Document Retention Policies and Litigation Holds: Benchmarking Your Process

Document Retention Policies and Litigation Holds: Benchmarking Your Process Steven Schoenfeld, Esq. Trial Partner, Dorsey & Whitney LLP 51 West 52nd Street New York, NY 10019-6119 (212) 415-9341 schoenfeld.steven@dorsey.com www.dorsey.com Melissa Lorenzo-Hervé (Moderator) Editor, Practical Law Company 747 Third Avenue New York, NY 10077 (646) 562-3488 Melissa.Lorenzo-Herve@practicallaw.com www.practicallaw.com November 15, 2011 1

SYLLOGOMANIA OR DISPOSOPHOBIA Compulsive hoarding or retention of unnecessary stuff. Person who engages in such hoarding is commonly called a pack rat. 2

PACK RAT 3

NEATNIK Noun One who is habitually neat and orderly. 4

Agenda creating and updating a document retention policy A records retention policy is typically comprised of a schedule setting forth the length of time documents must be retained, a framework for implementing that schedule, and a statement of the company s policy on retention. implementing a policy issuing litigation holds dealing with the implications of cloud computing 5

Creating and Updating A Policy: Core Elements Statement of Policy Example: It is the Company s policy to maintain complete, accurate, and high-quality records. Records are to be retained for the period of their immediate use, unless longer retention is required for historical reference, to comply with contractual, legal, or regulatory requirements, or for other business reasons. Records that have satisfied their required retention periods shall be destroyed in an appropriate manner. Scope of Policy Employees, business units, departments, geographies. 6

Core Elements, cont d. Responsibility for Oversight and Destruction Framework for Implementation Address storage, destruction Definitions Example: duplicates, transitory documents, drafts, critical records Schedule of Categories of Records and Retention Periods Litigation Hold Procedure 7

Considerations Reasonableness scope, purpose, application Legal compliance Preservation and production Individualized tailor for your company 8

Drafting and Updating A Policy To create or update a document retention policy it is necessary to answer these questions: What records are the business records? Who controls those records? Where are the records located and how stored? What are the reasonably anticipated litigation or enforcement actions? When are records needed and when are records obsolete so they can be destroyed? 9

Identify The Records To develop a sound policy, one of the first steps is to identify the records that are regularly created and received by the company. A complete records inventory which identifies the records, their location, and the format in which they are maintained is the basis from which the records retention schedule is created. Records should then be grouped into categories that are named using terms that are commonly understood by the employees. Significant involvement from employees throughout the company is required. Individualization allows a company to describe record categories in an understandable way. Facilitates employee comprehension and implementation. 10

Categories Of Records Detailed and narrowly defined categories. More tailored and requires greater attention to detail, but can create confusion when records appear to fit within multiple categories. Increased complexity increases risk of non-compliance. Broadly defined categories. Easy to implement but will likely lead to retention of records longer than what is needed or required. Strive for acceptable balance of risk/cost. 11

Determine Appropriate Retention Periods Determining the appropriate length of time the company must retain documents requires consideration of several different factors. There is not a one-size-fits-all schedule. Key Considerations: Business Needs and Historical Significance Contractual obligations, warranty obligations, customer promises Legal and regulatory requirements of the industry May vary by jurisdiction. In these cases, consider applying the longest applicable legally required period. The Guide to Record Retention Requirements in the Code of Federal Regulations, published by the Office of the Federal Register, National Archives and Record Administration, is a helpful resource on federally mandated retention requirements. Most records have no legally required retention period. 12

Key Considerations, cont d. Industry requirements or prevailing industry standards Reasonableness may be judged by standard adopted by others in your industry. Many industries have provided guidance, such as the Association of Records Managers and Administrators (ARMA), American National Standards Institute (ANSI), and the International Organization for Standardization (ISO). Other legal considerations Company s litigation history and anticipated litigation risks. Continued costs and risks of retaining records beyond what is required and useful Storage Litigation and search 13

