Records Retention and
Records Retention and
E-Discovery Issues
E-Discovery Issues
for Nonprofit Organizations
for Nonprofit Organizations
November 9, 2005
November 9, 2005
Rob James
Rob James
Mark Koehn
Mark Koehn
Pillsbury Winthrop Shaw Pittman
Pillsbury Winthrop Shaw Pittman LLPLLP
ACC Nonprofit Organizations Committee Webcast
Overview
The electronic information explosion E-discovery, and the need for
a litigation response plan
• generally • for nonprofits
The need for a customized
records retention program
• generally • for nonprofits
Questions about records management
3
The electronic information explosion
Well over 90% of organizational information is nowcreated or stored electronically; two-thirds never printed
1 gigabyte (GB) ≈ 75,000 pages ≈ 40 “bankers boxes” A university with 10,000 employees and students, each
averaging 84 email messages a day plus attachments, would generate 220 million emails plus attachments per year, or more than 38,000 GB of data (radicati.com)
1.1 billion active electronic mailboxes worldwide in 2005 Over 60 billion emails per day worldwide by 2006
Types of electronic information
Any information created, modified, or stored electronically • Word processing (Word, WordPerfect, etc.)
• Spreadsheet data and formulas (Excel, Lotus, etc.) • Databases (e.g., donor and applicant records)
• Email (Outlook, Lotus Notes, etc.)
• Internet usage (e-commerce, electronic data interchange (EDI)
records)
In any storage medium
• Voicemail, audio and video tapes, personal data assistants (PDAs),
fax machines
• Instant messaging (IM) on cellphones, phone logs, Internet phone
records
• Backup tapes, CD-ROMs, DVD-ROMs, diskettes, flash drives, etc. • Smart cards, car systems (OnStar, etc.), credit card records
5
Volume of electronic information
“Persistence”: for a single paper document (printed from
an e-document), there might be:
• 1 hard drive copy and 12 monthly backups
• Multiple drafts on several hard drives—over 12 months’ worth of backups (maybe weekly and daily backups too) • If email was used to circulate drafts and finals . . . there may
be 1,000 copies or more of the same document
More typical nonprofit example: 50 employees, 25 new
emails/workday/employee, 240 workdays/year, no permanent deletions, and monthly backups
• 25,000 in month 1, 50,000 through month 2 … • 1,950,000 email records by year end
Volatility of electronic information
Every time an e-document is opened and closed, it
changes information about that file known as “metadata”
• Time of creation, access, receipt and revision
• Identity of creators, accessers, recipients and revisers • Content of edits and comments
Generally, when an e-document is deleted, it is not
actually deleted
• The “space” is flagged for reuse by the computer the next time it
needs “space”
• Unless completely overwritten, a “deleted” e-document may be
“undeleted” in whole or part with forensic software
Many e-documents of nonprofits are communicated to
wide audiences, e.g. members, donors, committees, boards
7
Costs of electronic information add up
Costs of archiving or backing up Costs of executing a retention/disposition plan Costs of storing
Costs of retrieving (and reconstructing) Costs of separating and preserving
Costs of reviewing for relevance
Costs resulting from information that was kept Costs resulting from information that was not kept Lost opportunities from information that was not kept Poor records management means you might not be
9
…and the power of metadata
United States v. Quattrone (S.D.N.Y. 2004) • Drafted email message urging group to
“catch up on file cleaning”
• Allegedly two days after lawyer told him a
federal grand jury was looking into his IPO allocations • Metadata showed the email was created and
saved as a draft one day, and sent a day later
• Metadata helped rebut defense claim that defendant sent email unthinkingly, without intent to obstruct investigation
E-discovery is the norm
Expect electronic records to be covered by any
interrogatory or subpoena
Courts are increasingly “e-savvy” and will expect any
organization—even a small nonprofit—to be able to preserve, retrieve and search virtually any stored data
Sanctions for noncompliance can be severe • fines
• default judgments
• adverse inferences (e.g., $29 million in single employee harassment/termination case)
• civil contempt • criminal liability
11
Key cases
Zubulake v. UBS Warburg LLC (S.D.N.Y. 2003) Seven-factor analysis for shifting e-discovery costs:
• 1. specificity of request;
• 2. availability from other sources;
• 3. total cost, compared to the amount in controversy; • 4. total cost, compared to resources of each party;
• 5. each party’s ability to control costs and incentive to do so; • 6. importance of the issues at stake; and
Key cases
Residential Funding v. DeGeorge Home Alliance (2d Cir.
