To Delete or Not to Delete: Five Things Your Company Can Do to Achieve Balance with Data Retention
Whether ‘tis nobler to incur the expense of keeping all of the hard copy documents and electronically stored data that your company creates or to delete nearly everything and risk not having evidence to defend a claim…that is the question facing many companies today.
Data retention is both an expensive and high risk issue. A variety of state and federal laws require preservation of certain documents and data for different periods of time. In addition, when a legal proceeding or government action arises, a preservation obligation follows regarding all discoverable data. As a result, today’s companies must find a balance in data deletion and retention that takes into account their operations, complies with applicable laws and allows the companies to quickly adapt their policies in the event of foreseeable litigation. The following are five steps that your company can take in order to achieve this balance.
1. Establish a diverse internal committee to address data retention.
The manner in which the members of your organization create and store data likely differs from department to department and possibly, from individual to individual. Thus, a variety of company representatives should participate in crafting an effective retention policy.
A representative from IT is essential. He or she knows how much electronic data the company creates, can explain how and where it is stored, and knows how technological processes can or should be changed. In addition, an HR representative should be included, as he or she is likely responsible for maintaining documents and data in compliance with state and federal employment laws. A representative from each company department also should be included to explain the content of the data that his or her department creates and what must be retained in order to carry out the department’s business responsibilities. Finally, either in-house or outside counsel should be included on an as-needed basis to provide insight on the company’s compliance with applicable law and litigation hold procedures.
2. Determine what you have and where it is.
The committee’s first task is to determine what data the company has and is creating, as well as how and where it is stored. The company must be sure to include hard copy and electronic data, as well as data held or stored by a third party on the company’s behalf. In litigation, the company could be required to preserve and produce data in the possession of a third party that is under the company’s custody or control.
3. Draft and publish a written retention policy.
Companies should not be concerned that a retention policy inevitably results in deletion. Even the U.S. Supreme Court has recognized that the purpose of a retention policy is “in part to keep certain information from getting into the hands of others, including the Government.”(Arthur Anderson v. U.S., 554 U.S. 696, 704 ) Thus, outside of specific legal preservation requirements, a company may permissibly destroy the data it creates. Moreover, an effective retention policy will better equip a company to handle any future litigation and protect the company from any claims that the data was purposely destroyed as a result of an actual or foreseeable claim.
Substantively, a retention policy should address each class of data identified by the committee and set forth the length of time that the company will preserve each class in compliance with all applicable state and federal laws. In addition, the policy should set forth the location and/or manner in which the company will preserve each class of data. The company should publish sections from the retention policy that are applicable to employees so that employees are aware of what data to preserve and when other data will be destroyed.
4. Establish a litigation hold procedure.
Company data in electronic as well as hard copy form is discoverable in any litigation. Evidence stored in electronic forms, such as e-mail and word documents, is much more easily deleted or changed than its hard copy counterparts. Thus, in order to avoid liability arising from destruction of electronic evidence, companies need to institute a litigation hold procedure that suspends their normal data destruction policies regarding both electronic and hard copy data that may be discoverable.
The duty to institute a litigation hold may arise before litigation actually commences. An indication that litigation is reasonably foreseeable may start the preservation duty. This could be a demand letter, an administrative filing, or even a verbal comment. As these events may take place before consultation with counsel, it is advisable for a company to establish its own litigation hold procedure that specifies: who will decide when to issue a litigation hold; what destruction actions will be suspended in the litigation hold; how the litigation hold will be communicated to key employees; and how discoverable data will be located and preserved.
5. Substantially comply with the retention policy and the litigation hold procedure.
A company should never prepare a retention policy or litigation hold procedure and then not comply with it. Similarly, a company should not prepare a retention policy either that does not address all of the data the company has or alternatively, that is overbroad.
Retention policies become very important very early on in litigation. Having a policy that does not address all data may result in some data not being properly preserved. This may lead to litigation sanctions.
Conversely, an overly broad policy may result in your company’s incurring unnecessary costs and in litigation, possibly providing the adverse party with information that it would otherwise not be entitled to obtain. Noncompliance with a retention policy and/or litigation hold procedure will open the door for extensive questioning by opposing counsel in any litigation and may even create a suspicion of destruction of evidence.
A final thought.
Compliance requires follow up. Companies should conduct an annual review of their retention policies to ensure that all data continues to be addressed in these policies and that employees are, in fact, preserving and destroying data as required. In addition, after a litigation hold has been issued, companies must follow up with key employees to ensure that appropriate searches for data have occurred and discoverable data preserved.
Successful companies will move quickly to establish effective retention policies and litigation hold procedures in order to prevent liabilities arising from the various preservation obligations and to control the costs and risks associated with saving everything.
Julie Reddig helps employers design cost-effective and creative solutions that reduce the risk of and resolve workplace liabilities. To learn how to create or update your company’s data retention policy, contact Julie at email@example.com or 301-961-6099.
This article originally appeared in Lerch, Early & Brewer's Legal Update, 2010, Vol. II. It is for your information only and is not intended to constitute legal advice. Please contact your attorney for more information.