Electronic Data Records Law | How to Win E-Discovery

International E-mail Deletion

Computer Spoliation in Asia

Electronic discovery (EDD*) and the destruction of digital evidence are global issues, affecting more than just North America.  Throughout the world, electronic records are ubiquitous, and mushrooming in volume.  Any law enforcement investigation in the world – whether a lawsuit, a tax audit, a police inquiry, an arbitration proceeding,
a legislative hearing, an administrative probe or a government inspection – is likely today to seek access to electronic records (email, databases, flash drives, text messages, facebook posts, youtube videos, digital photographs, laptop hard drives, and more).

Naturally, to thwart an investigation, an unscrupulous holder of e-records (ESI) wants to destroy them.  In the US, we call that destruction “spoliation” or “obstruction of justice.”  Other jurisdictions may use different words for unlawful destruction of evidence, but the general concept of law must be universal.  If law enforcement is to function, it must forbid and punish wrongful destruction of electronic evidence.

Many of the leading cases punishing the destruction of computer evidence are American, and to a lesser extent Canadian.  But cases are emerging in other countries.  . . .
One such case before the Singapore High Court is K Solutions Pte Ltd v. National University of Singapore [2009] SGHC 143.  This lawsuit was a contract dispute involving IT services provided by K Solutions (KS) to a university.  Under the rules of discovery in the lawsuit, the university sought from KS certain email records, in addition to audio recordings of meetings between KS and university staff.

The court noted that Singapore rules of procedure (Order 24 rule 16(1) of the Rules of Court) require a litigant like KS to disclose relevant records to its adversary, the university.  Evidence in this case showed that KS had possessed numerous relevant electronic mail records and audio recordings, which it had not released to the university.  Although KS explained that some email records had been destroyed innocently under its policy of retaining e-mail only six months, the court was suspicious.  The court believed KS’s email destruction policy should have been suspended because KS knew that litigation was likely.  (In other words, using American parlance, KS should have applied a “litigation hold” on the email.)

The court observed that although the rules of procedure do not explicitly forbid a party from destroying records, the rules imply that records should be preserved when litigation is pending or anticipated and that wrongful destruction should be punished. 

As the court considered KS’s deletion of email, it noted that KS, during the course of the lawsuit, had also been evasive and untruthful about its records.  The court levied severe sanctions against KS, effectively granting judgment against it in favor of the university.

Analysis:  From the perspective of any enterprise such as a business, law punishing the destruction of evidence is dangerous.  Digital records are destroyed constantly, in the ordinary course of operations. But the law may punish destruction if a legal authority concludes the destruction should have been avoided.  In any investigation the authority looks backwards and second-guesses what the defendant did in the past.  Retrospection is always how investigations like lawsuits or tax appraisals work.  With the benefit of hindsight, an action (or omission) of records management that seemed innocent to the defendant at the time can appear sinister later.   All enterprises (US and non-US) therefore need margin for error.  The law gives them incentive to be more generous in retaining computer records, especially electronic mail.  And the law gives incentive to keep email of important people much longer than six months.

–Benjamin Wright

Mr. Wright serves as a public speaker on e-discovery, e-records management and IT security law.  He speaks to professionals groups like Institute of Internal Auditors and SANS Institute.

*What is EDD?  Electronic Data Discovery is a relatively new legal term of art.  It refers to the process of finding, managing and disclosing electronic records (whether on a tape, a PC, an iPod, a cell phone or whatever device) as required in a lawsuit or legal investigation, such as a regulatory audit.

Alternative Dispute Resolution eDiscovery

Global Electronic Mail Record Retention-Destruction Policy

E-discovery (EDD) is a topic of growing importance in international dispute resolution. Although the US courts are considered the hotbed of e-discovery (along with, to a lesser extent, the other common law-based courts of UK, Canada and Australia), the topic cannot be ignored anywhere in the world.  For this reason, foreign (i.e., non-US and non-English tradition) organizations have growing reason to retain plentiful e-mail records, even if they have little or no exposure to the jurisdiction of US or other English-tradition courts.

