It is black letter law that a party to litigation has a good faith duty to preserve all potentially relevant documents. This duty generally arises when a party knows, or should know, that litigation is likely. To that end, companies execute litigation holds by either preserving electronically stored information (ESI) in place where it was created or immediately collecting the ESI and storing it safely on an evidence server inside the company's network. Which is the better option?
Preserve in Place
Many companies rely on a preserve in place strategy, which involves keeping documents in their original location and collecting only if absolutely necessary. This approach sounds reasonable in theory, but it is difficult to execute and can be risky.
"Preserve in place" traditionally referred to preservation of archived data, such as back-up tapes, e-mail archives and document repositories--items that are not altered in the normal course of business. However, the term recently has been expanded to refer to "locking down" files currently in use wherever they are found--such as in workstations, laptops, file shares, information repositories, etc.
This preservation strategy relies on either: 1) the end user manually identifying and preserving documents subject to the hold, or 2) the company using search technology to target responsive ESI for lock down and then changing the administrative rights on the target files to "read only." With this approach, if a user needs to open and work with a read only file for business reasons, they must open a copy and save it with a new name. Each time they do so, a duplicate is created. That means every time the file is changed and saved (even via auto-save), it will be locked from further edits as another potentially relevant document.
This can lead to the creation of many unnecessary copies of documents requiring additional storage, increased processing and review costs, and business disruption for end users trying to manage their documents in the normal course of business.
Another risk with preserving in place is that if a key custodian is also an "administrator" on that computer, he or she can override the in-place preservation and potentially alter the document. In addition, leaving a file in place on a computer in the possession of a custodian exposes the ESI to greater risk of accidental or intentional deletion. Finally, the file metadata and unique hash value of the file may be altered when "locked down," making authentication and duplicate identification problematic.
There is also no practical way to apply an in-place hold for broad preservations or ongoing litigation other than to lock down all documents created by a particular author. In the beginning of most cases, it is often impossible to know exactly what may be potentially relevant. Therefore, best practices often require broad preservations (all user-created files) and then culling or filtering at a later date. Additionally, some cases, such as antitrust, wage-and-hour, or discrimination, allege ongoing conduct, so there may be a need to preserve newly-created documents for discovery purposes. This can create business disruption and additional risk if the newly created documents are not properly preserved.
Consider the following points before choosing a preserve in place approach:
- Preserving in place often leaves the files on the custodian's machine, which could be a laptop that is not under physical control of those responsible for enforcing a legal hold.
- Preserving in place often involves changing system metadata, so the documents cannot be altered. Additionally, the company cannot keep an electronic document from being deleted if the user of the computer has administrative rights.
- Preserving in place is cumbersome for the custodian because they need to make a copy of the "preserved" file (if they have the permissions) in order to get it back into use in the regular course of business.
- Preserve in place, without collection, does not protect the ESI from drive crashes and potential data corruptions, losses of equipment, etc.
- There is no practical way to preserve in place ESI when a broad preservation is required of all user created documents.
Collect to Preserve
The term "collect to preserve" means you collect the evidence as soon as it is practical instead of preserving it in place. By immediately collecting all ESI subject to a litigation hold, you minimize business disruption, mitigate the risk of evidence spoliation, facilitate early case assessment, and get the documents into the hands of legal personnel faster.
This approach allows corporations to easily collect (based on narrow or broad culling criteria) the ESI over a network from a central location, and it allows them to store it safely on a secure evidence server. Additionally, for ongoing litigation, the same technology can be used to easily perform secondary collections to gather any newly created evidence.
One perceived downside to this approach is that it will increase storage cost. However, that argument is weak because storage costs continue to drop and enterprise collections can quickly target just user-created data or easily apply keywords or conditions such as date ranges to target only responsive ESI. And finally, the collected ESI can be compressed for storage.
Consider these points before choosing to collect to preserve:
- Collecting to preserve minimizes the risk of spoliation by sequestering responsive documents.
- Isolation of the evidence helps to avoid business disruption.
- Collecting to preserve allows broad preservations of all user-created data and facilitates early case assessment to get on top of the evidence early.
- Collecting to preserve prevents alterations to the metadata.
Since litigation holds are the riskiest part of the e-discovery process, deciding on the right preservation strategy can be the most important decision a company will make.