Document Retention In The Digital Age: How Long Is Long Enough?

The advent of the “paperless society” has been a boon for fastidious record keepers and the lazy alike. With storage capacity expanding to unfathomable dimensions and storage costs per bit of data approaching zero, the incentive to discard, at least at first blush, has been virtually eliminated. However, another trend, the rapid increase in the number of lawsuits, as well as the ever-present risk of government enforcement actions, provide ample justification for doing more than retaining indefinitely an undifferentiated mass of electronic documents. Retrieving data in response to a request for “electronic discovery” in private litigation or in response to a government investigative demand, and the attendant review of that data by attorneys for responsiveness, privileged communications, and confidential business information, could be extremely costly. At the same time, any business person who recalls the 18-minute gap in the Watergate tapes or the rapid demise of Arthur Anderson will recognize that the inability to produce key documents when called upon to do so can be damning not only in the courtroom but in the arena of public opinion as well.

A Recent Federal Court Decision Sheds Some Light on Data Retention Requirements

A recent employment discrimination case in the federal district court in Manhattan, Zubulake v. UBS Warburg LLC, illustrates the potentially high cost of determine just how much and which data should be retained. In that case, a securities trader, Laura Zubulake, charged UBS Warburg (“UBS”), her former employer, with gender discrimination and retaliation. Zubulake requested, in discovery, the production of all communications, including e-mail, relating to her that were sent or received by five specified employees over a two and one-half year period.

UBS estimated the cost of restoring and searching backup tapes potentially containing responsive e-mail at $166,000 and the cost for attorney and paralegal review of all retrieved e-mail at $107,000. In other words, responding to just one discovery request would cost UBS more than one-quarter of a million dollars. To complicate matters further, key UBS employees had deleted e-mail responsive to this one discovery request from their active files despite instructions not to do so and UBS determined that seven backup tapes potentially containing responsive e-mail had been destroyed, setting the groundwork for Zubulake's request that the court sanction UBS for destroying evidence.

Guiding Principles for Allocating the Cost of Electronic Discovery

In four separate opinions, issued between May 2003 and July 2004, the court laid out several guiding principles for allocating the cost of electronic discovery: The court's thorough analysis and deep expertise in the subject of electronic discovery will likely result in these guiding principles being adopted by courts throughout the United States. Because one principal purpose of a data retention and destruction policy is to reduce the cost of electronic discovery, these principles should have a significant impact on the policy's development.

The guiding principles include the following:

• Electronic documents are subject to civil discovery in the same manner as paper documents;
• The responding party must bear the entire cost of producing accessible electronic documents, i.e., documents stored in a readily usable format, such as active computer files or optical storage;
• The court will shift some, or all, of the cost of producing inaccessible data, i.e., data that must be restored or otherwise manipulated to be usable, such as data on backup tapes created for disaster recovery purposes, to the requesting party only if the responding party proves that the discovery request imposes an “undue burden”;
• The burden of production is “undue” when it outweighs the likely benefit of the discovery taking into account the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues;
• The cost of attorney and paralegal review of accessible data and of inaccessible data after it has been restored to a usable form will not be shifted from the responding party to the requesting party.
• Applying these principles, the court imposed on UBS seventy-five percent of the $166,000 cost of restoring and searching backup tapes for the pertinent time period and the remaining twenty-five percent on Zubulake. The court also ordered UBS to pay the $107,000 in attorney and paralegal fees for document review. The court's decision to impose any cost on Zubulake was driven largely by her high income while working at UBS ($650,000 annually) and by the substantial damages that she sought to recover (allegedly exceeding $15 million) -- facts that will not be present in most employment discrimination lawsuits.

Guiding Principles for Effectuating the Duty to Preserve Relevant Evidence

The court also provided important guidance concerning a company's duty to preserve relevant evidence. In ruling upon Zubulake's request to sanction UBS, the court explained that a business must impose a “litigation hold” on routine data destruction in certain circumstances. This “duty to preserve” records arises at a minimum when a business receives notice that a formal administrative or judicial proceeding has been filed and, even sooner, if the business has reason to believe that litigation is on the horizon, for example, upon receipt of a demand letter.

