Information governance is evolving: making organizations eDiscovery ready
E-discovery issues have come into greater focus due to the fast growth of new communication apps such as Slack, G-Suite, and Facebook Workplace, which employees often download without any IT support. These and other DIY technologies are causing problems for organizations that are required to preserve all such communications for discovery.
Email is just one piece of an intricate puzzle, as employees increasingly conduct business via smartphones and office collaboration apps, with information residing on disparate networks. The discovery of social and mobile communications is becoming commonplace, and companies need a formal strategy to ensure they are ready to comply with information requests.
Businesses have a duty to preserve records. While this is not a new requirement, the scope of what is included in “records” has grown and changed dramatically in the past 20 years, and continues to do so. Case law has stipulated that records include all electronic communications — chats, social media, photos, calendars, contacts, voice files, and more. Courts have held that text messages are Electronically Stored Information (“ESI”) and subject to the same discovery standards as emails, documents, contracts, etc.
In recent cases, courts ordered the production of texts and imposed sanctions for failing to comply with discoverable requests. In a federal copyright case involving recording artist and producer Jay-Z, Walker v. Carter, the court affirmed a sanction against the plaintiff and his counsel for refusing to produce text messages over a period of eight months. The plaintiff was even ordered to pay the defendant’s attorney’s fees for the costs incurred in compiling the text messages.
Likewise, regulatory agencies have ramped up enforcement for violations related to failure to maintain and enforce supervisory systems intended to ensure that communications are monitored and captured. Regulators have recently levied substantial penalties against several individuals and firms for failing to establish, enforce, or comply with recordkeeping governing client-broker communications.
Mind the chain of custody
Information governance and legal professionals must be aware of and prepared for evolving issues related to the digital landscape. I recommend that companies create a process to account for new channels and the discovery protocol. It’s critical that organizations maintain a clear, documented chain of custody, just as they would for any other physical evidence.
From the moment evidence is obtained, a trail must document the process of how it has been handled and by whom, including capture, search, and production. Given the volume and growth rate of data involved, it is virtually impossible to do this manually. Partner with a vendor that has the technology capabilities to automatically capture and archive all the workplace communications in real-time. A compromised chain of custody can undo a legal proceeding and waste years of investigation.
Robust policies should identify those responsible for reviews, describe the review process, document the timing and frequency, and outline how the process will be documented in order to prove compliance. Policies and procedures should provide escalation instructions and account for internal conflicts of interest. They should be updated to reflect changes to regulations, best practices, supervision, and technology. Provide employees with complete and regular training about procedures and approved communication channels.
Keep your eyes wide open
Prepare your compliance and discovery process for new communication channels and ensure you know which channels employees are actually using to communicate. Are they using Slack to communicate at work? LinkedIn? Identify all channels in use by all employees. If you have a global organization, make sure to include all of the apps used and digital content produced in every geographic location.
Be aware of the application-specific risks involved, and stay up-to-date as cyber threats and app features change frequently. For instance, apps like Snapchat, Wickr, Vaporstream and Telegram are designed to instantly and permanently delete messages. Facebook Messenger recently added support for an opt-in ephemeral messaging feature called Secret Messages.
Ephemeral messaging is the mobile-to-mobile transmission of multimedia messages that automatically disappear from the recipient's screen after the message has been viewed. The word "ephemeral" describes something that only lasts for a short period of time — useful in many cases, but antithetical to e-discovery requirements. However, ephemeral messaging raises questions for organizations because companies at risk of litigation cannot preserve the data.
Messages that are automatically deleted from devices must still be preserved in light of a litigation hold, and failure to stop automatic deletion of messages is sanctionable. IT, legal, and compliance teams must identify alternative technologies that create more manageable levels of risk and offer them to users in place of blacklisted apps or shadow IT practices.
Make it an enterprise effort
Cross-functional collaboration is more important than ever. Legal, compliance, and IT teams must all work together to enforce policies and evaluate new communication tools. Training and ongoing education are critical for effective oversight. Provide focused training on accepted and prohibited communications channels. Your employees should know the consequences of using prohibited channels; following through with enforcement as outlined in relevant policy will emphasize the seriousness of noncompliance.
In the digital era, businesses of all kinds run on trust. Accountability is key to maintaining trusted relationships with partners, clients, and the public. Diligent supervision of electronic communications — tracking, managing, logging, and auditing — is central to fostering accountability, identifying risks early, and protecting your reputation.
Saying “no” to every new app or communication channel won’t work. The digital landscape continues to evolve rapidly, introducing better tools for collaboration that streamline workflows and boost productivity. Customers and clients will expect to be able to interact with vendors and advisors on their preferred platforms. Fortunately, e-discovery and archiving technology also continues to advance, making it much easier for companies to manage risks, stay compliant, and meet customer demands.