E-Discovery: Blessing or Curse?
Chris Costanzo

All electronically stored information is now legally discoverable—but will this new environment simply open the door for additional legal gremlins?

As of last December, banks involved in litigation have more to worry about than whether the merits of their case will stand up in court.

The added burdens have to do with the 96% of documents estimated to exist in electronic form in companies and the astonishing rate at which the volumes of these documents are growing. To clarify their expectations on how all this electronic information should be handled in the event it is called forth as evidence in a lawsuit, U.S. courts issued amendments to the Federal Rules for Civil Procedure, which went into effect on December 1, 2006.

Far from providing relief from having to track down electronic information that may be hard to find, the amendments essentially declared that all electronically stored information is fair game as evidence. Further, it put the onus on companies to quickly retrieve electronic documents for use in discovery (an exchange of information between lawyers about a case) or face serious consequences.

“You could lose the lawsuit—not for the merits of the case, but for your inability to find documents,” says Mark Diamond, president and CEO of Contoural Inc., a Mountain View, California-based consulting firm.

The obligation to track down documents extends to e-mails, which have emerged as critical pieces of evidence in a number of cases. “When companies get sued, the No. 1 thing lawyers want to look at is e-mail,” Diamond says.

The investment bank Morgan Stanley has become the latest cautionary tale involving the importance of correctly handling e-mail. At the end of September, the Financial Industry Regulatory Authority announced Morgan Stanley had agreed to pay $12.5 million in fines and back payments to customers, partly for the firm’s failure to produce e-mails presumed lost in the 9/11 attacks, but which it later found.

Susan Merrill, FINRA executive vice president and chief of enforcement, says the settlement underscored firms’ “obligations to search diligently for, and provide in a timely way,” documents related to lawsuits and regulatory investigations.

Situations like Morgan Stanley’s have heightened awareness of the importance of electronic discovery and created a groundswell of interest in systems that can identify where various types of electronic information is stored, and then collect, analyze, and present it. St. Paul, Minnesota-based Socha Consulting, in its fifth annual Socha-Gelbmann survey of electronic discovery systems, estimated the market would more than double in size between 2006 and 2009, to just over $4 billion.

But there’s more to meeting the new requirements for e-discovery than just having a system. “Directors need to inquire and be assured that management has a comprehensive records management program in place,” says Steven Swartout, executive vice president, corporate risk and general counsel at the $1.2 billion Canandaigua National Bank & Trust in Rochester, New York. “One component of that would be e-discovery policies and procedures.”

An effective e-discovery policy should describe the length of time specific documents will be held by the bank, and provide automated processes for deleting documents, as well as an audit trail. The courts recognize that companies will delete documents under the normal course of doing business, Diamond says. “If you show what you’re going to do, and that you have done it, the courts will understand,” he says.

The courts also recognize that some of a bank’s data may be located in hard to reach places, such as on backup tapes in a data center hundreds of miles away. Often, this sort of “inaccessible data” is also the most expensive to retrieve. As a result, the courts have relieved companies from having to produce it. If a company’s opponent in a case insists on having this type of data, they must pay for its retrieval, Diamond says.

The most important part of an institution’s e-discovery policy, experts say, is developing a litigation hold procedure. This part of the policy identifies the steps an institution would take if it anticipates being drawn into a lawsuit. The law requires companies that are likely to enter into lawsuits to retain all documents that might be relevant to the matter.

The consequences of not doing so can be very serious, says Adam J. Cohen, senior managing director in electronic evidence consulting at FTI Consulting, a Baltimore-based business advisory firm. Executives at companies that do not comply with their document preservation obligations could be charged with criminal liability, subject to personal monetary sanctions, or have the court decision go against them, he says.

Explains Craig Hilliard, shareholder at Stark & Stark, a Lawrenceville, New Jersey-based law firm, the courts can instruct juries to consider the deleted information, even if it was deleted inadvertently, to be negative. “That can be devastating,” Hilliard says, “especially if the bank had nothing to hide.”

A litigation hold procedure basically overrides a company’s normal document destruction policy in the event it faces possible litigation. According to the courts, “It’s OK to destroy documents until you have a legal duty to preserve them,” says Cohen. “That means you have to have a litigation hold procedure.”

Before any policies or procedures can be developed, the first task an institution must undertake is to determine each source of its electronic information. “That may sound simple, but in practice is anything but,” Cohen says. “Until you identify the systems and understand the technology, you really can’t do anything.”

Institutions are tending toward developing simple policies because they are easier to execute, Diamond says. For example, a bank may decide to save all documents created in the loan department for seven years, and those created at the teller line for six months, he says.

Such policies are merely an extension of what happens in the paper world, Swartout notes. At Canandaigua National, paper loan documents are stored for a certain amount of time, then destroyed with a bonded shredder. An employee then confirms that the shredded documents are taken away by truck.

In the bank’s auto loan department, where all the documents are electronic, there is similarly a document destruction protocol in place, Swartout says. “We’re in the process of doing that for all our lines of business,” he says.

Once policies and litigation hold procedures are in place, institutions must figure out how to collect the information, Cohen says. If not collected properly, information may be altered or destroyed, he says.

Hilliard advises clients involved in litigation to immediately bring in outside forensic experts to create an image of the data in question, an operation similar to collecting fingerprints at a crime scene. “When you’re dealing with data after the investigation starts, it’s so easy to delete or alter it,” he says. “With a snapshot, you don’t have to worry about that.”

The final step in e-discovery is implementing a way to review electronic information and analyze its potential value to a case. The initial disclosures between lawyers about which documents are relevant to a case typically happen within 100 days, Hilliard says. Two weeks after that meeting, the parties to a case are obligated to put their disclosures in writing.

The new rules do not accelerate the timeframes associated with producing documents, he says, but they make clear that electronic documents are included. Given the cost to gather and produce what may be a huge amount of electronic information related to say, a particular loan or employee, this requirement “can often send a bank into a tizzy,” Hilliard says.

The key for directors, Swartout says, is to be prepared ahead of time. “You cannot wait until you’re subject to a request or sued,” he says. “If you do, you’ve waited too long.” Diamond echoes, “The new rules force companies to be in a state of litigation-readiness. You have to know what you have and where you can find it relatively quickly.”

Getting to that state requires teamwork between the legal and technology departments. “You need to have the lawyers, IT, and compliance all sit down and understand how the technology works,” Swartout says. Canandaigua National accomplishes this by having Swartout and the bank’s head of technology sit on the same information security committee to address electronically stored information among other issues, he says.

Directors need not only be concerned about bank policies, but also the files on their personal computers, even if they are located at home, Cohen says. One trend resulting from the new rules is “a major increase” in requests to inspect hard drives where even long-ago deleted files can be recovered. “Anything you do on a PC lives forever,” he notes. “It’s important for directors, especially if they’re using personal PCs, to understand they are fair game in litigation.”

Banks generally are well prepared compared to companies in other industries to meet the new e-discovery requirements, Cohen says. But the flip side is they also are subject to higher expectations. “Banks have to meet high standards when it comes to e-discovery,” he says.

© Board Member Inc. All Rights Reserved