This duty to preserve does not extend to every document and bit of data. Documents and data in accessible format when notice is received, or created thereafter, must be retained only if prepared by or for those employees who will be the “key players,” i.e., the principal witnesses in the litigation, or if the data otherwise is or will be discoverable in the litigation because the data is itself relevant or may lead to the discovery of admissible evidence. Backup tapes created for disaster recovery purposes generally may continue to be recycled as provided in the company's data retention and destruction policy. Backup tapes that are regularly used for information retrieval most likely would be subject to the “litigation hold.” Once the duty to preserve attaches, both in-house legal staff and outside legal counsel must take proactive steps to ensure that relevant evidence is preserved, discovered and produced. They also have a continuing obligation to monitor employee compliance with the “litigation hold.” Counsels' obligations include the following:

• Make reasonable efforts to prevent the destruction of discoverable information. Not only must the “litigation hold” be timely issued, particularly to the “key players,” it must be reissued periodically for the benefit of new employees and as a reminder to existing employees.
• Take reasonable steps to identify and search all sources of discoverable information. Typically, counsel should meet with each of the “key players” to determine how each of them stores relevant data and to uncover all potential sources of relevant information. When such interviews are not feasible, counsel must take alternative steps, such as searches of the client's database using a broad list of names and other search terms, to locate discoverable information.
• Meet with the client's IT personnel. At these meetings, counsel should discuss the actual application of the client's document retention policies, such as system-wide backup procedures and the schedule for recycling backup tapes;
• Instruct employees to produce relevant electronic documents. The instruction should encompass all active files, backup tapes containing accessible data, and inaccessible backup tapes that may contain discoverable information that is not stored elsewhere.

Failure to comply with these obligations could result in a range of sanctions. One sanction is self-imposed: employees who are deposed before all relevant documents have been discovered may provide testimony contradicted by later-discovered records, undermining their credibility at trial. In addition, the court may permit plaintiff's counsel to reopen a deposition or take additional depositions, at the employer's expense, to question witnesses about newly discovered evidence.

The willful, or even negligent, destruction of evidence could result in the severe sanction of an “adverse inference instruction.” When this sanction is imposed, the court instructs the jury that it may draw the adverse inference that the party who destroyed the relevant evidence did so out of a realization that the evidence was unfavorable, raising what the Zubulake court called a “virtually insurmountable barrier” for the target of the instruction.

The court in Zubulake ultimately imposed a panoply of sanctions on UBS after finding that “key players” had destroyed relevant evidence despite instructions from counsel not to do so and that counsel had failed to discover important evidence, to communicate the litigation hold to one key player, and to prevent the destruction of backup tapes containing relevant evidence not available elsewhere. The court granted Zubulake's request for an adverse inference instruction, permitted Zubulake to take additional depositions and to re-open depositions to question witnesses about newly produced evidence, ordered UBS to pay the costs of those depositions, and ordered UBS to pay the costs of the motion for sanctions.

The Elements of an Effective Data Retention and Destruction Policy

With the principles enunciated in the Zubulake case as a backdrop, the starting point for controlling the monetary and non-monetary costs of data retention, retrieval and destruction and for reducing the risk of discovery sanctions is an effective data retention and destruction policy. This policy should be drafted before litigation is on the horizon. Legal counsel, IT staff, and managers familiar with the electronic documents and storage practices of the employees under their supervision should participate in the drafting process. The legitimate business objectives underlying the policy's development should be carefully considered and documented to rebut any future charge that the policy itself is a fig leaf for the willful destruction of relevant evidence.

To further safeguard the business against a charge of improper document destruction and to reduce the cost of electronic discovery, the policy should achieve the following:

1. List All Document Retention Periods Established by Statute or Regulation. These retention periods will vary substantially based upon the sector within which a business operates and the types of records involved. Securities brokers and dealers, for example, are required to retain all business-related communications for three years, the first two years in an accessible format. Trucking companies must retain the results of employee alcohol tests for up to five years. All businesses must retain federal payroll tax records for at least four years from the date the tax is paid. Each business should carefully research and catalogue all applicable statutory and regulatory retention requirements and comply with them.
   
   
2. Establish Additional Retention Periods. Categories of information not subject to a statutory or regulatory retention period should be subjected to a specified retention period consistent with business imperatives. Key business documents most likely will be retained indefinitely. E-mail in accessible format, by contrast, should be subject to a short retention period — perhaps thirty days — unless earmarked for longer retention because of business needs.
   
