Electronic Data Records Law | How to Win E-Discovery

Recordkeeping for Social Networking Managers

Social Networks for Official, Commercial & Employment Transactions

By law, employers generally need to keep records of employment decisions.  So when the boss conveys a pink slip by way of Facebook, the employer needs a legal record of it.

What?  Fire someone by Facebook . . . a posting on a wall?  Would a manager do that?  Yes.  A spa in Canada (British Columbia) used Facebook to notify Crystal Bell of her job termination.

The history of electronic messaging tells a story about business records.  As each new form of message comes along, we initially doubt you can conduct business with such a flimsy thing.  Fax as a medium for transacting serious business?  No way, people thought in the early 1980s.  But as time passed –- and as court cases enforced fax contracts -- we grew more comfortable with fax as a business tool.  Today, fax is considered a responsible, even conservative medium for transmitting signed agreements and binding business records. 

Then, when electronic mail came into the workplace, conventional wisdom dismissed it.  Convention said e-mail was not a business record, said it could not (conveniently) be authenticated with a signature, and said it should be deleted quickly like so much water-cooler chitchat.  But naturally business people embraced e-mail as a tool for making obligations and delegating authority.  Today we see the law giving enterprises growing reason to store e-mail as business records.

I predict the same process will unfold for collaborative (Web 2.0 and social network) media like instant message, Facebook, Twitter and Myspace.  Old-fashioned folks will try to ban these technologies as methods for conducting important business.  They will, initially, ignore them as records to be kept.

But the outcome of the story is inevitable.  Busy people (like the boss in BC) will use the new channels to hire, fire, negotiate, agree and so on.

The managers of records need to plan for capturing the records of Web 2.0.  Those records can become the subject of a subpoena, an IRS taxpayer audit, an administrative summons or an internal investigation or the source of exculpatory evidence in defense of lawsuits.

Web 2.0 records are a topic of growing interest to financial regulators.  The US Treasury Department is proposing extensive recordkeeping requirements for OTC non-standardized derivatives contracts.  Given technology's rapid advance, this proposal will involve the retention of many informal records.

Update:  Government attorneys are cautioning officials about government maintenance of Facebook pages.

–Benjamin Wright

Mr. Wright is a paid colleague of Messaging Architects, consultants in eDiscovery services.  He provides training in e-commerce law at the SANS Institute.

Sedona Principles | Record Management Policy

Setting E-mail Retention Policy at a Confusing Time in History

A colleague at Messaging Architects sent me this inquiry:  "I have been doing research on legal issues impacting the government sector. More and More I read about how the Sedona Principles that came out from the Sedona Conference affects a judge's decision in a case. Is there anything you can share on the subject?"  My reply:

The Sedona Conference's statements on e-records are indeed influential with judges (whether federal or state, whether Illinois or North Carolina) because they are thoughtfully conceived.   In professional practice, the statements are most helpful when litigation is pending.

But how valuable are they to someone crafting an enterprise records policy before litigation?  My humble view is The Sedona Guidelines: Best Practice Guidelines & Commentary for Managing Information & Records in the Electronic Age are not very helpful.  The Guidelines are correct in everything they say.  Still, they are vague, and they don't reflect a grasp of the big picture.

What is the big picture?  The legal system is giving enterprises (corporations, nonprofits, government agencies, labor unions) incentive to be more generous in the retention of records like e-mail.  I support that observation with posts like:

Employees Ill-suited to Make E-Record Retention Decisions

and

Legal Hold Risk at Local Transit Authority

and

Litigation Hold Punishment for Little Community College

and

The Second-Guessing of Arthur Andersen

[In support of my big picture observation, more posts are coming.]

However, the Sedona Guidelines do not say anything as direct and insightful as "legal system is giving enterprises incentive to be more generous in the retention of records like e-mail."

The East Carolina University case study I posted recently provides a more practical road map for e-mail policy making than the Sedona Guidelines.

--Ben Wright

Mr. Wright teaches the law of electronic records and investigations at the SANS Institute.

Porn | Employee Computers

Hostile Workplace Lawsuits in the Age of Networked Computers

In the workplace, electronic pornography is legal poison.  A singular lawsuit against the Chicago Police Department demonstrates the value of technical measures to filter, screen or block porn (including lewd spam).

In a hostile workplace lawsuit against an employer (whether private sector or government), the existence of porn on work computers or in work e-mail systems can be highly prejudicial.  Even though the employer objected to porn and enforced an explicit policy against it, its presence can reflect horribly on the employer as a case goes to a public courtroom.

In Williams v. City of Chicago (US Dist Ct, N.D. Illinois, E Div 03C2994, Jul 13, 2004), e-pornography backed the police department into an indefensible position.  Officer Williams had complained more than once about a sexually offensive work environment, including both foul comments by co-workers and nasty images on computers (e-mail and otherwise).

The department had a formal policy against such behavior, and Ms. Williams' supervisors endeavored to uphold that policy.

In pursuit of the policy, supervisors had promptly investigated and responded to her complaints, including removal of pornography.  The city argued that on account of its good policy it should be entitled to "summary judgment" in the case. Under summary judgment, the city would win the case before it went to the jury.

However, the court ruled there was insufficient evidence to award summary judgment to the city. In other words, the court said the case should go to a jury for decision.   According to the court: "If the jury determines that pornography was so prevalent that the City should have known about it, the jury could conclude that the City was negligent in discovering the harassment.  Similarly, if the jury determines that the City knew about the pornography because others had complained about it, the jury could conclude that the City was negligent in remedying the harassment."

Wow.  How can the police department (or a sherrif's office) withstand a jury trial focused on the amount of pornography on the department's computers?  Such a public trial would be highly embarrassing, even if the department eventually won the case!  The local media would have a field day.  At this point, the city has strong incentive to settle – at considerable expense – with Ms. Williams.  (I can't tell from the court's opinion whether the city did settle with Mr. Williams, but I'll bet it did.)

Behold the city's unenviable position.  Even after it settles, its problem remains.  The continued presence of Internet pornography can prejudice the city in future cases brought by future employee-plaintiffs, just as it did in Ms. Williams' case.  A case could rise directly from sexual harassment allegations, or from allegations of retaliation following a complaint about porn.

I therefore argue an employer like this police department has good reason to seek technical measures to mitigate its problem.  Although technical filters and blocks are imperfect, they can materially reduce the quantity of pornography in workplace e-mail and systems.

–-Benjamin Wright

 Mr. Wright teaches Internet Records and Security Law for the SANS Institute, where he covers topics like investigations into cybertheft and HR allegations.

Healthcare Internal Control: Retained E-mail & IM Records

Board of Directors Fiduciary Duty

Medicare Compliance & Fraud Investigations

Electronic records such as e-mail do more than satisfy discovery requests in litigation. They serve as a check against mistake, fraud, overcharge, kickbacks, tax evasion, false records, misappropriation of funds-assets and other misconduct. Healthcare institutions need to retain these records to enable investigations of misconduct on the part of administrators or other decision-makers.