Item One: The Chartered Institute of Arbitrators (known as CIArb, based in London) has published the Protocol for E-Disclosure in Arbitration.  In general, the Protocol is akin to the 2006 e-discovery amendments to the US Federal Rules of Civil Procedure. It confirms that “e-disclosure” (British for “e-discovery”) is a legitimate, even common issue in modern business-commercial arbitration, regardless of whether the common law countries (e.g., US, UK, Canada, Australia, New Zealand and in Asia Signapore) are involved. Further, similar to amended FRCP 16(b) and 26(a) & (f), the Protocol urges parties to confer early and often on e-discovery issues and seek to reach agreement on matters such as the scope, method and cost of e-discovery. And, similar to amended FRCP 26(b)(2), the Protocol presumes that hard-to-reach e-data (electronically stored information or ESI) are outside the scope of disclosure, though the presumption can be overcome.

Item Two: Could the e-discovery law of American courts hold that a continental European government, which hails from a civil law tradition (sometimes called the Roman law tradition), spoliate e-mail records?  The glaring answer is yes. In Reino de Espana v. American Bureau of Shipping, 2006 U.S. Dist. LEXIS 81415 (S.D.N.Y. Nov. 3, 2006), the national government of Spain sued a US enterprise, in US federal court, regarding an oil spill near Spain.  But as Spain initiated this lawsuit, it failed internally to implement an effective litigation hold on its own e-mail records. Spanish government computers lost, destroyed, deleted, erased relevant records.  The US court ruled that the government of Spain was at fault for spoliation.  

The law of spoliation is a key reason that US institutions have learned that generous, centralized retention of e-mail is today wise. The Spanish government has now learned the same lesson.

Update: Practical experience in Germany shows that businesses are, legally-speaking, wise to keep their e-mail records.

–Benjamin Wright

EuroSox: Audit, Disclosure for Corporations

E-mail Archives For Control and Contract Enforcement in Europe

European enterprises feel impelled to improve internal controls, and retention of e-mail records must play a role.  

For years government authorities have sought greater accountability and transparency among European companies, and greater uniformity in financial reporting.  This campaign has led the European Union to adopt amendments to the following: 4th directive 78/660/EEC (annual accounts of specific type of companies), 7th directive 83/349/EEC (consolidated accounts) 8th directive 84/253/EEC (auditor and audit committee requirements).  

In accordance with these amendments, individual EU member countries are now implementing new national law.  Informally known as “EuroSox” (a nod toward the US Sarbanes-Oxley Act - SOX), these laws reflect modern expectations that institutions open themselves to much greater outside scrutiny, through disclosure and third-party review.  

Although the details can vary from country to country, the broad message is clear:  publicly-held companies and larger public enterprises are expected to pay greater heed to responsible governance and internal control.

A critical part of modern internal control is electronic mail.  E-mail records (and other electronic messages records such as instant message) show who was delegated responsibility for what and when. They show what the terms of business deals were.  They deter the creation of false accounting books.

See for example the UK case Hall v Cognos Limited (Hull Industrial Tribunal 1803325/97).  Cognos’ company policy was not to reimburse employee expenses more than six months after they were incurred. That policy was part of the larger, written employment contract between the company and salesman Hall. The employment contract stated it could be modified only by a signed writing.  Then a superior agreed by e-mail to depart from the policy and reimburse Hall for certain old expenses. When the company failed to honor this commitment, Hall sued.  The court held the e-mail (when printed out) was in fact a signed writing that amended the employment contract.  Therefore, the court enforced the agreement to reimburse the expenses.

E-mails need to be kept (in a way that facilitates searching) so that third parties –- that is, auditors -- can review transactions and relationships after the fact.  They enable investigations into issues like fraud, bribes, kickbacks, corruption, tax evasion, false pretenses, misrepresented facts, government waste, misappropriation of funds-assets, executive abuse of assets.  As internal control grows in importance in Europe, the old practice of deleting business e-mail and text messages quickly looks more and more archaic.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, global provider of electronic archival solutions.