United States: Managing Risks and Cutting Costs: Remediation of Legacy Data
(Tip of the Month: January 2009)

Originally published January 2009

Keywords: Electronic discovery, records management, legacy data, data retention, legal hold policy,

The Electronic Discovery & Records Management (EDRM) practice at Mayer Brown LLP is pleased to bring you the first edition of our "Tip of the Month" series. These monthly tips will provide you with best practices and other information about effective risk and cost management practices associated with EDRM.

Scenario:

In 2005, a government investigation of a company was initiated and class action litigation quickly followed. In response to the investigation and litigation, the company pulled backup tapes, de-activated the auto-delete function for its email systems, and imaged dozens of employees' hard drives. Four years later, the investigation has been dormant for some time, and the class action litigation has now mostly settled or has otherwise been dismissed, but some opt-out litigation remains active. Now, due to cost-cutting initiatives at the company, Information Technology and Records Management are demanding that Legal provide authorization to return to normal retention practices.

The following addresses the costs and risks associated with "legacy data," and the steps to be taken to remediate legacy data.

Risks and Costs Associated with Legacy Data

Remediation of legacy data is becoming an increasingly important component of effective information management policies and procedures. Legacy data generally consists of data that was retained outside an organization's routine records retention schedule and beyond any useful business purpose it once may have had, and yet continues to be retained due to fear that some small part of it might be relevant to pending or threatened litigation.

The discovery rules now require transparency for sources of data that are not "reasonably accessible." As a result, unnecessary retention of legacy data exposes an organization to the risk of being forced into expensive fishing expeditions in litigation, particularly where knowledge about legacy data sources is limited. Moreover, the retention itself can result in substantial costs that often are hidden or not fully appreciated because they are dispersed across an organization in different departments or business units.

The continued retention of legacy data also undercuts the purposes of the records management policy and increases the risks and costs of data management itself. The cost to store and maintain large quantities of data can be significant, and the burden and costs for retrieving relevant data increases with the volume of legacy data. The risk of losing, or simply being unable to locate, the useful data also increases.

Additionally, unnecessary retention of legacy data complicates, and can add dramatic expense to, unforeseen litigation.

• In-house and outside counsel are required to analyze legacy data as part of their required "reasonable inquiry" into sources of potentially relevant information in order to make accurate representations and disclosures to adversaries and courts.
• To the extent that the legacy data appears likely to contain relevant evidence that is not available from more accessible sources, it will be necessary to disclose the existence of the legacy data to adversaries and the court. This transparency must be volunteered, even absent an inquiry from the adversary.
• Once the legacy data is disclosed, adversaries have a road map for where to exert pressure in discovery. This will often lead to expensive motion practice, which can lead to data sampling and even expansive data restoration and discovery.
• There is also the risk that the legacy data will be lost or destroyed through inadvertence. If a court finds that there was neglect, or worse, the organization may be subject to spoliation charges and related sanctions.

Steps Toward Remediation of Legacy Data

The goal of a remediation project is to identify and segregate that portion of the data that may be subject to active legal holds, and to discard the rest in order to bring the legacy data into compliance with record retention policies.

Create legal hold portfolio. Every organization should have a written protocol or policy for managing legal holds, including issuing, enforcing and lifting legal holds. It is essential to know information about the legal holds that are currently in force, and what they cover, because the main impediment to discarding legacy data is the potential applicability of legal holds. Information collected about legal holds should include:

• the individuals subject to the legal hold;
• the databases and other systems subject to the legal hold;
• business units impacted by the legal hold;
• the kind of evidence that is relevant;
• the relevant date range; and,
• any other information that would be helpful in determining which legacy data is and is not on legal hold.

Software and database tools are available to help manage and track this information about legal holds.

Analyze legacy data. The legacy data should be analyzed and, to the extent practicable, identified, organized and catalogued; there are many different forms of legacy data so many different approaches are available.

• The first priority will be to remediate legacy data that, based on a high level analysis, can be ruled out as subject to legal holds (e.g., outside relevant time period, custodians that are not relevant). It may be necessary to sample other data to make a determination whether it is, in whole or in part, subject to a legal hold.
• Sources of data that do appear to contain relevant information may be retained and disclosed in relevant cases. Alternatively, a search protocol may be developed to segregate the irrelevant data so that portion can be remediated.
• To further mitigate risk in either case, it can make sense to inform adversaries in material litigation, and the court if a dispute erupts, of the intent to dispose of legacy data.
• To the extent that some of the legacy data will be retained long term, it can reduce costs and facilitate future disposition to organize and catalog the data. It also can be useful to collect the legacy data in a central location, and to integrate the catalog with the litigation holds management system.

Following these steps can result in a successful legacy data remediation project that significantly reduces the costs of storage, the cost of accessing retained documents and the risks associated with disclosure and production in the event of government investigations or litigation.

Learn more about Mayer Brown's Electronic Discovery & Records Management practice.

Visit us at www.mayerbrown.com.

Mayer Brown is a global legal services organization comprising legal practices that are separate entities ("Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP, a limited liability partnership established in the United States; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales; and JSM, a Hong Kong partnership, and its associated entities in Asia. The Mayer Brown Practices are known as Mayer Brown JSM in Asia.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

Copyright 2009. Mayer Brown LLP, Mayer Brown International LLP, and/or JSM. All rights reserved.