2002)
• Discovery sanctions, including an adverse inference instruction,
may be imposed where a party has breached a discovery obligation not only through bad faith or gross negligence, but also through ordinary negligence
• Discovery opponent’s “purposeful sluggishness” regarding email
production may be enough to infer that the withheld or destroyed emails would be damaging
13
Associations Are Frequent Discovery Targets
Often anticipated to be the “hub” of communication Association counsel has attorney-client privilege with
association – generally not individual members
Discovery proponents pursue associations hoping for
relaxed email discussion of sensitive issues
Responding associations should consider and develop
strategy for appropriate coordination with members’ counsel in responding to subpoenas
Consider whether any nondisclosure agreements are
implicated
Recent Example
In re Mutual Funds Investment Litigation (D. Md. 2005) • Allegations of “market timing”
• Multidistrict litigation (“MDL”)
• Subpoena to Investment Company Institute (ICI) • Sought broad categories of documents
• Court: the subpoena “would require production of virtually every document in ICI’s files concerning market timing and late trading, including documents relating to defendants in MDL proceedings”
• Court: “the subpoena is not limited to the documents in ICI’s file relating to [particular[ . . . entities, but encompasses
documents relating to every member of ICI.”
15
Pending Federal Rule amendments
Approved September 20, 2005, effective December 1, 2006,
unless Congress or Supreme Court intervenes
FRCP 26(b)(2), 45(d)
• “[N]eed not provide discovery of electronically stored information from
sources that the party identifies as not reasonably accessible because of undue burden or cost.”
FRCP 34(b), 45(d)
• “If an [interrogatory/subpoena] request for electronically stored information
does not specify the form … of production, [recipient] must produce the information in a form … in which it is ordinarily maintained or … reasonably usable.”
FRCP 37(f)
• “Absent exceptional circumstances, a court may not impose sanctions … for
failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.”
The court or magistrate can make exceptions and shift
Duty to preserve evidence
Duty attaches when litigation, investigation or audit
commences or is “reasonably anticipated”
• Well before subpoena is served (Arthur Andersen)
• At or before filing of EEOC complaint or union grievance
(Zubulake)
• But not as soon as there is an abstract possibility of dispute:
– A “knowingly … corrup[t] persuader cannot be someone who persuades others to shred documents under a document retention policy when he does not have in contemplation any
particular official proceeding in which those documents might be material” (Arthur Andersen) (emphasis added; construing criminal statute)
17
Litigation response plan
Policy• All employees responsible for alerting Law Department that litigation, investigation or audit commenced or anticipated • Law Department responsible for instituting and
communicating record hold
– Initial communication may need following up
• IT and Records Departments, and all employees who are records custodians, are responsible for segregating and preserving records and suspending disposition
Process for enforcement and audit Training and reminders
Practical considerations
Doing (and documenting) the right thing
• Reasonably anticipated litigation (P vs. D) • Obtaining opponent’s discovery requests
Identify relevant/responsive e-documents and preserve
• Ex 1. Pull and save certain backup tapes beyond standard
recycling procedure
• Ex 2. Cease standard recycling procedure
• Costs can be enormous - especially if saving all daily and
weekly backups
19
Practical considerations
Preserving as in ordinary course• “Imaged” hard drive copy v. active file copy • Collecting edocuments from individuals
-– Emailing to counsel (bad idea)
– Copying to “Repository Server”
Practical considerations
Reviewing what you preserved• Review from copies
• File extension reports to identify volume and size of e-documents of
various types and file name reports to identify structure of indexing/filing system
• De-duplication • Review platform
-– None
– Key word searching over multiple e-docs
– Lit document repository (local or via Web) • Nonresponsive Email
21
Practical considerations
Producing what you reviewed
• “Native format” • Images or paper • Metadata
• Making paper documents
electronic-– Imaging
– OCRing
Practical considerations
Ascending order of difficulty:• Active data • Metadata • System data • Backup tapes • Deleted files
23
Records retention program
Not just a policy resident on a bookshelf or intranet site A program consisting of
• Tone set by upper management that compliance is a core value of
the organization
• Policy integrating the nonprofit’s legal, information technology (IT)
and records management (RM) resources
• Communication and assumption of responsibilities by individual
departments and employees
• Training, enforcement and audit
• Updating for changes in laws, services/products, markets/audiences
Coordinate with other policies:
• Inappropriate content of communications • Privacy
• Ownership of information
“An organization need not retain all electronic
information ever generated or received.”
