For years, the e-discovery industry has discussed various strategies for bridging the gap between IT and legal for handling litigation and corporate investigations involving electronically stored information. Corporations have become increasingly savvy about proactively addressing the challenges that arise when legal and IT must collaborate for the collection, processing and analysis of electronic data. And while the process has become more efficient, the partnership between these two groups often begins and ends with the various e-discovery matters at hand, abandoning opportunities for strategic planning that could even further eliminate complexity and reduce cost.

Building an effective relationship between IT and legal can pay dividends over the course of e-discovery matters. Effective coordination between legal and IT seems simple, but often there are numerous misconceptions about how the other group operates. How long are backup tapes REALLY kept? Could IT systems inadvertently destroy data that needs to be kept? Is it necessary to use special tools when making copies of data for litigation? Who is responsible for storing all of the data for litigation? These are just a few of the questions that IT and legal need to coordinate on to effectively implement a litigation hold strategy.

To address issues like this, legal teams should consider the following six best practices for partnering with IT to ensure a legally defensible information management strategy that can be followed consistently across the entire organization.

Step 1: Make sure IT policies are followed

All too often, companies have stated policies regarding email retention but don't actually follow them. Typically, this arises from IT bending the rules to accommodate a request from an executive but it also frequently occurs when IT implements a technical policy without alerting legal. Regardless of the reason, having technical IT policies that differ from stated policies that legal has signed off on creates risk to the company and opens them up to discovery issues.

Step 2: Be ready to stop deletion processes

If your company has a policy that calls for regular and frequent deletion of data, make sure there is an easy way to stop the deletion quickly if a need to preserve arises. When an e-discovery request comes in, and there is an order to put certain data on legal hold, action must be taken very quickly to preserve anything that might be scheduled for automatic deletion. Even a lapse of one day can lead to significant data loss, which again, can cause problems in court.

Keeping the data in a single system is one way to mitigate risk. Some companies implement different email systems for different offices, departments, or functions. Others store litigation hold data separate from operational email systems. Needing to setup litigation holds across systems and offices can be cumbersome and can lead to unnecessary data loss. If you can't put all of the data in one system, there are safeguards you can implement to give your corporation the time necessary to implement effective holds.  

Step 3: Simplicity can go a long way

Companies that have very complex document retention policies end up confusing everyone, making it difficult to apply policies consistently. Typically, various records need to be preserved for differing amounts of time (ex. email may not be kept as long as contracts). To handle this, email should be separated from data repositories that need to be retained for a longer period of time. For example, email should not be the system of record for storing contracts—even though there may be significant discussion of the contract over email. Relevant documents should be migrated from email to a specific repository where effective retention periods can be implemented.

Technical solutions can help with the process of classifying different forms of data and storing them according to different policies. The more involved and complicated the policies are, the harder it is to deal with inherent complexities like those mentioned above.

Step 4: Make sure your policies are reasonable to an outsider

Any policy that calls for deleting data should be examined through the perspective of a judge for reasonableness. Policies are very helpful for justifying to the court why data isn't available. However, if the rule is unreasonable, the judge may not always accept the explanation.

For example, a company should reasonably have a different policy for the automatic deletion of the janitor's email versus that of the CEO. Furthermore, as mentioned above, policies need to take various types of documents into consideration. Retention records of transactions with partners and/or contracts are expected to be longer than the retention period for internal communication.

Step 5: Be aware of data duplication and policies that complicate e-discovery

Eliminating duplicative data reduces cost and risk to the organization. Take email as an example—if employees can store email on laptops and desktops, it may be necessary to collect from each of these devices. On the other hand, if all emails for the corporation are stored in one repository and are only accessed from the laptops and desktops, you may be able to implement your hold and collection from the single repository.

There is a recent trend towards a “bring your own device” (BYOD) work environment. BYOD policies shift the burden of purchasing devices to employees and let employees get the device they want. But they can also complicate e-discovery—think for example of how you might collect data from a device that will walk out the door when that employee leaves the corporation. Does IT have the ability to unlock password protected devices to get to relevant data that might be needed for litigation? If your retention policy was developed more than a few years ago, consider revising it to include processes and best practices for handling new BYOD challenges.  

Step 6: Appoint a third party auditor

A third party—who is technologically proficient—is critical for auditing the policies and interviewing IT and legal to determine if policies are being followed correctly. Attorneys may not always be able to identify spoliation issues or recognize potential gaps in the collection process simply by speaking with IT. A liaison that can understand IT nuances and the legal needs is best suited to do the internal legwork needed for simplifying the retention and deletion process across the board. An outside consultant can be useful in clarifying roles, providing best practices, and implementing a litigation strategy that IT understands and the legal department trusts.

And, the cost of hiring an outside consultant is usually far lower than dealing with sanctions later on.

The challenge of setting up reasonable, defensible, and clear policies can most effectively be addressed when there is strong collaboration between Legal and IT. Proactively addressing policies is far cheaper than reactively fixing e-discovery issues. It's never too late to start a dialogue about your company's policies or to get help from an outside expert.