Robust new data analytics have complicated company data maintenance policies. Increasingly powerful platforms now offer business decision makers in-depth, highly detailed insights into the factors that motivate customers and consumers. But businesses that want to use data analytics must often comply with data privacy rules regarding the retention and disclosure of certain kinds of personal information, known as Personally Identifiable Information (PII). At the same time, businesses need to also adhere to the clearer guidelines on corporate data preservation duties developed as part of e-discovery's emerging jurisprudence. Balancing these data-driven issues requires an understanding of the ever-evolving landscape of each competing concern.

Data analytics meets data privacy

Data analytics use captured data, statistics, algorithms and other mathematical tools to improve decision making. In analytics, data value increases with specificity. Every time data gets filtered, its analytic value diminishes. Thus, businesses that want to increase the reliability of the predictive conclusion reached by their analytics often seek to maintain and use as much data as possible.

Yet ethical and privacy considerations push against analytics' full capabilities. Governments and regulatory agencies have drafted a wide range of data privacy rules, regulations, laws, directives and frameworks in an effort to address the concerns data use creates. In the European Union, the EU Data Protection Directive (1995) and the Organization for Economic Co-operation and Development (OECD) Guidelines (1980) create one set of requirements to protect information that qualifies as PII. The Asian-Pacific Economic Cooperation (APEC) crafted the APEC Framework, a less well-defined set of guidelines for the protection and use of PII. The U.S. is a member of APEC and signed the APEC Framework.

Within the U.S., a variety of federal and state laws and regulations control business use of PII, often tied to a particular sector or industry. Examples include the Video Privacy Protection Act (VPPA) of 1988, the Cable Television Protection and Competition Act of 1992, the Fair Credit Reporting Act, the Children's Online Privacy Protection Act, and the Health Insurance Portability and Accountability Act (HIPAA). Additionally, the Stored Communications Act of 1986 defines privacy rights in data stored by third parties like cell phone companies and social media sites like Facebook and Twitter. There's also recently introduced but non-binding Federal Trade Commission recommendations on data privacy, pending federal data privacy legislation and individual state data privacy laws in all but four states. Each has sometimes differing rules and recommendations regarding the protection and disclosure of PII.

E-discovery and data privacy

In the last few years, e-discovery litigation has revealed a set of best practices that give guidance to businesses seeking to gain control of potentially discoverable electronically stored information (ESI). These practices—often led by corporate general counsel—call for the design and implementation of data retention policies that plan for the regular review and elimination of unnecessary data. Policies that allow too much data to accumulate may increase the cost of future, unanticipated litigation. Conversely, failure to retain enough data may lead to accusations of spoliation and all its attendant consequences.

Data privacy considerations can complicate data retention policies. Data privacy laws may impose retention limitations at odds with data holds and litigation needs. For example, the VPPA and similar state laws set limits on the amount of time data regarding video rentals may be retained. Other privacy laws explicitly limit the disclosure of PII that may otherwise qualify as relevant, discoverable ESI. Employee records containing privileged HIPPA information serve as an easy, but not singular example.

Adding data analytics into the mix requires a further risk-benefit assessment. Businesses may have to decide whether or not keeping data containing PII pushes the limits of best practices for e-discovery. They may also have to determine how to meet obligations to protect PII in legitimately retained data from prohibited disclosures in litigation.  

Putting it all together

Insights gained from e-discovery practice can help companies navigate the complicated intersection of privacy, litigation and ongoing needs for data analytics.  Suggested practices include:

• Creation of data privacy policies that comply with the standards of all potentially affected markets—including international ones.

• Early use of custodian interviews and other established e-discovery tools to identify data sources containing PII that data privacy laws protect.

• Adding PII to the list of private or privileged information to be discussed at Rule 26(f) Meet and Confers or covered by judicial protective orders. 

Data proliferation offers businesses both opportunities and challenges. Better technologies have created new ways to mine records for insights on critical business decisions and directions. At the same time, companies have learned that keeping unnecessary data can create unanticipated problems in litigation. By recognizing the multiple and competing issues involved, businesses can create a plan that lets them make the best use of their data and defend that use no matter the challenge that comes.