Hanging on to data unnecessarily can be risky and expensive. Data that is kept beyond legal or business retention obligations can become subject to a legal hold. The costs associated with preserving, collecting, reviewing and producing this data can be substantial. Increased exposure to compliance risks is another problematic potential result, particularly in business sectors that maintain sensitive customer information.
A “keep everything” approach may have been an effective and prudent strategy in the past; however, the reality going forward is that most companies generate too much data for this to remain a viable approach. While it is true that the cost of storing data is decreasing, most experts agree that the exponential pace of data accumulation will greatly outpace any storage cost savings. If everything is kept, companies facing litigation may be forced to review and address all their data, including data that was stored unnecessarily. In addition to driving up litigation costs and slowing discovery responsiveness, it also may increase the chance that unfavorable evidence that could have otherwise been deleted long ago may fall into the hands of an adversary.
Implementing a good defensible disposal program could have a large positive impact for most companies. Depending on a company’s business sector, age, litigation profile and other factors, 40 percent to 70 percent of a company’s data may be eligible for disposition.
The challenge, of course, is identifying the eligible data. Companies store data on any number of media, some of which could be antiquated and require outmoded hardware to extract the data. The institutional history associated with the data could be cloudy because employees once familiar with the data may have left the company, transferred or simply forgotten the details. Implementing a defensible disposal strategy is not easy; however, the benefits can be worth the efforts.
Some practical tips to consider when implementing a defensible disposal plan follow:
Make the Case. Get the support of upper management. Present the current costs of storing data. Mention that while data costs are indeed declining, these savings will likely be eaten up by the staggering increase in data. Focus on the litigation risks inherent in storing data unnecessarily, including the increased costs and inefficiencies associated with preserving, reviewing and producing large amounts of unnecessary data that could have previously been destroyed. Note that discovery costs can be substantial—particularly in complex cases. Unfortunately, many large companies probably have an intimate knowledge of the discovery costs associated with litigation, so upper management may not need much persuasion on this topic.
Assemble the team. The right team will likely include legal, records management, IT and business professionals with extensive knowledge of legal hold processes, technology systems and system constraints, business needs, and company policies. Documenting steps taken is critical to a defensible plan. Identify a point person to develop and maintain documentation to track actions and decisions. Don’t be afraid to leverage other resources that the company may offer, such as a project management office, to set goals, monitor progress and measure success. Consider whether including external counsel would be helpful to guide overall strategic approach, to provide advice on legal hold and retention requirements, and to advise on process defensibility.
Identify the easiest data first. Typically, certain data can be identified as eligible for disposition because enough information is known to make an informed decision. Consider whether data under review is duplicative of what is stored elsewhere. If yes, it may not need to be preserved.
Document before destroying. Once a population of data is identified for disposition, thoroughly document the reasons why the data can properly be destroyed before disposing the data. Include within the documentation any investigative steps taken, as well as any legal analysis, being mindful of potential privilege and waiver considerations. Once the determination to dispose is made and documentation is complete, use appropriate methods to ensure that confidential or private information is not compromised in connection with any data destruction.
Moving Forward. Promote compliance with company policies. Use clearly documented and easy to follow instructions. Conduct regular oversight to help ensure that policies are being followed. Consider revisiting policies relating to backup media. Finally, consider implementing tools to automate records retention, legal holds, email deletion and archiving.
Data will likely continue to accumulate at an exponential rate for the foreseeable future. Keeping everything is no longer a prudent strategy, and for most organizations, it is not even possible. Storing unnecessary data wastes money and resources, and risks legal and regulatory exposure. Implementing a defensible disposal strategy can help a company’s bottom line by reducing costs, and can substantially reduce the company’s exposure to potential legal and regulatory risks.