Electronic Data Records Law | How to Win E-Discovery

Reasonable, Proportionate ESI Demand

Denied without Rational Basis

E-discovery is not the gateway to a feast for the litigant requesting access to the electronic records held by its adversary. The party requesting e-discovery of complex information 

from a larger enterprise must be careful.  If the request is not targeted, proportionate to the seriousness of the case and rationally based on already-known evidence, the request may be blocked. 

Sanctions for Overly-Broad eDiscovery Request?

One e-discovery expert, Mary Mack, even predicts that soon a court will sanction a requester for being overly broad in its e-discovery request.  

Another leader in e-discovery, Craig Ball, advises that when a requester demands that the record holder preserve ESI, the requester is shooting himself in the foot if he “demands the moon and paralyzes [his] opponent’s operations.”

In other words, crafting an e-discovery request is hard work. The request must be tailored to the case at hand as it exists – and according to the information that is available – at the time of the request.

Request Denied

See Mirbeau of Geneva Lake, LLC v. City of Lake Geneva, 2009 U.S. Dist. LEXIS 101104 (E.D. Wis. Oct. 15, 2009).   After a city government turned over some paper printouts of email, the requester (Mirbeau) demanded that the city make all its computers and electronic storage devices available for forensic examination.  To justify this demand, the requestor argued that, in an earlier deposition, a city employee hinted that some relevant electronic evidence was being destroyed. 

The court denied the request because the requester “failed to demonstrate why a more rigorous discovery process, with extensive forensics analysis of the computers by the plaintiffs, is needed in this case….  Mirbeau has failed to identify what type of information it hopes will be discovered through the forensic mapping of the entire City’s computer system, and Mirbeau has not explained that the information it is requesting would be in the form in which the defendant’s ESI [electronically stored information] is normally maintained.” 

Court Urges Cooperation

Still, the court believed further e-discovery was warranted because the city had been less than diligent in retrieving records. The court urged the parties to cooperate to come up with a fair way to get information. It said : “While not intended to be all inclusive, the parties need to contemplate: (1) what different methods could be used to find ESI relevant to this litigation; (2) whether neutral parties could be procured to run scans on the electronic devices of the defendants; (3) whether the searches for ESI could be staggered, such as not to disrupt the City’s ability to function; (4) whether the searches could be narrowed such that they are focused only on certain parties and certain dates; and (5) what methods need to be in place to ensure that the privacy rights of third parties are not adversely affected during the discovery process.”

Rational Request, Based on Existing Evidence

The negotiation of e-discovery is a delicate, intellectual process.  It's not enough for the requester to say, "give me [or save for me] everything you got."  Nor is it enough for the record holder to say, "you aren't entitled to anything more," or "we just don't have any more records than these."

In this computer age -- when one fully comprehends every scrap of data that may exist anywhere on an iPhone, hard drive, or backup tape -- the quantity of records in an enterprise is infinite.  Accordingly, it is ridiculous to say either:

- "I want everything" (to find and disclose every last data element takes too much effort); or

- "nothing more exists" (something more always exists somewhere within the control of the enterprise).

For the requesting party, a key challenge is to gather enough intelligence via depositions, interrogatories or other research to inform rational e-records demands.

For the responding party, the challenge is to be cooperative, while not enabling a "fishing expedition" by the requester.

–Benjamin Wright

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages

Terminate Employee, Delete Email?

Are Layoffs a Reason to Destroy Electronic Mail Records?

Departure (dismissal) of an employee does not justify destruction of his e-mail records stored on employer equipment. Those records are not the property of the employee or (normally in the U.S., with some qualifications) the vessel of his privacy.  The records are an asset of the employer, showing what the employee did in his capacity as an employee and agent of the employer and how he was supervised.

In our changing economy, employers are learning how to get the same productivity with fewer people.  As they let some employees go, the email records of those employees are part of the employer's valuable institutional memory.

Wasting Manager Time

A manager is wasting her time if she paws through a departing employee’s e-mail to decide what to keep and what to destroy (delete).  It is better just to keep the e-mail, consistent with the retention and privacy practices generally applicable for all employees. 

Email is an Asset of the Enterprise

E-mail records memorialize intellectual property development by employees (such as an inventor or engineer), and they record when and under what conditions trade secrets are shared with business partners.  In intellectual property (IP) disputes, proving the time and date that particular events transpired is essential.  The beauty of email records is that every message is stamped with time and date.

Today, e-mail records are critical to many investigations and disputes; they are even critical under search warrants, where law enforcement seizes records under court supervision. In Jane Doe v. Norwalk Community College (a sexual harassment case), the court sanctioned a college for destroying electronic records of a suspect teacher after he left the college.  The same could happen to any educational institution (public or private . . . higher, secondary, primary, K-12).

E-mail records show what commitments employees did and did not make on behalf of the employer. In Cloud Corp. v. Hasbro,  314 F.3d 289 (7th Cir. 2002), employee e-mail effectively modified a paper-written contract that said it could not be modified except by a “signed writing”.  E-mail can be a legally-binding “signed writing” that memorializes the employer’s rights and responsibilities under contracts.

Federal Sentencing Guidelines

E-mail records showing day-to-day education and supervision of employees are consistent with the expectations of the Federal Sentencing Guidelines.  The Sentencing Guidelines are the framework within which federal judges select penalties for convicted criminals.  If a criminal happens to be an enterprise, the Guidelines call for leniency where the enterprise had taken steps to prevent and mitigate crime by employees.  In other words, bad employees might go to jail, but their not-so-bad employer might avoid stiff criminal penalties.

Under the Sentencing Guidelines, the steps the employer must take include establishing and promoting an employee ethics program and then monitoring and disciplining employee conduct.  To show that an employer did this, electronic mail records (ESI) can be key evidence.  They can document regular education, supervision and discipline of employees.

Update: The Federal Sentencing Guidelines are proposed to be amended so as to place more emphasis on complete record retention.

Policy?

So precisely how long should employers keep email records? There is no one-size-fits-all answer.  I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.).  Normally, these different stakeholders start with different positions on what the policy should say.  But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

–-Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he delivers professional training on the law of e-discovery, e-records management and internal investigations.

P.S.  Employers may believe that by deleting email they are preventing a future eDiscovery adversary from conducting a so-called fishing expedition through the records.  However, I argue that the advantages of generous record retention outweigh the risk of a fishing expedition.