In this new year, eDiscovery is fast becoming a headache for organisations as volumes of data balloon out of control. Email is a key culprit. People rely on email as their main method of communication so not only is there is a lot of it, but it also means that email is likely to form a central component in any form of dispute.
So what is eDiscovery?
eDiscovery or electronic discovery, refers to the process of collecting and processing electronic material for use in civil or criminal litigation. Collection can be as simple as finding a CD with the right data on it or a much more complex processing of forensically acquiring data from a company’s entire network. The primary function of eDiscovery is to organise data to ensure that the litigation review process runs accurately and efficiently.
An eDiscovery process needs to manage the identification, collection, preservation, processing, analysis, review and production of electronic documents to support litigation, corporate and regulatory actions.
This puts a degree of pressure on the organisation’s shoulders to come up with an eDiscovery framework that manages its responsibility to retain and retrieve relevant emails upon request, and in a timely manner.
The requirement to retrieve information and communications from your email archives is likely to occur in two main situations:
- In response to an audit of your regulatory compliance obligations
- During a legal dispute
Organisations must prove that they are not attempting to hide, destroy, or falsify emails. If this transparency is in question, there are very serious repercussions.
For example, Washington Examiner reported that Lisa Jackson, now former head of the Environmental Protection Agency in Obama’s administration, was found to be using an email account using a government-approved pseudonym which was set to delete emails after 90 days.
This discovery “sparked trench warfare among Jackson’s EPA, a federal court, at least two committees in Congress, Horner [who discovered the account] and the CEI over thousands of other internal emails and documents likely to shed additional light on the illegalities going on at the environmental agency.”
Whilst this isn’t the US, in Australia, by law, companies are required to retain and be able to retrieve records for compliance in the following areas:
- Privacy act
- Corporations act
- Employment legislation
- Tax – requires 7 years of accurate records
- Australian standards + APRA guidelines
Failure to provide evidence of compliance can result in prosecution of both individuals and companies. In Australia, penalties can be up to $330,000 for companies, or up to $60,000 and 5 years imprisonment for individuals (which includes the board of directors).
Additionally, during a legal dispute, you can be required by a judge to provide all communications between two parties between a specified timeframe with very little notice. Failure to comply has serious implications, not least of which is that you severely limit your chances of winning the case.
Legal discovery can hit an organisation at any time, requiring instant attention. Legal discovery can be about a range of potential issues, from discrimination in the workplace to contract and IP disputes to name a few. These requests can incur a huge workload for organisations if they are unprepared. Clearly, there is a direct relationship between large volumes of electronically stored information (ESI) and the costs of an eDiscovery request.
Returning to the Jackson case, Human Events reported that the Justice Department has agreed to disclose 12,000 of Jackson’s secret emails that included one of the four key words; “coal”, “climate”, “endanger” and “MACT”. This means that their email archive needs a quick search and retrieval capability (especially if they are dealing with troublesome PST files!). Without the appropriate email archiving solution, sifting through a large amount of data is not only costly but a huge burden on the organisation.
Email Archiving Solutions
The proliferation of “big data” means companies are having to get organised. The goal is for the business to archive all emails, and to have a search capability to quickly sort through their data to find the relevant communications. As you probably guessed, this isn’t always the case.
Here are a few ways of ‘planning for the worst’. Some methods are clearly much more efficient than others, but there are a number of options.
Manually saving and labeling important emails
This approach is commonly adopted by small businesses. If this is the approach you use, you need to:
- Attempt to predict which emails will be important in the future
- Educate your employees on which email types are important and manually label and store those emails
- Acknowledge that this approach is highly subject to human error
- Be aware that you will have to manually search through data in the event of an eDiscovery request
- Be prepared to spend a long time doing this at very short notice
Backing up all your emails on premise
Although this method prepares you somewhat for legal discovery, the major challenge organisations face is in data retrieval. The proliferation of email means that without an effective search tool, you will have a very long and labor intensive search process. If this is the method you are using you need to:
- Be prepared to manually sort through a lot of duplicates and disorganized data
- Have the resources available for a long, labour intensive search process
- Consider involving a lawyer to help decipher what is relevant.
- Be prepared to finance the cost of hiring a lawyer
- Buy and host a large storage device, and then more storage devices when those are full
Email archiving solutions require investment, however, when compared to the costs and benefits of other options this starts to look like an attractive option. With email archiving solutions, you can choose to have offsite backup storage, (eliminating the cost and space issues of backing up emails in your office).
In the event of legal discovery, you can access all emails and effectively search for relevant emails using specific search requests, eliminating the need to manually sort through duplicates, unorganised and unnecessary data.