Electronic Data Records Law | How to Win E-Discovery

Digital Right To Be Forgotten

Privacy or Spoliation?

A movement is afoot in the European Union to grant individuals an online “right to be forgotten.”  
The general idea is that a person would have the right to force a service provider to delete  data the provider possesses about the person.  That right would promote privacy. 

Yet the right to be forgotten clashes with another emerging expectation in modern law, that is, the expectation that organizations will maintain extensive records about their activities.  Broadly speaking, law in the digital age has become increasingly suspicious of early destruction of records. See UK case, record retention trends and civil law jurisdictions.

The ability of computers to create and preserve prodigious quantities of records has fueled a sense that organizations should keep records so they can be held accountable to society.

Law expects organizations to retain records for many purposes:  consumer protection, collection of taxes, investigation of fraud, resolution of civil disputes and innumerable other purposes.  If an organization deletes records too early, law will punish the organization under doctrines like spoliation and obstruction of justice.

So . . . when an organization evaluates whether to delete a person's data for privacy purposes, it also must weigh whether the data is a record that must be preserved under some other principle of law.

[Update November 2011]  A US court ruled that putative privacy interests under European law do not justify the destruction of emails needed for litigation in the US.  In IO Group Inc., et al. v. GLBT Ltd., et al., U.S. District Court for the Northern District of California punished a website owner for intentionally destroying emails relevant to copyright litigation.  The website owner argued that U.K. Data Protection Act 1998 required destruction of the emails because they contained personally identifiable information that was no longer needed for business.  The court  dismissed the argument and held that the website owner had engaged in spoliation.  E-Commerce Law Week; Issue 683, Week Ending November 19, 2011.

--Benjamin Wright

Treat Electronic Records the Same as Paper Records?

In-house Local Government Counsel Sanctioned for Spoliation

Courts seem more assertive in punishing electronic spoliation than they historically were in punishing the spoliation of paper documents.  Many veteran lawyers will be astonished to hear that a federal judge sanctioned an in-house government lawyer for taking something less than vigorous steps to cause and monitor the preservation of electronic evidence.

Prior to filing a negligence lawsuit against a county sheriff’s department (Swofford v. Eslinger), the plaintiff demanded by letter that all evidence including electronic records be preserved.  General counsel for the Seminole County (Florida) Sheriff's Department, David Lane, forwarded a copy of the letter to six senior officials in the department.  Still, the department subsequently destroyed relevant e-mail records and wiped the hard drives of relevant laptops.  

The judge was highly suspicious. On her own initiative she called the in-house lawyer as a witness in a hearing on the question of spoliation.  Citing the famous Zubulake case, the judge concluded that the lawyer had defaulted on his duty to ensure that electronically stored information (ESI) was preserved.  The judge specifically opined that in a case like this counsel needs consult with IT staff about preserving ESI.  The judge imposed a monetary fine on Mr. Lane personally, the amount of which is to be determined.  (See The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities for more on a lawyer's professional duty regarding the preservation of e-records and subsequent search through them.)

The judge is saying that modern counsel must understand how ephemeral ESI is and how vigilant counsel (as an officer of the court) must be to preserve it under a litigation hold.

I don’t know how much annual salary counsel to a Florida county sheriff's department makes, but I'll bet the man is not getting rich on his salary.  The imposition of monetary sanctions on him makes quite a statement.  It is unclear whether malpractice insurance would cover this fine.

A different lawyer at a government agency recently asked me why the record retention policy for e-mail should be different from the policy for paper documents with the same content.  I believe electronic records behave differently from equivalent paper records.  They must be managed differently.  What's more, this Swofford case reinforces my impression that courts are treating electronic records differently.  It reinforces my argument that today the law gives all enterprises heightened incentive to retain email generously.  No employee of a government agency, whether counsel or otherwise, wants the risk of being held accountable for premature destruction of email. 

–Benjamin Wright

Mr. Wright is senior instructor at the SANS Institute, where he teaches a 5-day bootcamp on the law of e-records, cyber defense and computer investigations.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.