   
3. Provide For the Routine Destruction of Documents and Data. Data and documents should be routinely destroyed upon expiration of a statutory or regulatory retention period or expiration of the period mandated by the policy. Backup tapes should be recycled on a regular schedule. Regular recycling will significantly reduce the need to restore and search inaccessible data, the most costly aspect of electronic discovery. IT personnel should ensure that backup tapes containing data subject to a statutory or regulatory retention period are destroyed only after the retention period has expired.
   
   
4. Encompass All Storage Media. Potentially discoverable data may reside on any form of storage medium — including network server, local hard drive, laptops, hand-held devices, optical disk storage, and backup tape. The policy should expressly apply to all of these media and specify variations in retention periods, if any, based upon the type of storage medium. For example, backup tapes containing e-mail for disaster recovery purposes typically should be retained for a longer period than e-mail saved to the network server or a local hard drive. If company employees “telecommute” and use their personal computers for work purposes, the policy should address documents stored on those personal computers as well.
   
   
5. Suspend Routine Destruction to the Extent Necessary When Litigation is on the Horizon. Once notified of actual or anticipated litigation, a business should identify all records related to the “key players” and all other categories of records most likely to be discoverable in the litigation. These documents should be preserved in accessible form to avoid the cost of restoration and retrieval from backup tapes. The “key players” should be instructed concerning the types of newly created documents that must be preserved. Counsel, with the assistance of IT personnel, should identify all forms of backup storage potentially containing relevant evidence. If the business can identify backup tapes that might contain discoverable evidence not available elsewhere, those tapes should be excluded from routine recycling. Doubt concerning whether to retain or destroy certain documents should be resolved in favor of preservation.

By limiting the total universe of data that is potentially subject to discovery, routine data destruction will help reduce the cost of responding to requests for production of information and reduce the likelihood that damaging e-mail will resurface during litigation. Routine data destruction in compliance with pre-established schedules, following the steps listed above, also should defeat a charge that discoverable evidence was improperly destroyed.

The following additional steps can further reduce the potentially exorbitant costs of electronic discovery:

1. Classify Data in a Manner Compatible With Search Capabilities. Under Zubulake, the responding party bears the entire cost of searching accessible data, and presumptively bears the entire cost of searching inaccessible data on backup tapes that have been restored. Given the enormous quantities of data involved, the search for responsive documents, unless automated, will substantially increase the cost of production.
   
   
2. Segregate Privileged Communications and Confidential Business Information. Responsive documents generally should be reviewed before production to ensure that privileged communications and other confidential business information are not produced to the adversary. In many civil cases, the volume of responsive documents can be substantial, making this “privilege pull” a costly exercise. These costs can be avoided, or significantly reduced, if privileged communications and other confidential business information are segregated when stored.

Once the data retention and destruction policy has been drafted, it should be uniformly enforced throughout the organization. Uneven application of the policy – for example, permitting high-level employees to destroy data more frequently than provided under the policy – could support a charge that the policy was intended to camouflage bad faith destruction of evidence. In addition, the business should ensure that all storage media assigned to departing and terminated employees are routinely examined upon the employee's departure. Records subject to a statutory or regulatory retention period, or to a “litigation hold,” should be preserved. Records retained for business purposes should be moved to the appropriate storage medium. All other data stored by the former employee should be destroyed.

Conclusion

Unlike Laura Zubulake, most employee-litigants do not earn $650,000 annually or possess multi-million dollar damages claims. In other words, employers can expect to bear the entire cost of electronic discovery in most employment lawsuits. Employers can lessen the monetary burden of electronic discovery and substantially reduce the risk of severe sanctions by implementing a data retention and destruction policy guided by the principles described above.

Philip L. Gordon is a shareholder in Littler Mendelson's Denver office. He has substantial experience litigating employment disputes involving federal statutory and constitutional claims, common law torts and trade secrets. He is also an expert on employee privacy issues and has written and lectured extensively on HIPAA privacy regulations, workplace surveillance of employees' electronic communications, and the European Union Data Protection Directive. Mr. Gordon, who is Chair of Littler's Privacy Practice Group, recently co-authored HIPAA Privacy for Employers, a comprehensive guide to assist employers in complying with the HIPAA privacy regulations.