Do you know where all your data is?

Changes to the law mean that organisations will be required to account for all their data and documents in the event of litigation, says Bill Onwusah


Changes to the law mean that organisations will be required to account for all their data and documents in the event of litigation, says Bill Onwusah

Recent legal changes mean that you may well be developing a closer than expected relationship with your lawyers. The rule change means that in the event of litigation, lawyers will need to delve more deeply into the innards of your organisation in terms of how data is stored, archived and retrieved so that they can review the facts of a case.

So what should you do knowing that litigation may well be heading your way?

Should litigation arise, one of the first things lawyers will ask is where there is any information stored relating to the litigation. It is therefore very important that you have quick, easy access to e-mails, documents and other potentially relevant data.

One way you can prepare for any future litigation is by implementing an effective document management system. This will enable you to manage the basic documents, control versions where appropriate, control access rights to information, and of course, enable the documents to be part of your archiving system.

Why is document management so important? It is because litigation is not just about winning cases. It can also be about knowing when not to litigate – such as when you have little chance of winning. The only way you can do this is by being in possession of all the facts, and for that you need to have all of the relevant documents.

In the age of electronic disclosure you can be requested to perform specific searches over your systems. The last thing that you want is for a search to dig up a long-hidden document that you had no idea existed, but which may return to haunt you.

Knowing your documents will also mean knowing when and why they were destroyed. Typically, this will form part of a document retention/destruction policy.

The growth of data is such that many firms cannot possibly hope to retain all data that is created and many firms impose strict, documented policies relating to their destruction.

The policy could take the form of automatically emptying users’ recycle bins after a defined period, or limiting the amount of e-mail storage per user. It is very important that any policy you do have in place is unambiguous and enforceable in all jurisdictions where your firm operates.

Naturally, the bigger the organisation the greater the potential volume of data involved. In larger, multinational organisations, national and international data protection acts may complicate the transfer of information from one ¬jurisdiction to another and how data can be retained.

Similarly, the outsourcing of technology functions could further complicate matters, as there may be issues relating to accessibility and costs of retrieval.

In the event of litigation, most law firms should supply you with a questionnaire that will prepare you for the task ahead. The questionnaire is designed to take you through the purely electronic sources of data that were in existence at the time, through to management issues such as how passwords and encryption were dealt with.

Depending on the nature of the case, the questionnaire will cover the obvious areas such as back-up systems, through to the searching of temporary files, thumb drives, home PCs and even websites.

The main thing is not to panic. The point of the questionnaire is to get you to think about where the relevant data could possibly be located, not to get you to hand over every single byte.

The questionnaire should allow you to scope the exercise and determine where the documents are, what they are and possibly most important of all, how much there is.

Keep the lawyers informed throughout this exercise. They are trying to work out whether it is proportionate to pursue a particular line of data collection and excavation. In their eyes “proportionate” means whether the cost of the gathering and reviewing exercise is worth it in relation to the value of the case.

The person responsible for your firm’s systems may well be called upon to sign an affidavit saying that they have found everything that there is. It is important that they emphasise to their teams not to take any decisions that will “help” their employer’s case.

I am aware of one “helpful” employee, who instead of destroying old back-up tapes, took them home, where he stored them just so that he could “help” someone if they were looking for an old document. All of the supposedly destroyed tapes then became admissible.

The lesson of this story is if you have a destruction policy, stick to it. Do not make subjective decisions to “help”.

So what about the future? Think about bringing on board someone who is legally qualified and can provide a legal perspective on future technology projects being considered for the organisation.

Technology investment decisions are primarily based on making decisions that will deliver the best technological solution to a problem. However, this solution may set you up with a long-term legal problem.

In a client-focused business, it may not be good practice to have one client’s data archived on the same media as another’s. In the event of litigation, neither client will be happy about handing over their data because it is all stored on the same media.

One of the most valuable tips to prepare for litigation is to conduct a role play. Set up an imaginary scenario and work out what would need to be done to retrieve the relevant data.

The work that you do here is not wasted, as the practices and procedures that result will help to address any queries that may arise out of a personal data access request. Centralised document systems put you back in control.

I am aware of one company that is so well prepared it works on the assumption that all of its matters will be litigated and prepares its documentation accordingly. Therefore, when litigation is impending it can simply drop the relevant data into its litigation module.

I am not suggesting that you go this far, but by setting up procedures in advance and being aware of what to expect when litigation arrives, you can avoid reacting in a hasty and ultimately expensive way that may harm your case.

Bill Onwusah is the litigation support manager at international law firm Lovells

Private life of data

Read more on Privacy and data protection