United States: Electronic File Retention: Preparing For Preservation and Compulsory Retrieval

By Mr Steven Skulnik and co-authored by Mr Alessandro Saracino

On June 15, 2002, the lead news item was that a Texas federal jury found Arthur Andersen guilty of obstructing justice when it destroyed Enron Corp. documents while on notice of a federal investigation. While it is rare that company officials can be proved to have acted with criminal intent when following the company’s document retention policy, there have long been legal rules that apply to records retention and records production in judicial proceedings and failure to comply with these rules can lead to significant penalties.

Now that business documents are almost always created electronically, and communication that was oral is now often evidenced by electronic mail, document retention policies need to be reviewed and reconsidered. This article addresses some of the issues that have emerged as a result of the ever-growing use of electronic data and the need or obligation to make electronic data available in the context of litigation or investigations. There is no "one-size-fits-all" solution on how best to address the need to retain or discard data. However, by proactively managing its data retention process with an information technology consultant and with counsel, a business can be prepared for the new e-challenges.

From a record retention point of view, the basic unit of measurement is the "file." Files come in different formats: email messages (e.g., MS Outlook, Lotus Notes), word-processed documents (e.g., MS Word, Corel Word Perfect), spreadsheets (e.g., MS Excel, Lotus 123, Corel Quattro Pro), presentation slides (e.g., MS Power Point, Corel Presentations, Astound), faxes (e.g., RightFax, WinFax), chat room transcripts, and video or audio files. Large relational databases that handle, for example, customer, financial and transaction data contain a wealth of information that may become the subject of discovery in the course of litigation or other proceedings.

Because data can be lost due to hardware failures, viruses, theft, natural and unnatural disasters, and user error, data files could be rendered irretrievable without a functioning back up system. Therefore, electronic data will usually be "backed up" on tapes or other media at least for disaster-recovery purposes.

Electronic files may also have been copied from the workstation that created them onto network drives, portable discs (diskettes, compact discs, zip drives, etc.) or tapes for a variety of purposes. These files may be created or saved onto workstations and laptops located anywhere in the world by employees in remote locations or on personal digital assistants such as Palm™ Pilots. Newer devices, such as compact flash cards or smart media cards, are being developed all the time, so it is virtually impossible to catalog all of the places one could find electronic data.

The flip side of emerging data storage media is so called "legacy" data, namely old data that may be in a file format that cannot be opened with existing applications or which may be stored on support media that can no longer be read using current hardware or software. One example is the 5¼-inch Floppy Diskette that fit into the DOS-based personal computers in what was called the "A" Drive. Although it may be possible to find such computers to read files from these old diskettes, a computer consultant will most likely be needed to access data created with out-of-date software or stored on such long forgotten media used in large systems such as optical disks.

The ease of data storage has led to a vast increase in the volume of archived information. While in the past the cost of real estate drove the need to discard obsolete paper files gathering dust in warehouses, there is no similar concern with electronic data, which can be stored in relatively small spaces.

Email is among the most commonly requested data which must be searched and produced in connection with litigation and is often the most expensive to retrieve and organize. Email programs usually make a file copy of every message received and sent; messages are often forwarded or replied to. As a result, there are often multiple copies of the same email message on many workstations and on network servers.

Besides document files and databases, other information may need to be retrieved. Web browsers, for example, record visits to websites on the workstation or server, in what are called "cache" files. There are also "history files," and "cookies", which record the web addresses that were accessed.

Lastly, most software programs create and store what is known as "metadata." Metadata is information about the creation, editing and distribution of a particular file or database. For evidentiary purposes, metadata is crucial to prove the authorship, timing and distribution of electronic documents, including email messages. Metadata is contained within the electronic file for the particular document, but is not usually visible when the document is printed.

Generally, documents should be deleted or "purged" when there is no business purpose to keep them, unless there is a specific legal requirement to keep them for a fixed period of time (e.g. Treasury Regulations for record retention by tax payers, Equal Employment Opportunity Commission Regulations for personnel records, etc.). Even though the storage of electronic data can be relatively inexpensive, the cost of retrieving data that may reside in a large universe of obsolete information can be staggering. In some reported litigations, the cost of restoring data containing email messages alone from back-up tapes was in the millions of dollars.

