By Brian Schrader, Esq. and Barry Schwartz, Esq., CEDS
One of our most popular annual presentations is Risks and Responsibilities: The Ethics of Legal Holds, and we just joined with ACEDS to present our 2018 update, which can be viewed here.
The attendees asked some great questions on a variety of topics, and we thought we would share our answers to the top questions and concerns they raised, as we know most of our readers are probably asking many of the same questions and facing many of the same issues themselves.
1. Can you explain what triggers a legal hold?
A legal hold should be triggered when something happens that could lead to litigation, which can range from the obvious, like being served with a complaint, to the less obvious like product complaints that rise to a level where a reasonable person would anticipate a potential legal action. While there are no Federal Rules specifically stating when a legal hold must be issued, the common law standard going back decades has been that a legal hold obligation is triggered when litigation (or a similar legal event) is “reasonably anticipated.” See, e.g., Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998).
In the end, it is a question of objective reasonableness: Given a particular set of circumstances, should a reasonable person have anticipated that those circumstances would lead to a litigation or other legal event? For example, a single complaint about a rather mundane alleged product defect would usually not rise to the level of a triggering event, while dozens of similar complaints might. On the other hand, a single sexual harassment claim made to an HR representative is likely sufficient to trigger a litigation hold.
- Common triggering events include:
- Product complaints
- Product malfunctions
- Harassment complaints
- Other HHR issues
- IP infringement
- Claim letters
- Regulatory investigations
- And more
Unfortunately, this is one of those legal gray areas without a neat, bright line, so we often counsel our clients that, when in doubt, issue a hold. Issuing a legal hold is one of the cheapest things you will ever do in discovery, but it’s the single act that can have the most disastrous consequences if not done correctly. The costs of issuing a hold will be miniscule compared with the consequences of having been found to have not met your legal hold obligations.
2. How do you discuss preserve in place or collect to preserve with executive management?
When speaking with executive management, start by making absolutely certain that they fully understand the critical importance of legal holds, data preservation and data collections. They must understand that the process is a very serious legal obligation that, if not done properly, can spell disaster. Indeed, a company could lose a legal battle – even if entirely innocent – based on failing to fulfill their legal hold and preservation obligations. Once that’s established, it should be easier then to discuss the best methods for meeting those obligations.
In most instances, we recommend a collect to preserve approach over a preserve in place approach as the safer, more practical option. While preserve in place seems like the more economical approach, the simple reality is that it requires significant systems, software solutions, training and monitoring to be in place well before the need arises. And even then, it’s nearly impossible to truly control all your employees’ data.
What’s more, the cost savings of preserve in place are rather elusive in today’s much more commoditized eDiscovery marketplace. Data collections have always been one of the cheapest steps in eDiscovery, and now with remote collection options, collections should cost only a few hundred dollars per custodian.
In the end, like most discussions with management, it becomes one of return on investment (ROI), with the analysis being one both of costs and potential risks. A preserve in place strategy comes with often significant costs, from training to monitoring to new software systems and more, and always carries the risk of those systems or processes not performing as expected. A collect to preserve strategy can be developed and deployed quickly and economically, and generally ensures that data is truly preserved without any possibility of loss or alteration. And so, when compared, the ROI usually makes the choice clear in terms management understands.
For more information, check out our prior blog Creating a Bulletproof eDiscovery Process and our webinar Ensuring Executive Sponsorship for Legal Holds.
3. Do you have a legal hold form letter that you can share or examples of language to use?
Yes, we have a standard example of a legal hold letter that includes the basic pieces of information any legal hold should contain. In a clear and concise manner, it should state who the subject of the legal hold is, why the legal hold was issued, when the hold goes into effect (or really, the time period covered by the hold), what should be preserved, where it should be preserved and how it should be preserved.
The notice should also provide a contact person for answering any questions and avoid legalese like “heretofore” & “herewith,” as well as any legal analysis of the claims or management’s comments on the claims. You don’t want anything that confuses custodians or leaves them with the impression that the obligation is anything other than absolute.
Also, it’s not uncommon to have different notices for different groups of custodians. Depending on the industry or matter, some people may receive a broad notice, while some may have specific instructions as to what specific data are involved. It’s appropriate to have stratified legal hold notices depending on the audience and the recipients.
And all that’s not legal advice – it’s really just about how to effectively communicate with your custodians.
4. I work for a city government. Should the attorney’s office train city staff (e.g., different departments) on how to respond when our office issues a hold notice?
Absolutely. And that training can be either general to the entire organization or specific to groups as they first receive a legal hold notice. While such training is not a legal requirement per se, courts do expect that steps are taken to ensure that custodians are not only notified, but that they understand and acknowledge the notification and their own obligations. Establishing a training program is an excellent way to satisfy that requirement.
We’ve even seen a number of companies start to address this in their onboarding process. (This is also applicable in government employee onboarding as well.) Usually it’s a very brief training that simply tells employees what a legal hold process is, how the company notifies employees (and others) of a particular legal hold obligation and generally what is expected of an employee who receives a legal hold notice. It need not be complicated and usually takes as little as 10 minutes. But, by making it part of an onboarding process, it helps ensure that every employee understands at least the basics from day one – and prevents them from being shocked and worried the first time they get a legal hold notice.
And, if there’s ever any dispute as to whether a given employee properly met their obligations, showing that training process is in place will go an incredibly long way in showing the court that the organization took its obligations very seriously and proactively worked to meet those obligations.
