Practical Considerations for the Preservation of Electronically Stored Information

1. Prepare a clear, specific litigation hold notice. The litigation hold notice should include enough detail that the recipients understand what type of information is potentially relevant and where it might be stored, including identifying specific systems or resources that are known at the time. Merely mentioning the case name is typically not sufficient and can result in the over-preservation of ESI by cautious recipients or under-preservation (if at all) by frustrated or distracted recipients. Specifics will also help reduce the volume of data preserved, as well as time and costs in the future. You should also distribute reminder litigation hold notices to your recipients, often after six to twelve months, or if there have been notable changes in the case, such as the filing of an amended complaint or issuance of specific discovery requests that may expand the potential scope of the matter. It is often extremely helpful to not only include a reference to a legal contact that can address questions related to the scope of preservation, but also an IT member that can assist with any technical challenges or questions that the recipient may have.
2. Initially identify custodians broadly. Individuals who may have relevant information should be identified and notified through a litigation hold that they need to preserve any potentially relevant information. It is far easier to remove someone from a preservation listing once you have a better sense of the facts and issues of a matter than to restore information from backup recordings, servers, or other sources at a later point in time, if such an option is even possible. Further, asking your initial listing of custodians who might also have unique, relevant data related to your case can be a great way of streamlining the identification of supplemental individuals that should receive the litigation hold notice.
3. Ensure potentially relevant devices are preserved. Many IT departments are, understandably, focused on supporting the business interests of the company and often take the opportunity to redeploy devices as soon as they become available. This can result in the loss of unique, relevant evidence if a machine is wiped and redeployed before steps can be taken to preserve that data. Proper coordination with outside counsel and between the IT, HR, and legal departments to identify whether a particular individual’s devices may be relevant to reasonably anticipated litigation is critical to guaranteeing that no data is lost.
4. Suspend standard retention policies. As the volume of email and the creation of other data types increases exponentially, many organizations have implemented strict retention policies to securely remediate data that is no longer required for business or regulatory purposes. In tandem with the distribution of the litigation hold notice, IT should identify and suspend any retention policies that may result in the deletion of potentially relevant ESI from the recipients’ accounts. Alternatively, when suspension of certain retention policies for specific individuals may be difficult, a viable alternative is to create a forensically sound snapshot or collection of these sources for preservation.
5. Consider non-traditional sources. Most parties have existing procedures for preserving and collecting traditional sources of ESI, such as email, workstations, and network directories. However, other sources, such as chats and text messages, cloud-based storage platforms, and collaboration software like Slack and Microsoft Teams can be far more complicated. An early consideration and discussion of what sources custodians may use to create and maintain potentially relevant information can avoid preservation issues in the future. It is often helpful to ask what types of information you would want if you were in opposing counsel’s shoes, particularly due to the fact that it is increasingly common for employees to use unapproved software to communicate and transfer documents that IT may simply not be aware of.
6. Discourage “sneak peaks” of data. It is not uncommon for IT members or other “tech experts” to want to play detective and find the smoking gun or other incriminating evidence on a device or account, particularly in trade secret misappropriation cases. Unless these individuals have appropriate forensic training, they are far more likely to alter or permanently delete highly relevant metadata and other information that would have been helpful to your case. If you are dealing with a matter that focuses on the transfer, activity, or deletion of information, notify your client immediately that they should focus on identifying and preserving those sources while a reasonable and defensible plan is developed for the investigation and analysis of those sources by appropriately credentialed experts.
7. Continually revise your preservation plan. The types of sources of potentially relevant ESI are not static and new technologies and methods of creating and transferring data are continually being released. While it is often helpful to review prior preservation response plans, you must ask your clients whether there have been any changes in systems or technologies that would impact your case. Further, if you encountered preservation issues in a past matter, you should spend time identifying the underlying cause and be ready to avoid similar issues in future cases.

Matthew Christoff is an associate with Seyfarth in Chicago, Illinois.

_{Copyright © 2021, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}