If disaster-recovery is the only purpose for backing up, the back-up tapes should be retained for a short period of time and then recycled. Each time the tape is re-used, the data is overwritten. However, many companies often save backups for much longer or even permanently without considering the costs of retrieval. Those costs come as an unwelcome surprise when the company needs to respond to a discovery request submitted in the course of litigation or another proceeding.

Where there is a business purpose for retaining large amounts of data, a business should consider strategies that support data archiving and warehousing. These strategies can be designed to collect the data in a format that will make search and retrieval relatively simple, should the need arise in connection with a litigation or government investigation.

Further, where files are not archived in an orderly way, a court may order a search of entire systems, including "residual data," and "file clones" which may reside on the network or on hard drive of the one or more workstations. Residual data is not detectable except by forensic experts who will use sophisticated tools to examine entire disk drives, and for this reason residual data is generally the most costly form of data to recover. Archiving strategies should be thought through in a way that minimizes the risk of having to perform these costly recoveries.

Finally, in the computer world, major system upgrades are performed as often as every year. When this is done, should legacy data be retained? If so, can it be stored in a way that will make important records accessible through search tools? Asking these questions in advance could save significant expense if production of data is compelled. There is little utility in maintaining data that cannot be easily accessed and consulted, especially where this useless data may be the source of enormous expense.

A policy that systematically purges obsolete data and rotates back-up tapes so they are useful only to restore a recent image of the computers and servers in case of disaster can present problems where litigation is pending or foreseeable. Once a company knows that is in litigation or reasonably anticipates that it will be, it should have its information technology department and its counsel devise a strategy to (a) discontinue automatic purging of files which could be the subject of discovery in the litigation and (b) establish controls to protect electronic data, even from accidental deletion or modification, by disabling users’ ability to change or delete such data.

If the company does not immediately establish and communicate a "preservation" policy, and have technology-literate personnel or consultants execute that policy, it risks court sanctions if by continuing its standard tape backup and rotation practices the company then destroys evidence. A company that fails to protect the integrity of its data can run risks ranging from monetary or other litigation sanctions to criminal prosecution, in the extreme case, such as the Arthur Andersen matter.

The cost of producing documents in litigation can be borne by the party requesting data, the party producing data, or shared. Generally, if a party maintains electronic data for the purpose of utilizing it in connection with current activities, it may be expected to respond to discovery requests at its own expense. This is true even if the company is not a litigant, but merely a third party that has been served with a subpoena.

On the other hand, a company that retains data for no current business purposes, but only in case of an emergency or simply because it has neglected to discard it, will not ordinarily be put to the expense of producing it. It is important to keep in mind, however, that even where a party can convince a court that it should not have to pay to restore data which it no longer uses, it may have to turn over duplicate back-up tape or hard drive images which may contain embarrassing, harmful or even privileged documents, so that the requesting party can perform its own searches. This possibility may encourage the producing company to pay for organizing and searching the data itself, prior to turning data over to the adversary, even if not technically required to do so.

While this article focuses on the burdens of producing evidence to an adversary, it is of course true that a party’s own documents can be helpful to its case. For example, where a company discharges an employee for disciplinary reasons, good practice dictates that the employee’s email mailbox be closed so he or she can no longer access mail and those wishing to contact the employee will receive a notice that the email account is no longer in use. This can be accomplished in a variety of ways. The account can be closed and files deleted, or the account can remain but the mailbox disabled so that the files remain. If the employee complains about the discharge, it may be helpful to search emails for evidence concerning the employee’s performance, loyalty, etc. If a former employee joins a competitor, emails may provide a basis for showing improper solicitation or removal of trade secrets. Similarly, it may be useful to track web-browsing activity for this former employee. It would be wise to move all the email files of the former employee to a location on the network that is not scheduled for automatic deletion until there is no longer a need to investigate and litigation is no longer considered a risk.

Many businesses need to review and reconsider retention policies and archiving strategies. What is archived should be organized to permit efficient retrieval of the necessary information. In addition, a disaster recovery policy should always be accompanied by a preservation policy which should identify what steps should be taken to suspend any electronic data retention/destruction policy, e.g., back-up and write-over procedure in the even of litigation or investigation. By implementing relatively simple and sensible policies in advance, companies can avoid the risk of costly and time consuming burdens later on.