Retention Periods and Litigation Applicable statutory limitations periods may influence retention periods. Examples include: Contracts In the U.S., the period of time during which a contract dispute may be brought varies from 3 to 20 years, typically running from the date of breach, with the average being 6 years. Because most disputes are brought during the life of the contract or shortly thereafter, many companies opt to follow the average limitations period, as opposed to the longest. Personal Injury These claims often arise in negligence, and the period of time for bringing these claims ranges from 1 to 10 years, with the average being 3 years. 14

Finance Records and Tax Documentation Sarbanes-Oxley Act of 2002 ( SOX ) - Contains several provisions pertaining to records retention and document destruction. One of the most important provisions has very narrow application: retention of audit records of public accounting firms. SOX requires 7-year retention for audit work papers and other information related to any audit report to support report conclusions. Although SOX is narrow in application, some assert it creates implied requirement of 7-year retention of financial, accounting, or other records required to demonstrate compliance with it. Tax documents - Typically retained for a 7-year period; however, financial statements, books of account, summary financial records, and some others are often retained for much longer periods, sometimes permanently for business and other reasons. 15

Documents Retained For Longer Periods Product design and development records depending on the product, its life on the market, and potential litigation, permanent retention of certain documents may be appropriate. Environmental records where a company owns environmentally sensitive properties, records showing status are retained permanently. Employee health and safety records where employees are exposed to hazardous substances or where long-term health effects may result from conditions of employment, OSHA mandates certain retention periods. For example, the following must be retained for at least 30 years: exposure records, employee medical records, material safety data sheets and related documents Records that document certain exposures must be retained for 40 years or the duration of employment plus 20 years, whichever period is longer. Conversely, companies that are not obligated to comply with OSHA typically retain safety records for 5 years. 16

Define Retention Periods Clearly Retention periods should be clearly set as a fixed period of time that runs from a readily determined date. If periods are vague, or the date from which the retention period runs is poorly defined, employees will resort to varying interpretations, resulting in inconsistent application. 17

Additional Considerations A good policy should address the full life cycle of a record, including record creation, active maintenance, archiving, and destruction. It should also account for every format of record, expressly addressing the variety of mediums employees use to work and communicate. It should consider how inactive records will be stored to ensure that records are stored in a manner that is organized and allows timely access, while still being cost-effective. Where appropriate, the policy should address privacy obligations and measures to protect privacy of information subject to laws governing confidentiality (examples: medical records, financial records, confidential and proprietary company information). 18

Where Are The Records, Especially Electronic Records? Computers Servers PDAs Laptops Portable storage devices, floppy disks, USB sticks, and CDs Backup tapes Access control systems Home computers Twitter, Facebook, LinkedIn In the cloud (discussed later) 19

Volume Of E-Records Can Be Daunting In 2010: Approximately 294 billion e-mails are sent on a typical day. That is 2.8 million messages sent per second. In 2011: It is estimated the average business e-mail account sends and receives 105 e-mails per day. Approximately 20% of these are not business-related. http://www.dynamicbusiness.com.au/blogs/how-much-do-youknow-about-email-192011.html 20

General Retention Rules For E-Mails Many companies retain more e-mails than necessary to meet legal or business requirements The more that is retained, the more that has to be searched. If it does not fit in a retention policy category, get rid of it. Employees are responsible to file electronically or print and file any e-mail that should be retained pursuant to the company policy (e.g., an e-mail that constitutes part of a contract). Otherwise all e-mails in an employee s Outlook Inbox, Sent Items, and Deleted Items folders should be purged on a fixed period timetable (for example, every 60 to 120 days). 21

