This article was originally published on InsideCounsel.com.
The cloud is forever changing the dynamics of computing. Cloud solutions make economic and logistical sense for a sustainable approach to the modern demands of the ever-expanding digital universe. Companies of any size have access to scalable resources of processing power, immediate deployment and application building blocks to quickly address business requirements. The computing world is changing: eDiscovery, meet the cloud.
Watch this recorded webinar (feat. Aaron Crews, Senior Associate General Counsel and Global Head of eDiscovery at Walmart) to learn how to successfully navigate the cloud and defensibly identify, preserve and collect ESI.
This is the second article of a three part series where we will explore best practices in working with ESI stored in the cloud. The first article focused on tips and best practices for identifying cloud based ESI. This second article focuses on legal holds and the third upcoming article will recommend best practices for cloud based collection.
It is important to reiterate that when a legal hold is issued, regardless of whether a policy exists, there is a duty to preserve both on premise and cloud-based ESI. Consider the following opinion from Brown v. Tellermate Holdings, Ltd., (S.D. Ohio July 1, 2014)
“While the preservation, review, and production of ESI often involves procedures and techniques which do not have direct parallels to discovery involving paper documents, the underlying principles governing discovery do not change just because ESI is involved. Counsel still have a duty (perhaps even a heightened duty) to cooperate in the discovery process; to be transparent about what information exists, how it is maintained, and whether and how it can be retrieved; and, above all, to exercise sufficient diligence (even when venturing into unfamiliar territory like cloud based ESI) to ensure that all representations made to opposing parties and to the Court are truthful and are based upon a reasonable investigation of the facts.”
Best Practices for Legal Holds for ESI Stored in the Cloud
As stated in the previous article, “data stored in the cloud isn’t different than data stored within the confines of an organization; it’s still data, but it has a lot more places to live.” Implementing legal holds for data contained in the cloud is essentially an extension to your legal hold plan for on premise data–it just extends to include cloud-based ESI. Below is a set of best practices for establishing defensible legal holds which applies to both on premise and cloud based ESI.
Proactively Plan for Legal Holds - A legal hold plan should contain specific, detailed criteria for what events will trigger a legal hold. The so-called “trigger event” is a misnomer. It is often not a single event, but a series of signals based upon which a legal team must choose to initiate preservation efforts or not. It is important to include cloud based ESI as a part of the criteria keeping in mind that this data can be discoverable and should not be overlooked. Proactively understand how data can be preserved, and how you will instruct custodians to take appropriate steps when necessary. As data becomes both more prolific and more diverse in terms of where it may be stored it becomes more important to make sure that employees understand legal holds. Plan ahead – don’t be caught out in the storm.
Provide detailed notifications to custodians on hold - Notifications should be clear, comprehensive and provide all the information that custodians will need to properly carry out their role in the legal hold. Be sure to remind custodians this includes ESI they have stored in the cloud – including social media! Don’t forget cloud-based repositories like Box and Dropbox that are becoming more popular as corporate-approved repositories or rogue data locations. This is done in a similar way one might ask users if they use other computers or storage repositories, such as at home). It is also important to ask about mobile devices that are changing the way we create, transmit and store data. New ways of communicating include instant messaging and texting using mobile devices, but also a whole new family of social collaboration tools. Social media is a hot target including employees using LinkedIn and Facebook for business.
Create and use templates whenever possible - Update any templates you have to include cloud based ESI. Talk to your employees and IT teams about what tools they are using and add those to the template. Creating notification templates can ensure that all necessary information and instructions are consistently included and that notifications can be issued in a timely manner.
Document the journey - Assume that the courts will ask for documentation of any and every step of the legal hold to demonstrate that proper procedures were carried out in a timely manner including how you handled cloud based ESI. Be prepared with documentation.
Automate what you can - Automated solutions not only simplify and speed up execution of legal holds, they provide tracking, auditing and other tools that help ensure compliance and minimize risk to the organization at every stage of the legal hold. Fortunately, new cloud-based software tools for electronic discovery (such as Legal Hold Pro from Zapproved) are available.
Execute the Plan - Sheer negligence is not an acceptable excuse at court. Failure to properly execute a legal hold can result in severe consequences that could potentially place the entire organization at risk. Make sure you update your legal hold plan to include ESI store off premises in the cloud. In our experience, interviews are best done in person. However, if this is not possible then utilize technology. We have conducted many interviews with multiple parties in disparate locations using Web-meeting technology. Don’t rely solely on email interviews, nothing beats face-to-face, even if it is over the Internet!
Taking steps to ensure a defensible legal hold process to ensure relevant data is preserved is essential. Documenting is the best way to avoid finding yourself under a cloud that you don’t want to be under. Next up in the series, Collection in the Cloud.
Discover More:
3 Misconceptions About Cloud Discovery: What is the Truth?
When to Do a Remote Forensics Collection and 5 More FAQs
eDiscovery Update: Cloud computing and lame excuses for not preserving ESI
Around the World in 8 Days: A Remote Collection Success