Preservation in eDiscovery is at the intersection of law, technology and strategy. It must fulfill the party’s legal duty. It should be technologically feasible and cost-effective. And it offers the best return on investment when it is treated as part of – not apart from – the litigation plan.
Parties to a dispute have a legal duty to preserve relevant information. The duty attaches when litigation is known or reasonably anticipated. Preservation applies to file content and metadata. The legal duty extends to physical evidence and paper files as well as electronically stored information (ESI), but ESI rightfully gets the lion’s share of the attention. Electronic data is both far more voluminous and far more challenging.
As a precursor step, the identification process is used to determine what ESI needs to be preserved. (Read my three part series blog series on identification, beginning with this overview of the purpose and process of identification.) The question at the preservation stage is how to ensure that relevant data is not lost, destroyed or altered.
Understanding the two conceptual approaches to preservation
There are two conceptual approaches to preservation: 1) preservation in place; and 2) preservation by collection.
The aim of preservation in place is essentially to maintain the status quo. Custodians, who may be individual litigants or employees of corporate parties, are instructed not to delete relevant ESI in their possession, custody or control. The litigation hold remains in effect until final disposition of the legal matter; for instance, when the post-judgment appeal period has expired or the statute of limitations has run on a potential claim.
Typically this is accomplished through a written litigation hold notice administered by in-house or outside counsel. The hold notice describes the subject matter and timeframe of the case, identifies the relevant data sources and gives specific “do not delete” instructions. It also provides practical information like a contact person for questions.
If the client has IT staff, separate instructions are given to IT for preserving relevant system data, archives and backups. One of the most common examples is suspending auto-delete functions in Microsoft Exchange email systems. Another common example is archived data of former employees, including employees who leave the company while the case is ongoing. It’s important to specifically track IT’s compliance with the hold from both an eDiscovery and information governance perspective.
Preservation by collection makes a copy of the ESI and basically puts it on the shelf until it’s needed. As with preservation in place, the copy is kept until the final disposition of the underlying matter.
It should go without saying that the preservation collection must be defensible. The copy must be made using forensically sound tools and processes and chain of custody must be documented. Preservation by collection is most often employed to preserve data sources that are easily altered during normal use, but may also be used for strategic reasons.
Six factors to consider in formulating your preservation strategy
Preservation in place is the preferred approach in the majority of civil matters because it is usually (although not always) more cost-effective than preservation by collection. However, any given matter may use either approach or a combination of both. Even if preservation in place is appropriate for most of the relevant ESI, a preservation collection may be the best choice for one or more specific data sources.
There are six main factors to consider in deciding which approach to use. The analysis should be performed for each unique data source.
1. Technical feasibility – The client’s IT staff and your eDiscovery or forensic consultant can assist in determining if preservation in place is feasible from a technological standpoint. An example of a data source that must be preserved by collection for technical reasons is the file slack space of computers. File slack is relevant when deleted files are at issue, such as when there are allegations of employee misconduct.
2. Cost – Making a preservation collection is a one-time out of pocket expense. There is additionally a small cost for storing and managing the collection data. Although it’s more difficult to assign a dollar value to preservation in place, it should be kept in mind that this approach also carries costs to the client. Complying with a litigation hold disrupts normal business operations and managing the hold is an ongoing administrative burden.
3. Risk of spoliation – Is there a high risk of spoliation, whether because of technical reasons, unreliable or inattentive custodians or deliberate misconduct? Some of the possible consequences of spoliation are loss of helpful evidence, wasteful discovery disputes and sanctions such as fines and adverse inference instructions. A significant example of a data source with a high risk of inadvertent spoliation is feature phones (a/k/a flip phones). Due to their limited storage capacity, feature phone data is easily overwritten in normal use causing deletion of potentially relevant text messages, call history, etc.
4. Litigation objectives – An early collection can be advisable for reasons other than preservation. For instance, forensic investigation into a key data source or expediting review of critical files in connection with settlement negotiations.
5. Case strategy – Preservation is just one piece of a bigger picture. There may be strategic reasons to make a preservation collection independent of technical or cost considerations. For example, agreeing to the opposing party’s preservation demand for a forensic image of a key custodian’s computer can head off a costly discovery fight. Another potential reason is to make the data more readily available in a separate legal matter.
6. Proportionality analysis – The final step is to make a proportionality analysis. Is the preservation plan proportional to its cost, the importance of the evidence in light of the issues and the value of the case?
When evaluating different preservation solutions, it’s important to keep in mind the overarching goals of the eDiscovery project. The preservation plan should be technologically feasible and cost-effective. The method of preservation should serve the larger needs of the investigation or litigation by making the data available when and how it’s needed for forensic analysis or review. Finally, like all aspects of eDiscovery, preservation should be proportional within the overall context of the legal matter.
Helen Geib is General Counsel and Practice Support Consultant for QDiscovery. Prior to joining QDiscovery, Helen practiced law in the intellectual property litigation department of Barnes and Thornburg’s Indianapolis office where her responsibilities included managing large scale discovery and motion practice. She brings that experience and perspective to her work as an eDiscovery consultant. She also provides trial consulting services in civil and criminal cases. Helen has published articles on topics in eDiscovery and trial technology. She is a member of the bar of the State of Indiana and the US District Court for the Southern District of Indiana and a registered patent attorney.
This post is for general informational and educational purposes only. It is not intended as legal advice or to substitute for legal counsel, and does not create an attorney-client privilege.