5. Just to clarify, if you anticipate litigation and are about to purge documents due to the retention schedule, do you feel it is best to place a legal hold on those documents or would the retention schedule trump the hold?
The retention schedule never trumps a hold obligation. Indeed, several of the cases we’ve included involve companies who were sanctioned based largely for failing to suspect their purge process – both electronic and paper. If you anticipate litigation, you must issue a hold and address and suspend any impacted systems or processes that might result in data loss, regardless of any retention policies or other issues.
That said, if information was deleted because of an ongoing defensible data retention and purge process, and a legal hold obligation first arises later, after any purge has taken place, then there should be no exposure because there was no reason to retain that data at that time.
6. Do companies have an obligation to issue a hold and then preserve ESI contained on their employees' personal electronic devices, such as their smartphones, laptops and computers?
Generally speaking, yes, and your legal hold notice should make that clear – it’s about the data, not about where that data sits.
This is a rapidly evolving area of law that touches on personal privacy and many other issues, and there can be many factors in any given matter that can impact an organization’s responsibilities. And it’s not even really about just personal devices – the same standards generally apply to cloud storage solutions like Box, mobile apps like Evernote, and other solutions that your employees might use that could contain responsive information but that are not controlled by the organization.
The best place to start is with a formal corporate policy on the use for business purposes of personal devices or other solutions not provided by the organization. Often called “Bring Your Own Device” or BYOD policies, such policies generally outline the organization’s approach to what, if any, corporate data may be accessed or stored on personal devices or other non-corporate resources. Companies take approaches ranging from “absolutely nothing can be stored on your personal devices” to “do what you need to do.” In the end, companies must balance the benefits to their organization from the efficiency of employees being able to use their own devices and access any information they need when and where they need it, with the organization’s obligations in terms of data security, document retention, legal hold obligations and more. It’s not a simple or easy question.
That said, if personal devices are used in an official company capacity, then those devices – or more importantly the data stored on those devices – are subject to legal hold obligations, and a company must take steps to ensure, to the best of its ability, that preservation steps are taken, even though they don’t own or control the device. Even if there is a company policy in place to not use personal devices, the employee still could have done that. And be careful with the defense that such data isn’t in the company’s “possession, custody or control,” as most organizations’ policies make it clear that all company data is owned by the company – regardless of location.
Now, all that doesn’t mean that you automatically preserve data from every personal device whenever a legal hold is issued. There needs to be a reason why you think there is company data on a personal device. And the perfect solution to that is to include questions about personal device usage in a custodian questionnaire, as well as questions about any other applications, software, storage, online solutions, etc., that a custodian might use or access in their work activities. And even then, just because a personal device is used in a business capacity, it still may not be reason enough to collect the data. For example, if an employee accesses her business email account on her phone, that data is usually simply a duplicate of what is on her computer, and that data would not need to be collected twice.
In the end, this is a complex question with a lot of considerations. Start by issuing a comprehensive custodian questionnaire to help you determine whether and to what extent this issue may exist – and the more you find that it does, the more you should consider bringing in experts to assist.
7. Could a court impose sanctions if a legal hold document is not properly maintained?
Rarely, but yes, and generally only in extraordinary circumstances where other acts undermine the legal hold process. One prime example is the Plantronics case we cited in the webinar where the company took significant steps to not only issue and maintain the legal hold at issue, but also established special training sessions for custodians as well. But, because of bad acts by their most senior sales executive and the court’s opinion that the company didn’t do enough to address those bad acts, the company was still sanctioned millions of dollars (they went on to win the case, but still had to pay the sanctions).
So, while legal hold discussions often center on the notice document itself, organizations must not forget that the document only establishes the notice to custodians. It’s the first step in a process that must be dynamic to each case. In most cases, a standardized process is more than sufficient, but when extraordinary events occur like the bad actor in the Plantronics case, then extraordinary steps are generally required to address, contain and correct those issues.
8. Does this rule apply in civil courts, common law courts and even in criminal law courts?
Generally speaking, the obligation to preserve and protect evidence exists in any legal context, but the obligations and discussions in our webinar and related materials focus more on civil and common law courts.
9. Do firms usually have hold software to issue and manage holds for corporate clients? Or is that something corporate clients usually maintain?
Historically it’s been handled by the corporation; however, that is changing, as attorneys and law firms start to take a more proactive role in the legal hold process.
As this webinar makes clear, courts are now holding attorneys directly responsible for their client’s compliance with legal hold obligations, and clients are starting to sue attorneys for malpractice when their attorneys fail to do so. In response, we’ve had a number of our law firm clients license our TotalDiscovery solution directly themselves so that they can quickly and easily issue, monitor and maintain legal holds for clients without established solutions.
10. What do you recommend regarding frequency of reminders?
We typically recommend every 90 days. Depending on the matter at hand, you may only need to remind the custodians semi-annually or annually. But there is no harm in doing it too frequently. Plus, if custodians are involved in multiple matters, all of them can be listed in the email, with links to view more information on them.
11. Do you have a form custodian questionnaire you can share with us?
Yes. You can access our standard custodian questionnaire example here.
Thanks to all who joined us for our recent webinar. And if you missed it, you can check it out here. Stay tuned to our blog for more insights into eDiscovery, and look for our next webinar with ACEDS coming soon!