Consider Storage Options Search and Retrieval Capability Courts are not usually sympathetic to companies that claim they are unable to reasonably search, access, and/or retrieve electronically stored information, especially given current technology and technological capabilities. See, e.g., Toledo Fair Housing Cntr. v. Nationwide Mut. Ins. Co., 703 N.E.2d 340 (Ohio 1996) (the defendant is not entitled to frustrate discovery of relevant material because the method it has chosen to store documents makes it burdensome to retrieve them ). See, e.g., In re Brand Name Prescription Drugs Antitrust Litig., 1995 U.S. Dist. LEXIS 8281 (E.D. Ill. 1995) (concluding that the defendant should be required to pay for e- mail retrieval program because it would be unfair to the cost of the defendant s choice of an inferior electronic storage media on the plaintiff). This is an important consideration in selecting storage media options. 22

Implementing A Policy: Priority and Buy-In Good records management must become part of the company s culture, much like anti-discrimination policies. Need buy-in and promotion from the top of the company. An in-house lawyer drafting a policy for the file serves no purpose. 23

Implementing A Policy, cont d. Employee education and training covers: overall records management practices, including record creation understanding importance and consequences how to apply retention schedules retention, storage, and destruction litigation holds Employee education Employee acknowledgment of receipt and understanding of policy 24

Implementing A Policy, cont d. Designate responsibility to specific employees at business units Maintain accurate indexes Consider technology tools to assist with implementation Regular review of policy and schedule, and update Regular compliance audits On-going employee training/education Accountability (for example, make it part of employee performance evaluation) MUST involve IT 25

Implementing A Policy: Consistency Courts will hold your company to the terms of your policy. Adopting a policy and ignoring it may be worse than no policy at all. Ignoring a policy could be used as evidence of intentional destruction in the face of litigation or investigation. Consistent implementation means regular records destruction pursuant to the policy s retention schedule subject to litigation holds. 26

Implementing A Policy: Destroying Records Documenting Destruction. Consider a written internal approval procedure before destruction. Ensure that records subject to a legal hold are not destroyed inadvertently as part of an otherwise regularly scheduled disposition. Retain a record of the destruction steps and reasons for destruction as evidence of good faith. Rotating Back-up Tapes and Other Routine Destruction of E-Data. Sanctions safe harbor for routine, good faith operation of electronic information systems before duty to preserve. (FRCP 37(e)) 27

Implementing A Policy: Destroying Records, cont d. Privacy/Confidentiality. Make sure disposition protects privacy required by law, and the company s confidential and proprietary information. Examples: HIPAA, Gramm-Leach-Bliley Deleting Is Not Enough. Make sure that when a record is destroyed it is fully destroyed. Address problem of multiple copies. Deleting e-files often does not result in an actual deletion. Rather, the file is removed from the directory and the space is designated to be overwritten, which may not immediately occur. Some options may be hard drive shredding, degaussing, and scrubbing. Deleting from a cloud platform may not delete all copies; the documents may exist on cloud back-ups. 28

Litigation Holds-Duty To Preserve in the name of justice! (With due respect to Diana Ross and The Supremes) 29

A Lesson In Failure: Arthur Andersen LLP (RIP) 30

When To Implement Hold: Triggers For The Duty To Preserve The duty to preserve material evidence arises... when a party reasonably should know that the evidence may be relevant to anticipated litigation. Examples: Receiving a plaintiff s demand letter. Oxford House, Inc. v. City of Topeka, 2007 WL 1246200 (D. Kan. 2007). Employer scheduled a meeting to discuss allegations of sexual harassment 9 months before suit filed. Doe v. Norwalk Cmty. Coll., 248 F.R.D. 372 (D. Conn. 2007). Employer should have known at the latest when employee filed EEOC charge, but the duty to preserve arose 5 months earlier based on e mails showing employer knew plaintiff planned to sue. Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212 (S.D.N.Y. 2003). Employer received a bankruptcy court order referencing alleged fraudulent scheme. E*Trade Secs., LLC v. Deutsche Bank AG, 230 F.R.D. 582 (D. Minn. 2009). 31

Super Triggers Document Request Subpoena Court Order Super triggers make it necessary to update any prior litigation hold notice and follow up to ensure compliance. 32

