Records Retention and E-Discovery Issues for Nonprofit Organizations

Transcription

1 ACC Nonprofit Organizations Committee Webcast Records Retention and E-Discovery Issues for Nonprofit Organizations November 9, 2005 Rob James Mark Koehn Pillsbury Winthrop Shaw Pittman LLP

2 Overview The electronic information explosion E-discovery, and the need for a litigation response plan generally for nonprofits The need for a customized records retention program generally for nonprofits Questions about records management for nonprofits 2

3 The electronic information explosion Well over 90% of organizational information is now created or stored electronically; two-thirds never printed 1 gigabyte (GB) 75,000 pages 40 bankers boxes A university with 10,000 employees and students, each averaging 84 messages a day plus attachments, would generate 220 million s plus attachments per year, or more than 38,000 GB of data (radicati.com) 1.1 billion active electronic mailboxes worldwide in 2005 Over 60 billion s per day worldwide by 2006 (sims.berkeley.edu) 3

4 Types of electronic information Any information created, modified, or stored electronically Word processing (Word, WordPerfect, etc.) Spreadsheet data and formulas (Excel, Lotus, etc.) Databases (e.g., donor and applicant records) (Outlook, Lotus Notes, etc.) Internet usage (e-commerce, electronic data interchange (EDI) records) In any storage medium Voic , audio and video tapes, personal data assistants (PDAs), fax machines Instant messaging (IM) on cellphones, phone logs, Internet phone records Backup tapes, CD-ROMs, DVD-ROMs, diskettes, flash drives, etc. Smart cards, car systems (OnStar, etc.), credit card records 4

5 Volume of electronic information Persistence : for a single paper document (printed from an e-document), there might be: 1 hard drive copy and 12 monthly backups Multiple drafts on several hard drives over 12 months worth of backups (maybe weekly and daily backups too) If was used to circulate drafts and finals... there may be 1,000 copies or more of the same document More typical nonprofit example: 50 employees, 25 new s/workday/employee, 240 workdays/year, no permanent deletions, and monthly backups 25,000 in month 1, 50,000 through month 2 1,950,000 records by year end Did we mention attachments? 5

6 Volatility of electronic information Every time an e-document is opened and closed, it changes information about that file known as metadata Time of creation, access, receipt and revision Identity of creators, accessers, recipients and revisers Content of edits and comments Generally, when an e-document is deleted, it is not actually deleted The space is flagged for reuse by the computer the next time it needs space Unless completely overwritten, a deleted e-document may be undeleted in whole or part with forensic software Many e-documents of nonprofits are communicated to wide audiences, e.g. members, donors, committees, boards 6

7 Costs of electronic information add up Costs of archiving or backing up Costs of executing a retention/disposition plan Costs of storing Costs of retrieving (and reconstructing) Costs of separating and preserving Costs of reviewing for relevance Costs resulting from information that was kept Costs resulting from information that was not kept Lost opportunities from information that was not kept Poor records management means you might not be able to afford to fight a claim that has no merit 7

8 The power of evidence... 8

9 and the power of metadata United States v. Quattrone (S.D.N.Y. 2004) Drafted message urging group to catch up on file cleaning Allegedly two days after lawyer told him a federal grand jury was looking into his IPO allocations Metadata showed the was created and saved as a draft one day, and sent a day later Metadata helped rebut defense claim that defendant sent unthinkingly, without intent to obstruct investigation 9

10 E-discovery is the norm Expect electronic records to be covered by any interrogatory or subpoena Courts are increasingly e-savvy and will expect any organization even a small nonprofit to be able to preserve, retrieve and search virtually any stored data Sanctions for noncompliance can be severe fines default judgments adverse inferences (e.g., $29 million in single employee harassment/termination case) civil contempt criminal liability 10

11 Key cases Zubulake v. UBS Warburg LLC (S.D.N.Y. 2003) Seven-factor analysis for shifting e-discovery costs: 1. specificity of request; 2. availability from other sources; 3. total cost, compared to the amount in controversy; 4. total cost, compared to resources of each party; 5. each party s ability to control costs and incentive to do so; 6. importance of the issues at stake; and 7. relative benefits to the parties. 11

