Electronic Data Records Law | How to Win E-Discovery

Digital Right To Be Forgotten

Privacy or Spoliation?

A movement is afoot in the European Union to grant individuals an online “right to be forgotten.”  
The general idea is that a person would have the right to force a service provider to delete  data the provider possesses about the person.  That right would promote privacy. 

Yet the right to be forgotten clashes with another emerging expectation in modern law, that is, the expectation that organizations will maintain extensive records about their activities.  Broadly speaking, law in the digital age has become increasingly suspicious of early destruction of records. See UK case, record retention trends and civil law jurisdictions.

The ability of computers to create and preserve prodigious quantities of records has fueled a sense that organizations should keep records so they can be held accountable to society.

Law expects organizations to retain records for many purposes:  consumer protection, collection of taxes, investigation of fraud, resolution of civil disputes and innumerable other purposes.  If an organization deletes records too early, law will punish the organization under doctrines like spoliation and obstruction of justice.

So . . . when an organization evaluates whether to delete a person's data for privacy purposes, it also must weigh whether the data is a record that must be preserved under some other principle of law.

[Update November 2011]  A US court ruled that putative privacy interests under European law do not justify the destruction of emails needed for litigation in the US.  In IO Group Inc., et al. v. GLBT Ltd., et al., U.S. District Court for the Northern District of California punished a website owner for intentionally destroying emails relevant to copyright litigation.  The website owner argued that U.K. Data Protection Act 1998 required destruction of the emails because they contained personally identifiable information that was no longer needed for business.  The court  dismissed the argument and held that the website owner had engaged in spoliation.  E-Commerce Law Week; Issue 683, Week Ending November 19, 2011.

--Benjamin Wright

Europe: E-mail Record Retention Policy

Storing Business Text Messages

In the US, a process known as “e-discovery” is requiring litigants to search for and disclose large numbers of electronic mail records in lawsuits.  Penalties related to e-discovery motivate organizations to retain an ever-growing quantity of e-mail records.

In civil law jurisdictions in Europe, however, e-discovery is not compelling businesses to retain email as it is in the US.

However, research suggests that European companies are wise or required to archive e-mail records.

Société Générale/ Jérôme Kerviel

See the discussion of the Société Générale/ Jérôme Kerviel case.  (I read it by using Google to translate from French to English.)

Société Générale is a large French bank. Jérôme Kerviel was a rouge trader who exposed the bank to potentially many tens of billions of euros in liability.

The case may be a landmark in French thinking about record retention.  The bank had, in the ordinary course of business, retained Kerviel's email and text message records.  As the scandal broke, at first the bank was reluctant to read his message records out of concern for his right to privacy. But the bank quickly dismissed that concern.  The bank read his messages so that it could understand what he had done and what commitments he had made on behalf of the bank and then to correct his dangerous misadventure.

The lesson seems to be that companies in continental Europe do need to keep the records of important employee email and text messages so that the companies can understand their rights and responsibilities and to correct mistakes.

Requirement to Keep Records of Rights and Obligations

My friends in Europe inform me that civil law jurisdictions often require companies to keep records of their rights and obligations for numerous years.  For example, I generally understand from Polo G. van der Putt of the Vondst law firm in Amsterdam that Dutch Civil Code Article 3:15i states an obligation for companies to keep for seven years “books of financial condition and of everything relating to the company and to retain records in such a manner that its rights and obligations can be determined at all times.”  Further, Article 2:10 paragraph 3 requires seven-year retention for “All books, records and other data carriers which relate to the financial condition of the legal person and everything relating to its activities.”

It seems to me that email would commonly constitute the records evidencing the rights and obligations of a company or business. See Article 9 of the EU Directive on Electronic Commerce 2000/31/EC, which supports the formation of contracts by electronic means such as email.

Punishment for Not Having Records

I am in search of European cases in which businesses have been punished for failing to keep electronic records.

Research in Switzerland, under the guidance of Dr. Jürg Schneider, Walder Wyss & Partners Ltd., identified a case in which a criminal defendant in a conspiracy and money-laundering prosecution had violated his obligation to retain records by destroying many electronic documents at his company.  The court found that by destroying records the defendant had hindered a criminal investigation and was therefore required to pay the full costs of the proceedings against him.  (In the US and Canada, we would call the defendant’s action the crime of “obstruction of justice.”)  The citation for the Swiss decision is SK.2008.18; it is a decision by the criminal division of the Federal Criminal Court of July 8, 2009.  The decision is available in German on the web.

This Swiss decision points up a issue for organizations as they set policy for email retention and destruction.  If the law will punish you for destroying records when you have reason to believe they will be needed in an investigation or lawsuit, then your policy for destroying email must be ready to stop the destruction at the right time.  In practice, knowing when to stop, and then actually implementing the stop, are not easy for complex enterprises. 

