail ‘destroyed’ in 9/11 attack is found.
E N D
Record Management, Electronic Discovery, and the Changing Legal Landscape Dino Tsibouris dino@tsibouris.com (614) 360-1160 www.tsibouris.com
More Trouble for Morgan StanleyE-mail ‘destroyed’ in 9/11 attack is found • $1.5 billion judgment for failing to produce thousands of backup tapes of digital documents • Paid the SEC $15 million to settle allegations of e-mail mishandling pursuant to SEC investigations • NASD accusing Morgan Stanley of failing to provide millions of e-mail messages to investigators and plaintiffs and falsely claiming the documents had been lost in the Sept. 11, 2001 attacks
Student Marketing Group, Inc. v. College Partnership Inc. • CPI claimed SMG failed to provide student database with 98% accuracy • Data merged into CPI’s master database, but failed to link the source of data in many cases • CPI’s 2 computer experts’ findings unreliable
Lorraine v. Markel Am. Ins. Co Parties asked court for summary judgment To support their request, both parties attached e-mails as their only evidence E-mails inadmissible because neither party had proven reliability/authenticity
Lorraine v. Markel Am. Ins. Co. Reliability/authenticity of ESI must be proven before it will be admitted into evidence Failure to authenticate evidence is a self-inflicted injury The mere existence of ESI does NOT prove its reliability/authenticity
Sources of Electronic Data • 90% of data is created electronically • 30% is never printed • Sources: • Databases - Purchasing, Payables, Receivables, Email, ERP • Hard Drives, Network Backup Tapes • File Slack, Deleted & Encrypted Files • Meta Data & System Logs
THE IMPORTANT SLIDE • Having a Document Retention Policy and Process is essential • A “Cut & Paste” Policy is risky • Policies should be consistent
Best Practices • Destruction of records under a RIM plan reduces discovery costs by 25 – 30% • Categorize documents as “business” and “non-business” communications • Establish the term for document and data retention • System security and access controls enhance reliability of data at trial
Sarbanes-Oxley • SEC Regulation S-X Rule 2-06 • Audit record retention • Electronic records created, sent or received in connection with the audit or review containing conclusions, opinions, analyses or financial data related to the audit or review • Data integrity = financial integrity
HIPAA • For covered entities • For protected health information • All paper and electronic records must be part of a comprehensive records management program • Security rule
ESIGN Laws • If a law requires record retention, may comply by retaining the records electronically • Accurate reproduction required • Integrity is key
Commercial Standards • Sedona Guidelines • SOX • ISO, COBIT • Emphasis is on your Processes and Procedures
Records Management • Maintain and use an in-house glossary of records management terminology • Business units should use common terms • Technology terms must be part of the glossary
Records Management • Maintain up-to date records & information management policies, procedures and schedules • Audit your procedures • Modify policy & procedures • Document the process
Records Management • Maintain and track policies, procedures & schedules for litigation defense • Document past RM compliance • Consistently follow good faith process • Include documentation of inactive record keeping systems
Records Management • Know where each record series is stored • Know what is the general content of each series • Available formats or media • Identify personnel or experts who can assist with any large electronic systems
Records Management • Help attorneys identify and preserve relevant records • System to track all legal holds • Education/training/tools to preserve records
Records Management • Create tools to automatically suspend all automatic destruction • Assist counsel in identifying and protecting attorney-client privilege
The New Federal Rules of Evidence • Effective December 1, 2006 • Pretrial planning required • “Electronically Stored Information” • Format selection • Litigation holds • Safe harbor for data disposal
IT IS A RECORDS MANAGEMENT ISSUE • IT Terminology now part of discovery process • Where is it stored? • How is it transmitted? • What format is used?
Rule 34 Electronically Stored Information Any party may serve on ... [an]other party a request (1) to produce ... inspect, copy, test, or sample any designated documents or electronically stored information — including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations stored in any medium from which information can be obtained — translated, if necessary ... into reasonably usable form ...
Rule 34 Electronically Stored Information • Amended Rule 34(a) • “Documents” includes ESI unless clearly distinguished from “documents" • Requesting party may specify form of production • Network access
Rule 34 Electronically Stored Information • Amended Rule 34(b) • Native File Production provision • Requesting party may specify the form of ESI production • Form more important for ESI • Preserve searchability
Rule 26 Conference to Plan Discovery Except [when] exempted ... parties must, ... confer to ... make or arrange for the disclosures required by Rule 26(a)(1), to discuss any issues relating to preserving discoverable information, and to develop a proposed discovery plan that indicates the parties’ views and proposals concerning: ... (3) any issues relating to disclosure or discovery of electronically stored information, including the form or forms in which it should be produced;
Rule 26 Conference to Plan Discovery • Amended Rule 26(f) • Early attention to discovery of ESI • Describe ESI to be sought • Preservation of relevant data • Form of ESI disclosure • Privilege or protection
Rule 26 Conference to Plan Discovery • Describe what is a “record” in your organization (and why other data is not) • Explain where relevant information kept • List staff to locate relevant information • Can you help determine what is reasonably accessible and what is not?
Rule 26 Initial Disclosures • Amended Rule 26(a)(1)(B) • Each party must disclose before discovery begins a copy or description (by category and location) of all documents, ESI, and things in the other party's possession, custody or control that it may use to support its claims or defenses.
Rule 26 Production Issues and Accessibility • No need to provide ESI if there is an undue burden or cost • Party seeking discovery may move to compel • Party claiming undue burden or cost has burden of proof
Rule 26 Production Issues and Accessibility • Reasonably accessible ESI that is relevant must be produced • Do not need to produce ESI from sources that are inaccessible • Rule does NOT address duty to preserve relevant information on those sources during litigation
Rule 26 Production Issues and Accessibility • Help locate and track confidential or privileged records • Be a primary contact to help manage production • RM = rules, IT = tools
Rule 26 Burden of Proof • Explanations such as "inactive" or "backup" unlikely to suffice • Court can compel party to produce even if they meet burden of proof when there is good cause • Creates a “balancing test”
Rule 26 Privileged and Trial-Preparation Info • ESI includes metadata • Shows the history and context of the information • Links to other information • May reveal privileged or confidential information
Rule 45Subpoena Practice • Subpoena may specify form or forms to produce ESI • ESI default form is "a form or forms in which the person ordinarily maintains it or in a form or forms that are reasonably usable"
Rule 37Safe Harbor Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.
Rule 37Safe Harbor • Term "routine operation" refers to the way systems are "generally designed, programmed, and implemented to meet ... technical and business needs" • Must exercise “good faith”
Rule 37Protection is Narrow • Procedures must be established, documented and followed • Incentive for destruction? • Coordinate with other regulations • Safe harbor only applies to sanctions "under these rules"
Rule 26 Conference to Plan Discovery • Develop defensible practices • Consistent application of RM procedures • Make high-value records are not compromised or altered • Be able to educate and warn your attorney about “issues”