Legal Holds - E86

[00:00:01] Speaker A: Legal holds hello. Thank you for joining us. This is what counts. A podcast created by Trailblazer Consulting. Here we highlight proven solutions developed through our experience working with companies across various industries, and we talk about how you can apply these solutions to your company. We share our experience solving information management challenges like creating and implementing a records retention schedule, creating an asset data hierarchy, or helping with email management. This is Lee, and in this episode, Maura and I will talk about the importance of legal holds. Maura, this is really an important subject. I think we should start with a little definition and then give some other names that legal hold is called. So, but what I mean by that is, first of all, definition is a process that ensures an organization preserves relevant information and data related to legal disputes, investigations, or litigations or audits or other cases. Typically, this process is initiated when litigation is pending or reasonably anticipated. Sometimes these are called litigation hold. Sometimes they're called preservation orders or hold order. How do you feel about this? [00:01:16] Speaker B: Well, I think you're right. It is really important. It's an interesting subject for me because coming from basic information governance, I don't, I get a little uncomfortable when people start talking about what do we need to preserve in case of a litigation? Because that shouldn't be the only driving factor to your information governance program. If you have a good information governance program where you're creating and maintaining and providing access to the information that you need to run your business, and then you are following your rules in terms of retention and disposition, that prepares you well for doing legal holds. Right? But if we turn it the other way and we do a good job, then there is a place for legal holds in it. And I like your different definition, or your definition is very comprehensive. I think that a lot of people, when they hear the word legal hold, just think. Honestly, I think a lot of people just think, oh, I shouldn't destroy my email and I should talk to it and stop an automated roll off of email. And I feel like, honestly, I feel like that's kind of a lazy way to approach things, but it's also a little bit of a reflection of reality that email is where a lot of drama happens. People really think about email like a conversation and they forget that it is being recorded. It's not a conversation being recorded. You're actively participating in the recording by typing your responses, but the context from the conversation, which if you were recording it, you would hear tone of voice, you would hear interruptions, you would see the flow in a different way, whereas the emails become asynchronous and they can be taken out of context very easily, but people are just as informal in email as they often are in conversation. So a lot of kind of shorthand of when, oh, it's on legal hold focuses in on email because it takes the drama. And also it's easy to do. [00:03:34] Speaker A: Yeah, I'm a little more old school. I picture, when I hear the word legal hold, I instantly picture a conference room full of people surrounding a shredding machine just throwing papers in there right before the hold either happens or right after it happens, which is obviously a very much a no no. [00:03:56] Speaker B: Okay, so legal hold. Observe. The legal hold has some interesting connotations for you. You started working a law firm, right? Many, many years ago? [00:04:08] Speaker A: I did, yes. [00:04:11] Speaker B: So, okay, well, I wasn't thinking about that, but I was thinking that it's got to be more than email. It's got to be about the records that actually document your business. It's the transactions, it's the contracts, it's the approvals and the decision making. It's reporting and sort of operational reporting. And where's the leak report, or the inspection report, or the accident report? Those things end up being important in any audit or investigation or litigation, and that's the real target of a legal hold. So I liked your definition about pending or reasonably anticipated that you are going to be subject to an investigation, audit, a discovery action of some kind related to a possible litigation. And that's the broadest view. And that's the one that, from an IG perspective, we want to prepare for. Obviously, in each case, it is up to the attorneys, the general counsel or the outside counsel, who's advising you of how and when to issue an order and to whom. So let's talk about custodians for a little while. Records custodians. When we talk about record owners from an IG perspective or data owners, we're talking about who's creating this data and who needs to use it, who needs to have access to it to do their jobs on a daily basis. But the record custodian has a special meaning in the legal hold space, which is they're the ones who are going to be held responsible for not destroying something that should have been preserved. Another thing that sometimes happens with record custodians is that they get deposed, they get the other side gets to ask them, how did you determine that you were going to stop the automated roll off of email? How did you determine that backups were in place and they were working, and that you had actually captured all the copies of these records, because it's not enough to keep one copy from a legal hold. You have to keep them all, you have to preserve them all. That to me is also a holdover of more paper based world where you have multiple copies and people might write things on them, so they're in fact not the same. I feel like in the electronic world where you have cloud based storage and people are working off the same version and updates are made automatically, there's less variation, but it's certainly possible that people have downloaded something and make changes and it's on their hard drive and it doesn't look exactly like what's in the cloud. And that could be an accident, or it could be deliberate, or it could be just the versions are out of sync, or it could be that the one on the hard drive has got the real information and they're trying to hide it. So the all copies is an important piece of this. And the record custodians are where that burden really lands, but the lawyers have to help them understand that and the information governance team has to make it happen. Help make it happen. What do you think about that? [00:07:28] Speaker A: No, that's good. Quick Internet search on record custodian is the person that manages records at an office level. Then it goes further though. It says applying the records retention schedule, preserving, transferring and destroying records appropriately, ensuring records are stored in a proper condition, and then setting strong access or password protocols also. So it goes into this, internal data breaches or cyber criminals, the record custodians responsible for that not happening as well. [00:08:02] Speaker B: Wow. So you don't. The goal here is don't be named in records custodian. You have