My knowledge of law in civil law jurisdictions is limited.  If you the reader know more information or cases on this topic, I invite you please to let me know.

–Benjamin Wright

In partnership with Messaging Architects, Mr. Wright leads in-house workshops to help organizations establish policy on the retention and destruction of electronic records.

New for 2012: Methods for reliably capturing and preserving text messages for audit and legal investigations.

International E-mail Deletion

Computer Spoliation in Asia

Electronic discovery (EDD*) and the destruction of digital evidence are global issues, affecting more than just North America.  Throughout the world, electronic records are ubiquitous, and mushrooming in volume.  Any law enforcement investigation in the world – whether a lawsuit, a tax audit, a police inquiry, an arbitration proceeding,
a legislative hearing, an administrative probe or a government inspection – is likely today to seek access to electronic records (email, databases, flash drives, text messages, facebook posts, youtube videos, digital photographs, laptop hard drives, and more).

Naturally, to thwart an investigation, an unscrupulous holder of e-records (ESI) wants to destroy them.  In the US, we call that destruction “spoliation” or “obstruction of justice.”  Other jurisdictions may use different words for unlawful destruction of evidence, but the general concept of law must be universal.  If law enforcement is to function, it must forbid and punish wrongful destruction of electronic evidence.

Many of the leading cases punishing the destruction of computer evidence are American, and to a lesser extent Canadian.  But cases are emerging in other countries.  . . .
One such case before the Singapore High Court is K Solutions Pte Ltd v. National University of Singapore [2009] SGHC 143.  This lawsuit was a contract dispute involving IT services provided by K Solutions (KS) to a university.  Under the rules of discovery in the lawsuit, the university sought from KS certain email records, in addition to audio recordings of meetings between KS and university staff.

The court noted that Singapore rules of procedure (Order 24 rule 16(1) of the Rules of Court) require a litigant like KS to disclose relevant records to its adversary, the university.  Evidence in this case showed that KS had possessed numerous relevant electronic mail records and audio recordings, which it had not released to the university.  Although KS explained that some email records had been destroyed innocently under its policy of retaining e-mail only six months, the court was suspicious.  The court believed KS’s email destruction policy should have been suspended because KS knew that litigation was likely.  (In other words, using American parlance, KS should have applied a “litigation hold” on the email.)

The court observed that although the rules of procedure do not explicitly forbid a party from destroying records, the rules imply that records should be preserved when litigation is pending or anticipated and that wrongful destruction should be punished. 

As the court considered KS’s deletion of email, it noted that KS, during the course of the lawsuit, had also been evasive and untruthful about its records.  The court levied severe sanctions against KS, effectively granting judgment against it in favor of the university.

Analysis:  From the perspective of any enterprise such as a business, law punishing the destruction of evidence is dangerous.  Digital records are destroyed constantly, in the ordinary course of operations. But the law may punish destruction if a legal authority concludes the destruction should have been avoided.  In any investigation the authority looks backwards and second-guesses what the defendant did in the past.  Retrospection is always how investigations like lawsuits or tax appraisals work.  With the benefit of hindsight, an action (or omission) of records management that seemed innocent to the defendant at the time can appear sinister later.   All enterprises (US and non-US) therefore need margin for error.  The law gives them incentive to be more generous in retaining computer records, especially electronic mail.  And the law gives incentive to keep email of important people much longer than six months.

–Benjamin Wright

Mr. Wright serves as a public speaker on e-discovery, e-records management and IT security law.  He speaks to professionals groups like Institute of Internal Auditors and SANS Institute.

*What is EDD?  Electronic Data Discovery is a relatively new legal term of art.  It refers to the process of finding, managing and disclosing electronic records (whether on a tape, a PC, an iPod, a cell phone or whatever device) as required in a lawsuit or legal investigation, such as a regulatory audit.

How Long to Retain Public Records?

Storing Too Many Messages on Tape?

Dallas County officials are debating a proposed policy under which the default will be to delete electronic mail quickly.   But some question whether such a policy would lead to elimination of records needed for legal purposes (such as open records law) and to legal exposure for county employees.

The county is considering the 90-day policy because e-mail storage is expensive and cumbersome under its present technology.  Proponents of the proposed policy argue that the county should archive only messages that an employee has deemed to be an official “record.”  They maintain that Texas state guidelines mandate only the storage of official records, not all e-mail.  Hence, they envision that employees will review each e-mail one-by-one to decide how it will be categorized for retention purposes, and if an employee does not designate it a record, then it would be deleted after 90 days. (Deletion would be suspended for e-mail subject to any special litigation hold).