12 Key cases Residential Funding v. DeGeorge Home Alliance (2d Cir. 2002) Discovery sanctions, including an adverse inference instruction, may be imposed where a party has breached a discovery obligation not only through bad faith or gross negligence, but also through ordinary negligence Discovery opponent s purposeful sluggishness regarding production may be enough to infer that the withheld or destroyed s would be damaging 12

13 Associations Are Frequent Discovery Targets Often anticipated to be the hub of communication Association counsel has attorney-client privilege with association generally not individual members Discovery proponents pursue associations hoping for relaxed discussion of sensitive issues Responding associations should consider and develop strategy for appropriate coordination with members counsel in responding to subpoenas Consider whether any nondisclosure agreements are implicated Consider formal common interest agreements 13

14 Recent Example In re Mutual Funds Investment Litigation (D. Md. 2005) Allegations of market timing Multidistrict litigation ( MDL ) Subpoena to Investment Company Institute (ICI) Sought broad categories of documents Court: the subpoena would require production of virtually every document in ICI s files concerning market timing and late trading, including documents relating to defendants in MDL proceedings Court: the subpoena is not limited to the documents in ICI s file relating to [particular[... entities, but encompasses documents relating to every member of ICI. Enforcement of subpoena stayed because would contravene a related discovery stay. 14

15 Pending Federal Rule amendments Approved September 20, 2005, effective December 1, 2006, unless Congress or Supreme Court intervenes FRCP 26(b)(2), 45(d) [N]eed not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. FRCP 34(b), 45(d) If an [interrogatory/subpoena] request for electronically stored information does not specify the form of production, [recipient] must produce the information in a form in which it is ordinarily maintained or reasonably usable. FRCP 37(f) Absent exceptional circumstances, a court may not impose sanctions for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system. The court or magistrate can make exceptions and shift production or review costs 15

16 Duty to preserve evidence Duty attaches when litigation, investigation or audit commences or is reasonably anticipated Well before subpoena is served (Arthur Andersen) At or before filing of EEOC complaint or union grievance (Zubulake) But not as soon as there is an abstract possibility of dispute: A knowingly corrup[t] persuader cannot be someone who persuades others to shred documents under a document retention policy when he does not have in contemplation any particular official proceeding in which those documents might be material (Arthur Andersen) (emphasis added; construing criminal statute) 16

17 Litigation response plan Policy All employees responsible for alerting Law Department that litigation, investigation or audit commenced or anticipated Law Department responsible for instituting and communicating record hold Initial communication may need following up IT and Records Departments, and all employees who are records custodians, are responsible for segregating and preserving records and suspending disposition Process for enforcement and audit Training and reminders Intranet-based repository so new hires are aware 17

18 Practical considerations Doing (and documenting) the right thing Reasonably anticipated litigation (P vs. D) Obtaining opponent s discovery requests Identify relevant/responsive e-documents and preserve Ex 1. Pull and save certain backup tapes beyond standard recycling procedure Ex 2. Cease standard recycling procedure Costs can be enormous - especially if saving all daily and weekly backups What about records in hands of third parties? 18

19 Practical considerations Preserving as in ordinary course Imaged hard drive copy v. active file copy Collecting e-documents from individuals - ing to counsel (bad idea) Copying to Repository Server Creating CD-ROMs 19

20 Practical considerations Reviewing what you preserved Review from copies File extension reports to identify volume and size of e-documents of various types and file name reports to identify structure of indexing/filing system De-duplication Review platform - None Key word searching over multiple e-docs Lit document repository (local or via Web) Nonresponsive 20

21 Practical considerations Producing what you reviewed Native format Images or paper Metadata Making paper documents electronic- Imaging OCRing Stip and Order re priv and workproduct review 21

22 Practical considerations Ascending order of difficulty: Active data Metadata System data Backup tapes Deleted files Legacy data - Ex. 5 1/4 floppies VisiCalc files 22