Policy Should Direct Trigger Information To Responsible Corporate Person Policy should establish procedures for employees to report to a responsible decision-maker any information relating to potential litigation. Policy should require reporting to legal department. Procedures should establish reasonableness and good faith in meeting duty to preserve. Train employees on when to raise matters with legal department. Complaints, subpoenas, etc. should automatically go to legal department. Legal department can then investigate and evaluate necessity of a hold. 33

Scope Of Litigation Hold A company must preserve all information that it reasonably believes is relevant to anticipated litigation. Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998). This includes all documents or electronically stored information in the possession, custody, or control of the company. FRCP 34(a). A company must suspend its customary deletion of data that is relevant, including back-up tapes that may contain relevant information. A company is not required to preserve every document or e-mail, but only those that a company determines may be relevant to pending or threatened litigation. Consider the following In determining the scope of information that should be preserved: The nature of the issues raised in the matter. Experience in similar circumstances. The amount in controversy. 34

How To Implement: The Litigation Hold Notice Maintain a litigation hold notice template ready to be tailored to the specific circumstances. An effective litigation hold notice: identifies the persons who are likely to have relevant information, communicates a preservation notice to those persons and asks them to identify any other people likely to have relevant information who are not on the distribution list; communicates the preservation notice in a manner that ensures the recipients will receive actual, comprehensible and effective notice of the requirement to preserve information; is in writing; uses plain English to define what information is to be preserved and how the preservation is to be undertaken; and is sent from someone with authority to ensure employee attention and compliance. 35

The Litigation Hold Notice, cont d. Follow up on the notice by: confirming receipt of hold notice (request signed acknowledgments) making sure it is understood, especially by IT ensuring central control of data (IT responsibility) confirming compliance (such as by interviewing custodians) Review the hold notice periodically and, when necessary, re-issue it in either its original or an amended or updated form. 36

Litigation Hold Notice Document The Process To Show Compliance The legal hold policy and process of implementing the legal hold in a specific case should be documented because both the policy and the process may be subject to scrutiny by the opposing party and review by a court. Document, Document, Document! Create a litigation hold file that includes: Documentation of triggering event and decision to implement the litigation hold. Copy of the litigation hold notice. Document confirmation of receipt and compliance from each recipient of the litigation hold. Letter to opposing counsel regarding preservation steps taken under certain circumstances. Copies of re-issued litigation hold notice and documentation of ongoing compliance. Copy of document retention policy. 37

Litigation Holds Help From Technology Preservation tools for e-mail, electronic files, social media Automated legal hold software Data-mapping software 38

Consequences Of Failure To Hold - Not Good Duke Law Journal Review article: Approximately 50% of 401 cases from 1970s through 2009 involved sanctions. Sanctions imposed have included adverse jury instructions, significant monetary awards and even dismissals. Sanctions applied despite the safe harbor provisions of Rule 37(e) of the Federal Rules of Civil Procedure. The study also found that defendants are sanctioned almost three times as often as plaintiffs in a lawsuit (175 to 53). The most common type of misconduct to receive a sanction was failing to preserve relevant information (sanctions were granted in 90 cases). Multiple types of misconduct led to the sanctions. Other types of misconduct included a failure to produce information and delays in producing the information. 39

More On Sanctions Consequences According to Ken Withers of The Sedona Conference: Courts are imposing sanctions with increasing regularity. The majority of sanctions involve preservation issues. December Kroll OnTrack analysis of significant cases January October 2010 found: 39% of cases addressed sanctions 49% of sanctions involved preservation and spoliation issues. 24% of sanctions involved withholding discovery and other abuses. 27% of sanctions involved production disputes. 40