Skeptics of the proposed policy fear employees (personnel) are not well-qualified to make such decisions.  Although employees have historically made similar decisions with respect to paper records, the number of paper records was much smaller.  Employees will need special training.  [Query whether the costs and risks associated with employee time, training and attention exceed the cost of just keeping copious e-mail records.]  What’s more, say the skeptics, an employee could be second-guessed for making a mistake and allowing an e-mail to be destroyed by the default policy rather than taking special effort to preserve it.  According to the Dallas Morning News, “Destroying local government records is a Class A misdemeanor and can be a third-degree felony under some circumstances.”

Dallas County e-mail records (ESI) have previously been the subject of controversy in litigation.

An alternative for the county would be to implement an e-mail archival appliance that efficiently stores older records separate from the county’s day-to-day production e-mail system.

–Benjamin Wright

Mr. Wright teaches technology law at the SANS Institute (CLE and CPE).

SOX Record-keeping

Arthur Andersen’s Records Management Crime

The US legal system is giving all enterprises (whether public corporations, private LLCs or otherwise) reasons to be more liberal in their retention of records, especially e-mail.  One reason is a change in obstruction of justice law.

The traditional obstruction of justice statute, 18 U.S.C. §1512(b), punishes anyone who corruptly persuades another person to destroy documents to impair their use in an official proceeding.  Under that traditional statute, a criminal court convicted Arthur Andersen for destroying Enron-related papers and electronic records. The jury in Andersen’s trial said Andersen’s internal record management practices violated the statute.

But one month after Andersen’s jury trial, Congress adopted the Sarbanes-Oxley Act (SOX).  SOX modified obstruction of justice law by making it easier to convict people who destroy records.  SOX included new 18 U.S.C. §1519, which now punishes anyone who destroys, conceals, or covers up any record to impede or influence a federal lawsuit or an investigation by any federal agency, or in relation to or contemplation of any such matter or case.

Notice the differences between the traditional §1512(b) and new §1519.  Under traditional §1512(b) a crime was committed only if the defendant "corruptly persuaded another person" to destroy documents.  It might be hard for a prosecutor in a criminal trial to show corrupt persuasion of a second person.  Further, the exact words of §1512(b) seem not to apply if the defendant directly destroyed documents.   In new §1519, Congress omits the traditional “corruptly persuades another person” element. Further, new §1519 employs expansive language -- “in relation to or contemplation of any such matter or case” – to stretch the law to cover destruction of records in any way connected to a specifically anticipated lawsuit or investigation.

Enterprises be aware.  The effect of §1519 is powerful.  To win an obstruction of justice conviction, the prosecutor does not have to work as hard as he or she did in the Andersen case.  The prosecutor no longer has to show the defendant acted "corruptly" to "persuade" someone else to destroy documents.  Now, it is enough for the prosecutor to simply show that the defendant intended to destroy records with federal litigation in mind.

With new §1519, Congress emphasized its intolerance of people who mulch records in view of a lawsuit or investigation, even one that is not pending or imminent.  Hear how Senate Report 107-146 interprets new 18 U.S.C. §1519:  “This statute is specifically meant NOT to include any technical requirements, which some courts read into other obstruction of justice statutes, to tie the obstructive conduct to a pending or imminent matter. It is also meant to do away with the distinctions, which some courts have read into obstruction statutes, between court proceedings, investigations, regulatory or administrative proceedings . . . and less formal governmental inquiries. The intent of the provision is simple: people should not be destroying, altering or falsifying documents to obstruct any governmental function.”

Think about that statement from a record management perspective at a complex enterprise.  The statement seems to imply that the enterprise must implement a litigation hold with respect to future (specifically-anticipated) lawsuits/investigations, even though they are not pending or imminent.  For an enterprise, it is tough to know what is and is not anticipated somewhere out there in the future.  But the risk is that later, after the lawsuit gets going, the court may judge the enterprise's decisions retrospectively, with the benefit of 20-20 hindsight.  The court may determine, "Oh, you could have seen this coming (even though it was not imminent), so you should have implemented a legal hold."

Given that it is now easier to be convicted for destroying records, the logical response for an enterprise is to keep more records longer . . . to give itself a wider margin for error.

SOX’s new contribution to obstruction of justice law should be viewed in the context of recent cases punishing premature destruction of electronic records.  In that context, one sees a whole legal system that expects more lavish record retention than in the past.

–-Benjamin Wright

Mr. Wright teaches cyber security and investigations law at the SANS Institute.

Reference: B. Wright, “Shredding Documents Post-Arthur Andersen: Reforming Corporate Record Retention Policies for the Information Age,” a paper published 2002.