(Sedona
Guideline #3)
Records should be viewed like other assets of the
organization
• They have value if they can be used to achieve the organization’s goals and meet legal responsibilities
• If they do not, absent an independent duty they need not be kept
– “It is … not wrongful for a manager to instruct his employees to comply with a valid document retention policy under ordinary circumstances.” (Arthur Andersen)
– “Courts routinely acknowledge that organizations have the ‘right’ to destroy … electronic information that does not meet the internal criteria of information or records requiring
25
Information vs. records
First challenge is to separate “records” from the mountain
of “information”
• “‘Records’ are a special subset of ‘information’ deemed to have some enduring value to an organization and
warranting special attention concerning retention,
accessibility and retrieval.” (Sedona Guidelines, Introduction)
• Ephemeral “information” need not be preserved in the first place
Assessing the IT and RM capabilities
Courts do impose e-discovery standards on parties based
to some extent on their resources and experience
Retention program, IT systems and RM practices should
be consistent
• Understand nature and purposes of archiving systems • Consider limiting access to archives solely
for disaster recovery
• Understand where electronic and hard copy records are maintained and by whom
Tension between ever-expanding IT capabilities and
retention program goals
27
Legal and business retention periods
Legal retention mandates
• EPA: keep records of studies not submitted to the EPA for at least 2
years following the date on which the study is completed, terminated, or discontinued (40 CFR 160.195)
• OSHA: keep employee occupational illness/injury reports for 30
years following termination (29 CFR 1910)
• Sarbanes-Oxley: auditors must keep workpapers and other audit or
review records for 7 years, often flows down to audited organizations
Statutes of limitation
• In absence of tolling, define period for suits against or by
organization
• Not a mandate but a matter of business judgment prior to
anticipated litigation
Business needs
• Maintain donor records, marketing data, R&D data for use in later
years
Legal destruction mandates
Examples from the nonprofit world
Lobbying
• Federal: 6 years for federal reports
• States: varies, often 3-6 years for records of meetings with legislative and executive branch personnel
– Cal. Code Regs. § 18612(f): 5 years
– Del. Code tit. 29 § 5831: 4 years
– N.Y. Legis. Law §§ 1-h(c), 1-i(d), 1-j(d): 3 years
IRS Form 990
• 3 most recent years’ returns Intellectual Property
Leases and other contracts
29
Tailoring the program
Record types and retention periods come together in the
schedule
• Usually a table identifying
– type of record kept by organization
– location and format of the “authoritative” version
– custodian of that version
– time period for retention
• Time periods usually specified in years
– 6: keep for 6 years after creation
– ACT5: keep for 5 years after cessation of activity in question (contract, employment, etc.)
– TAX5: keep for longer of 5 years or closure of tax audit exposure (for non-exempt businesses, e.g.)
– VITAL: keep hard copy original
Special cases
Ethical walls restricting internal access to information • revolving door government employees
• confidentiality agreements
What about litigation pending at time program starts? • Immediate need to segregate records relevant to current
cases
• Plan for implementing program when and as cases resolve
Document management systems
• Automatic deletion of Deleted Items and Drafts • Automatic deletion of Inbox, Sent Items?
• Organization should assure, through systems, training, enforcement and audit, that “records” are being sent from the Inbox or Sent Items folders to project folders, where they are maintained as prescribed by the policy
31
Additional resources
Involve experienced counsel Those that understand the discovery process
AND the technology
AND the behavior and culture
of the organization and its employees
Additional resources
The Sedona ConferenceSM• E-discovery: The Sedona Principles
• Records retention: The Sedona Guidelines
• Download for free at http://www.thesedonaconference.org Annotated Case Law and Further Reading on Electronic
Discovery by Kenneth J. Withers, Senior Judicial Education Attorney, Federal Judicial Center (kenwithers.com)
ISO 15489, ARMA, ANSI standards, especially
for trade associations
E-discovery vendor websites, including Applied Discovery
(LexisNexis) and Kroll Ontrack
• But beware of recommended activities beyond what “reasonable
33