23 Records retention program Not just a policy resident on a bookshelf or intranet site A program consisting of Tone set by upper management that compliance is a core value of the organization Policy integrating the nonprofit s legal, information technology (IT) and records management (RM) resources Communication and assumption of responsibilities by individual departments and employees Training, enforcement and audit Updating for changes in laws, services/products, markets/audiences Coordinate with other policies: Inappropriate content of communications Privacy Ownership of information Appropriate destruction methods 23

24 An organization need not retain all electronic information ever generated or received. (Sedona Guideline #3) Records should be viewed like other assets of the organization They have value if they can be used to achieve the organization s goals and meet legal responsibilities If they do not, absent an independent duty they need not be kept It is not wrongful for a manager to instruct his employees to comply with a valid document retention policy under ordinary circumstances. (Arthur Andersen) Courts routinely acknowledge that organizations have the right to destroy electronic information that does not meet the internal criteria of information or records requiring retention. (Sedona Guidelines, Comment 3a) 24

25 Information vs. records First challenge is to separate records from the mountain of information Records are a special subset of information deemed to have some enduring value to an organization and warranting special attention concerning retention, accessibility and retrieval. (Sedona Guidelines, Introduction) Ephemeral information need not be preserved in the first place meeting logistics , for example 25

26 Assessing the IT and RM capabilities Courts do impose e-discovery standards on parties based to some extent on their resources and experience Retention program, IT systems and RM practices should be consistent Understand nature and purposes of archiving systems Consider limiting access to archives solely for disaster recovery Understand where electronic and hard copy records are maintained and by whom Tension between ever-expanding IT capabilities and retention program goals Example: unified message systems (UMS) voic messages sent by 26

27 Legal and business retention periods Legal retention mandates EPA: keep records of studies not submitted to the EPA for at least 2 years following the date on which the study is completed, terminated, or discontinued (40 CFR ) OSHA: keep employee occupational illness/injury reports for 30 years following termination (29 CFR 1910) Sarbanes-Oxley: auditors must keep workpapers and other audit or review records for 7 years, often flows down to audited organizations Statutes of limitation In absence of tolling, define period for suits against or by organization Not a mandate but a matter of business judgment prior to anticipated litigation Business needs Maintain donor records, marketing data, R&D data for use in later years Legal destruction mandates Personal privacy information concerns 27

28 Examples from the nonprofit world Lobbying Federal: 6 years for federal reports States: varies, often 3-6 years for records of meetings with legislative and executive branch personnel Cal. Code Regs (f): 5 years Del. Code tit : 4 years N.Y. Legis. Law 1-h(c), 1-i(d), 1-j(d): 3 years IRS Form most recent years returns Intellectual Property Leases and other contracts Employment Records 28

29 Tailoring the program Record types and retention periods come together in the schedule Usually a table identifying type of record kept by organization location and format of the authoritative version custodian of that version time period for retention Time periods usually specified in years 6: keep for 6 years after creation ACT5: keep for 5 years after cessation of activity in question (contract, employment, etc.) TAX5: keep for longer of 5 years or closure of tax audit exposure (for non-exempt businesses, e.g.) VITAL: keep hard copy original PERM: keep indefinitely 29

30 Special cases Ethical walls restricting internal access to information revolving door government employees confidentiality agreements What about litigation pending at time program starts? Immediate need to segregate records relevant to current cases Plan for implementing program when and as cases resolve Document management systems Automatic deletion of Deleted Items and Drafts Automatic deletion of Inbox, Sent Items? Organization should assure, through systems, training, enforcement and audit, that records are being sent from the Inbox or Sent Items folders to project folders, where they are maintained as prescribed by the policy 30

31 Additional resources Involve experienced counsel Those that understand the discovery process AND the technology AND the behavior and culture of the organization and its employees 31

32 Additional resources The Sedona Conference SM E-discovery: The Sedona Principles Records retention: The Sedona Guidelines Download for free at Annotated Case Law and Further Reading on Electronic Discovery by Kenneth J. Withers, Senior Judicial Education Attorney, Federal Judicial Center (kenwithers.com) ISO 15489, ARMA, ANSI standards, especially for trade associations E-discovery vendor websites, including Applied Discovery (LexisNexis) and Kroll Ontrack But beware of recommended activities beyond what reasonable inquiry court standards may require. 32

33 More questions? Rob James Mark Koehn