a lot of responsibility. I think in a practical way, those responsibilities are shared across multiple people. You've got your IT security team. They're going to be responsible for data breaches. Each individual person is not responsible for that, except they have to be aware of and avoid phishing, or leaving their laptop somewhere, or forwarding emails to an unencrypted address, like to a home email address, or storing them on a home computer. That's not secure. Individuals have that responsibility, but the IT security team has a broader responsibility for protecting the footprint of the company. That definition that you just read is more like the everyday, ongoing, I'm the records custodian, I'm making the records, I'm organizing them, I'm keeping them, I'm making sure that they're accessible. And then when it's time to disposition them, I'm following the rules. Sometimes those are the same people who end up being named as custodians in the legal holds. But often it is a more senior person who is named as a custodian in the legal hold because they're the ones that are responsible for the function and they may have delegated the hands on record keeping on a daily basis to another person. In reality, they're all on hold. They all have to follow these rules. So from the lawyer perspective, it's look at the pending matter, determine what's the subject. How are we going to identify these records? Where are they? Do we have a data map? Do we know where our records are? How many copies are there? Do we know what our processes look like so that we can expect that all the information is in the enterprise systems? Or do we know that the company relies heavily on email and people are downloading and changing copies all over the place? It is part of the lawyer's responsibility to understand those things and to work with IG and it to improve the situation, but also to deal with what the reality is. When it comes time to find things, then it's informing and educating those custodians. Here's what you have to keep using it or having it use whatever tools are at its disposal to prevent inadvertent accidental deletions. And then you get to the end of it. The case has moved on. There may have been discovery actions, there may have been productions of information, there may have been searches. A lot of things could happen. Someday the case will be over and the final step in the legal hold is actually lifting it. And that is a step that is often forgotten. And you'll go into companies, will go into companies and we'll find out that things have been on legal hold for 710 or more years. Two general councils have come and gone. Maybe there's been another acquisition. Can we lift the holds on these records and actually destroy them in accordance with the retention schedule? It's always a question. It is often a question we have to ask. Instead, if you have a good process, when the matter ends, you should issue an order to all those same people who got the original order about holding and preserving all the information, saying, okay, the legal hold is lifted and we can now start again following our records retention schedule and our normal disposition processes. [00:11:44] Speaker A: Go a little bit further because the retention on those items doesn't start over from that particular point in time. Right. It goes according to the retention schedule that was in place, meaning if something is on, if something is. Is triggered by the retention, say a contract is after close of contract and it's ten years. Well, five years later, there's a legal hold. Right. So we have to hold on to that record, and we held it for ten years. So it's past its retention. Now, once it's off of legal hold, you can destroy that particular item because it's five years past its retention. [00:12:30] Speaker B: No, absolutely. And you should have a process for that, because now it's kind of out of the run of routine reports saying it's time to destroy this or any automated retention sweeps or something. So you need a process when you lift legal holds to say anything past retention, let's destroy it. Now, what's the approval process we need to go through? Anything that's not yet passed goes back and the clock continues as if that intervening time didn't happen. The other thing that's tricky is often the same records are subject to more than one legal hold at a time. And so you might lift one of them, but there's still two others in place. So you can't destroy those records because they're still being held under the other two. And the better legal hold process that you can put in place where you can be pretty granular and actually tag the information with this is legal hold one, two, three, and four. And now legal holds one and three have been lifted, but two and four are still in place. So that, you know, as you're going through and reviewing for your routine dispositions, you are confident that you know what's going on. I have only seen one company that's really good at that, and they focused on their legal hold process, the placing of holds, the tagging of information, and the lifting of holds so that they could streamline their retention and disposition process and not have to go seek individual approvals for everything that needed to be destroyed. And their reasoning was they had never once gotten in trouble for what their retention schedule said. They had only ever gotten in trouble for not following it. And the usual way of not following it was keeping things too long. Most companies we've worked for do not feel confident enough in their legal hold process. Their ability to tag all the information that's subject to hold, and their ability to lift things to lift the holds when they're ready, they don't feel confident enough in that process to let the retention and disposition process run without individual. Every time we want to destroy something, we have to go check and make sure it's not subject to hold, and we have to get legal to sign off. Haven't met any groups yet, any other companies except that one that really feels like they're okay if they do that. So most of them are somewhere in a process of making their legal hold process stronger, making their records identification and tagging process stronger, and making their retention and disposition program stronger so that the whole thing runs more smoothly and they can cut down on the exceptions and the individual. Can I destroy this questions every time. So everybody's working their way toward that, but that's the end goal that everybody wants. [00:15:33] Speaker A: That's good stuff, Maura. [00:15:36] Speaker B: Okay. It's important. So something to think about as you get your program underway. [00:15:43] Speaker A: If you have any questions, please send us an email at infotrailblazer.us.com or look us up on the web at www.trailblazer.us.com. Thank you for listening and please tune into our next episode. Also, if you like this episode, please be a champion and share it with people in your social media network. As always, we appreciate you, the listeners. Special thanks goes to Jason Blake, who created our music. [00:16:10] Speaker B: Thanks everyone. Look forward to our next episode.