Collecting Evidence in Sequence
In the digital realm, an investigator must be careful lest her work run afoul of the myriad rules and laws that restrain her. She must be mindful of ethics, and laws on privacy, contract, property and trespass (e.g., a web site owner might post terms that forbid her from entering the site).
In e-discovery if her demands for records from another party are too onerous, the demand may be quashed. (See for example Mirbeau of Geneva Lake, LLC v. City of Lake Geneva.)
So what is a prudent, responsible investigator to do?
Rational Behavior is Preferred
The investigator can often strengthen her probes and requests by ensuring that she systematically develops and collects evidence in a sequential order, and that each step she takes is rationally based on evidence she already possesses. For instance, before an HR investigator peeks into an employee’s email records, the investigator is wise to document (1) that she has reason to suspect the employee’s records will contain something the investigator needs to see (such as harassing emails), and (2) the evidentiary basis for that suspicion.
Good records by the investigator will show that she gathered preliminary evidence and deliberated logically before she barged into another person’s records or property.
Canadian Privacy Case Demonstrates the Principle
By way of example, see the decision by the Office of the Privacy Commissioner of Canada (PIPEDA Case Summary #2009-019) involving an investigation by an employer into whether an employee had violated his employment contract. Somewhat like the laws of some European countries, privacy law in Canada (PIPEDA) generally restrains an employer from reading employee email stored on the employer’s computers.
However, in this case the Privacy Commissioner observed that PIPEDA provides that "an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province." The facts in this case showed that the employer conducted – and documented – a predicate investigation before it gazed into the employee’s emails. The Commissioner found that before accessing the emails, the employer possessed evidence showing that this employee was violating his employment agreement and that information about this violation would likely appear in the employee’s email records. Accordingly, the Commissioner concluded that the employer was justified when it decided to open the employee’s email records and the employer acted in compliance with PIPEDA.
Principle Applies to Many Kinds of Investigations
Just as an evidence-based style of investigation will help support an internal HR investigation, it will also help support e-discovery in litigation. Normally when a requesting litigant demands computer records, a court is reluctant to force the responding litigant to search through them because searching is expensive and disruptive. However, the court is more likely to require the search if the requester has a logical, evidence-based reason to believe that the cost of the search will be proportionate to the case at hand will likely reveal relevant information.
This principle of e-discovery places a burden on the requesting litigant. The litigant needs to possess and understand predicate evidence before it asks for more evidence.
Attorney Wright trains cyber-investigators at the SANS Institute.
Read more on law of trespass in the data age.