EDiscovery

It would seem that e-discovery maturity hasn't changed all that much in a year. Exterro and EDRM released their 2020 E-discovery Maturity Analysis in March, and the findings indicate that despite the implementation of new privacy regulations such as the California Consumer Privacy Act (CCPA), many companies are still tailoring an information governance or e-discovery posture that is proportional to their individual risk of litigation.

Whereas the 2019 survey collected responses from 218 organizations across various industries, the 2020 analysis broadened that scope to 632 respondents from companies with between 200 and more than 10,000 employees. Even with a larger sample size in the mix, most organizations surveyed operate at a level the Maturity Analysis designates as "fair"—meaning that standardized e-discovery processes are in place, but not enforced.

For comparison. the lower end of the performance spectrum of "very poor" for organizations that are reactive with no e-discovery process in place. The upper echelon of "excellent" is reserved for organizations that are proactive with an actively managed process in place. So why are most of the organizations surveyed winding up in the middle road?

Michael Hamilton, director of marketing for Exterro, believes many organizations likely base the sophistication of their e-discovery programs on the severity of their litigation needs. "What we see is a correlation between the more litigious industries. [They] seem to have a more mature e-discovery process just because they have a higher frequency of litigation, which means the more they can standardize their processes, the more efficient they can be," he said.

Competition for the most litigious industry may have grown steeper this year. The 2019 analysis designated the pharmaceutical and finance sectors as the two industries with the most e-discovery maturity, but the spike in respondents seen by the 2020 report likely shifted those rankings. Per the 2020 report, telecommunications, pharmaceuticals and healthcare are the top three most mature industries, while aerospace, real estate and education made up the bottom of the list.

Just how that maturity—or lack thereof—is playing out a granular level within an organization's e-discovery process may have a lot to do with how it collects or retains data. For example, the Maturity Analysis shows that 73% of companies with less than 1,000 employees have a set process for collecting data from social media. This stands in contrast to the 81% of organizations with 1,001 to 10,000 employees or 84% of organizations with 10,000 or more employees who have a social media collection  plan.

It's possible that smaller companies operating on equally modest budgets may be more reluctant to spend money on the tech required to extract social media data. "Social and instant messaging data is expensive, right? And you have to the right tools in place to do it effectively," Hamilton said.

By contrast, only 78% of organizations with more than 10,000 employees had a process to deal with bring-your-own-device (BYOD), or personal devices their workers brought from home. Companies with less than 1,001 to 10,000 employees seemed a little more prepared for that reality, with 85% having a process in place.

However, it's possible that bigger organizations are circumnavigating the problem of BYOD altogether with other countermeasures, such as portals that limit the access mobile devices have to certain information or apps that employees have to use in order to send messages or emails. "I think that could be a reason, that [bigger companies] have a more robust security infrastructure when it comes to mobile devices," Hamilton said.

Still, even industries with a high degree of e-discovery maturity still seem to be lagging behind when it comes to training, which is consistent with the findings of last year's analysis as well. The pharmaceuticals industry, for example, scored a 3.81 out of 5 rating for overall e-discovery maturity, but only a 1.64 in training. Hamilton pointed out it may not be cost effective for organizations to provide employees with training if they already have designated staff like a director of e-discovery on hand.

"Maybe training isn't as vital to those people because you don't need someone to wear multiple hats," Hamilton said.