Sanction Consequences Plaintiffs Fail To Preserve - - For example, Pension Committee of the University of Montreal Pension Plan v. Banc of America Securities, LLC, 685 F. Supp. 2d 456 (S.D.N.Y. 2010) (a.k.a. Zubulake Revisited: Six Years Later ), decided by Judge Shira A. Scheindlin. Securities fraud case involving 96 investors seeking to recover losses related to the liquidation of two hedge funds. Defendants moved for sanctions against several plaintiffs for failures to properly preserve and produce relevant information. This case does not present any egregious examples of litigants purposefully destroying evidence. This is a case where plaintiffs failed to timely institute written litigation holds and engaged in careless and indifferent collection efforts after the duty to preserve arose. As a result, there can be little doubt that some documents were lost or destroyed. 41

Pension Committee, cont d. [T]he failure to issue a written litigation hold constitutes gross negligence because that failure is likely to result in the destruction of relevant information. With respect to collection and review: Gross negligence or willfulness will be found where a party fails to collect records from key players and where e-mail or certain back-up tapes are destroyed after the duty to preserve has attached. It may also be found where a party fails to collect information from the files of former employees that remain in a party's possession, custody, or control after the duty to preserve has attached. Negligence may be found where a party fails to obtain records from all those employees who had any involvement with the issues raised in the litigation or anticipated litigation (as opposed to just the key players). Negligence may also be found where a party fails to take all appropriate measures to preserve ESI (electronically stored information), or where a party fails to appropriately assess the accuracy and validity of selected search terms. 42

Pension Committee, cont d. Relevance and prejudice may be presumed when the spoliating party acted in bad faith or in a grossly negligent manner. Outcome: The court catalogued the conduct of the spoliating plaintiffs and applied the principles discussed in the opinion to craft appropriate sanctions. In the end, the court found a number of the plaintiffs were grossly negligent for some or all of the following conduct:. Initial searches that were severely deficient. Failing to institute timely written litigation holds. Failing to collect or preserve any electronic documents prior to 2007. Continuing to delete electronic documents after the duty to preserve arose. Failing to request documents from key players. Delegating search efforts. Destroying back-up data that was potentially the only source of key player data. Submitting misleading or inaccurate declarations. Sanction: rebuttable adverse inference instruction for grossly negligent plaintiffs, and monetary sanction for grossly negligent and negligent plaintiffs. 43

Third-Party Data Storage and Management: Cloud Computing Data and software platforms and services, including for e-mail, word processing, and spreadsheets, are stored offsite in the cloud. No need to install software on each employee s desktop computer. Services are provided over the Internet. But this has implications for document retention policies, litigation holds and related e-discovery 44

Cloud Separates Possession and Control FRCP 34(a)(1): produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party s possession, custody, or control. Company that maintains data on its own servers has possession and control of data. But with the cloud: the cloud customer may have contractual control and ownership of data; and the cloud service provider has actual control and possession. 45

Cloud Service Contract Considerations to Ensure Compliance with Document Retention Policy and Related Obligations State explicitly in the contract data ownership and control among the parties. Can the cloud solution implement records disposition schedules, including the ability to transfer and permanently delete records? What is the retention for e-mail in the cloud system? Do users have the ability to save e-mail to locations outside of the cloud repository? Does the customer or the provider control retention and destruction decisions? For example, can specific e-mails be flagged for records retention purposes and assigned a retention period? How is data backed up? How long is e-mail data kept on back-up media? How is your data segregated from data of other organizations, both in the live environment and on back-up media? In the event you move to another provider, or your provider goes out of business, what are your options for getting your data out of the cloud (and off back-up media)? 46

Cloud Service Contract Considerations to Ensure Compliance with Document Retention Policy and Related Obligations, cont d. How is a litigation hold implemented with respect to data in the cloud? What is the protocol for coordinating implementation between provider and customer? How are responsibilities divided? How are holds enforced and data preserved? Can deleted and draft items be put on a litigation hold? Are newly created messages automatically added to an existing litigation hold or do you need to manually intervene to ensure ongoing compliance with a hold? How can you release items in the cloud from a hold? 47

