IT’s Role in E-Discovery

E-discovery (for electronic discovery) is the electronic aspect of identifying, collecting, and producing electronically stored information (ESI) in response to a request for production in a lawsuit or investigation, according to legal definitions. “ESI includes, but is not limited to, emails, documents, presentations, databases, voicemail, audio and video files, social media, and web sites,” according to Complete Discovery Source.

The start of e-discovery is traced back to 2005, when a US Supreme Court decision amended the Federal Rules of Civil Procedure to include electronic records such as emails and instant messages as records that could be archived and produced as relevant evidence.

For those in the legal profession, this was a welcome change. However, it may have presented legal challenges to IT professionals.

It was welcomed by lawyers because many case-relevant communications were conducted through email and other electronic means. Also, the ability to capture and electronically search records for keywords was a boon to the legal profession. For decades before, law firms had to pay out significant sums to “coders” who physically searched through paper documents for case-relevant keywords and hand-coded them into key cards or other formats that ultimately had to be fed into a computer to facilitate searches.

Today, the law allows enterprises to store and retrieve relevant documents related to lawsuits and investigations electronically, but enterprises must also depend upon their IT departments to assist in the electronic document management.

Consequently, the growth of e-discovery affects IT practices and policies, such as how long your organization must retain data that is seldom or never used. For example, a common tendency in e-discovery is that you save everything forever.

Here is an example of what e-discovery may involve:

Sally in purchasing sends Jake in sales an email, inviting Jake to lunch. Would you normally archive such an email to “forever storage?” Likely not. Except that Sally and Jake were later accused of conspiring to award a major order to a startup widget supplier that Jake had invested in. The widgets proved to be faulty, and the company lost several key customers. The enterprise now wants to investigate why it ever ordered from this company in the first place.

In this case, the IT team might be instructed to review every email from purchasing, and it might find it hard to defend an archive policy that only kept emails that were only two years old or less, or that only had relevant titles. For example, an invitation to lunch might not be deemed to be relevant.

IT’s E-Discovery Responsibilities

Fearful of being caught in this quandary, IT revisits its data retention policies, and decides to increase the amount of data that it stores (along with increasing its storage costs).

But there also are other responsibilities that IT must assume to support e-discovery.

Governance of e-discovery data must be strictly maintained, with only certain persons within the enterprise (e.g., the compliance department, the legal staff, executive management, etc.) having access to e-discovery data and networks.

Data must be secured and protected.

Data must also be organized into a database that renders it searchable for others, so that keywords point to legal documents, making them easy be discovered and retrieved.

Processing must be able to handle vast troves of both structured and unstructured data, sifting through what is relevant for which individual who is working on a specific investigation or lawsuit.

Data and findings must be neatly summarized in readable reports, analyses and presentations that are easy for lawyers and others to navigate, and that are also court-ready for presentation.

This is a tall order for IT, and one reason why many IT departments opt to outsource much of their e-discovery to an outside cloud-based legal service.

Cloud E-Discovery Options

If the decision is to seek an outside cloud service provider to administer the majority of e-discovery data and processes, there are several caveats that should be considered.

The first rule of thumb is to engage all e-discovery stakeholders in your company throughout the vendor selection process (e.g., legal, compliance, etc.). The selection emphasis should be first and foremost on the legal expertise and the capabilities of the provider to perform data safekeeping and to do the due diligence for e-discovery that the enterprise requires. Reviewing the technical capabilities of the cloud provider can come later.

Once a legal platform is decided upon, vet the cloud provider for data and processing privacy, security, cost, etc.

On the IT side, test the provider's ability to send data securely to and from the cloud, as well as the support and working relationship that will exist between IT and the cloud provider.

Throughout this process, and after the cloud provider begins to perform their work, IT must be ready to assume the management of both the process and the cloud provider, because no one else in the enterprise can do this job as well.

Summary Remarks

E-discovery is just one of several new processes that IT must assume responsibility for with the advance of digitalization.

E-discovery has a direct impact on the IT budget in terms of increased data storage costs, possibly new software and additional person-hours that might be required to manage data and search engines for e-discovery. Plus, plan for the potential procurement of outside legal cloud services, and budget for that without sacrificing other critical areas of IT spending.

The e-discovery market is expected to grow at a rate of 8.7% CAGR between now and 2027, so, while companies are paying attention to it, it still lags other corporate priorities. However, like disaster recovery, all that is needed to bring e-discovery front and center is a major legal challenge or an internal investigation that instantly makes it more important than anything else. If and when this happens, the board and the C-suite will turn to IT.

What to Read Next:

Crash Course on E-Discovery for CIOs and CDOs

Data Breach Settlement: Manufacturing Company to Pay $1.75M to Employees

When (and if) to Sue Your Cloud Provider