Cloud Service Contract Considerations to Ensure Compliance with Document Retention Policy and Related Obligations, cont d. In what jurisdiction is data located? Is e-mail stored on a server in a foreign country subject to the data privacy and other laws of that country in the event of e-discovery? In what jurisdictions can the cloud provider be subpoenaed for your data? What is the cloud provider s subpoena policy? Do they automatically provide the data? Are you notified with sufficient time to object and assert your rights? 48

Cloud Service Contract Considerations: Think About E- Discovery Cloud provider agreement should contemplate everything involved with e-discovery including retrieval, search, and review: How is information searched for and retrieved pursuant to e-discovery requirements? For example, in creating e-discovery searches, can Boolean (And, Or, and Not) and proximity searches (e.g., find Schoenfeld w/2 Dorsey) be used? How is metadata protected? How and in what format are e-mails and attachments exported? Are attachment relationships maintained? Is it possible to review e-mails for an investigation without having to export them for review outside of the e-mail platform? In addition to flagging for litigation hold, can you flag items for other reasons, such as potential privilege? What are the protocols for communication and data transfer between litigating attorneys and service provider personnel, pricing, etc.? 49

Questions 50

Risks and Reasons for Failure Insufficient resources are devoted to the policy. Employee and management responsibilities are not clearly defined. Lack of training. Lack of regular follow-up. Intentional destruction of documents. Failure to implement a litigation hold. Not storing records in an organized manner. Not identifying critical documents. Violating laws on records retention. 51

Closing Thoughts: A Record Retention Policy Is Worth the Time and Costs A thoughtfully developed, comprehensive record retention policy that is consistently implemented and enforced is a must for every business. The time and money that is spent creating, implementing, and enforcing a policy will be saved in the long run through: Reducing storage costs, Saving administrative time and expenses by not having to sort through voluminous records in response to a subpoena, Ensuring critical business records are saved and available in the event of disaster, Providing protection from claims of spoliation, and Being able to defend and bring litigation. Having and following a legally sound record retention policy is a company best practice that should not be ignored. 52

About Us Steven R. Schoenfeld, Esq. Steve is a Trial Partner in the New York Office of Dorsey & Whitney LLP. He has been practicing for more than 20 years, and handles a wide variety of civil litigation for his clients, including commercial, intellectual property and bankruptcy litigation. Steve regularly speaks to in-house counsel and bar groups regarding managing litigation. His full biography is on the Dorsey web site. Melissa Lorenzo-Hervé, Esq. Melissa is an editor for PLC s Law Department web service, writing on litigation and ADR issues. She was formerly legal editor at Fortent, a compliance information management company. Previously, Melissa was an associate in the M&A group at Troutman Sanders LLP and before that was an associate in the corporate and litigation groups at Hughes Hubbard & Reed LLP. Dorsey & Whitney LLP is committed to understanding our clients businesses, to client service, and to our clients success, Dorsey is a go-to law firm for businesses large and small. Our partnership began in 1912 to meet the needs of a prominent Minneapolis business, and we have become an international firm since then. But our focus on client service hasn't changed. Each day, from 19 offices in the United States, Canada, Europe, and Asia, more than 650 Dorsey attorneys and 700 support staff - including paralegals, information technology professionals, case-management specialists and more - team with clients to create solutions built on service, collaboration and a determination to succeed. To learn more, visit www.dorsey.com. Practical Law Company provides practical legal know-how for law firms, law departments and law schools. PLC s online resources help lawyers practice more efficiently, get up to speed quickly and spend more time on strategic work rather than reinventing the wheel. To learn more, visit www.practicallaw.com. 53

Steven Schoenfeld, Esq. Trial Partner, Dorsey & Whitney LLP 51 West 52nd Street New York, NY 10019-6119 (212) 415-9341 schoenfeld.steven@dorsey.com www.dorsey.com Melissa Lorenzo-Herve (Moderator) Editor, Practical Law Company 747 Third Avenue New York, NY 10077 (646) 562-3488 Melissa.Lorenzo-Herve@practicallaw.com www.practicallaw.com November 15, 2011 54