This article originally appeared in the July 2022 issue of Security Business magazine. When sharing, don’t forget to mention Security Business magazine on LinkedIn and @SecBusinessMag on Twitter.
In business, we accumulate and sometimes preserve data. To manage all of it and comply with law, most sophisticated companies have data retention polices. Also known as a records retention policy, a data retention policy is a set of guidelines used by organizations to archive information generated or received by the organization and to set rules for how long that data should be kept.
Such policies are developed in accordance with internal, legal, and regulatory requirements. If your company does not have a data retention policy, you should prepare and implement such a policy.
Data retention policies help you manage the normal operations of a business; however, when a problem arises – such as anticipated, threatened or actual litigation – the guidelines in your data retention policy may not be sufficient or may have to be suspended.
Suppose someone alleges that you engaged in deceptive sales practices, performed a faulty security system installation, failed to monitor an alarm signal properly, or an employee contends that they were wrongfully terminated. In those circumstances, your data retention policy may be at odds with your duty to preserve documents and data in defense of the claim.
Legal Holds
When a duty to preserve documents is triggered, a document known as a legal hold notice may be issued. A legal hold notice (aka, a document and data preservation directive) is a formal notice to all affected personnel in your company of the legal obligation to preserve documents and information when litigation is pending or reasonably anticipated.
Legal hold notices come in at least two forms. The first is a notice that comes from your organization (usually from an inside or outside counsel). Among other things, an internal legal hold notice typically advises select recipients of the existence of a claim, identifies the documents (with varying degrees of particularity) which must be preserved, details the process by which relevant documents must be gathered, and provides a key contact to whom any questions should be directed.
The second form of legal hold is delivered by an opposing lawyer. In such a case, the notice is intended to threaten litigation or otherwise put the company on formal notice of a claim, and demand that all relevant documents be preserved. Notices from an opposing counsel often result in the issuance of an internal legal hold notice – as a notice sent by an adversary is not typically distributed to all affected personnel. Additionally, the internal legal hold will contain further guidance from the organization.
When to Preserve Documents and Data
Sometimes this is obvious – such as when an adversary sends a letter threatening litigation and demanding evidence be preserved. Other times, it may not be that clear – especially in the security industry. We deal in life safety. Alarm and other security incidents arise every day. Many are false, others may be real and may actually result in a loss or injury. Often, the security company does not learn of this in real time.
It is impractical to preserve documents indefinitely for every alarm or every security incident; instead, based on the particular facts of the situation, you should seek guidance from your attorney on when the duty to preserve is triggered.
Other Questions to Ask
How quickly should I issue an internal legal hold? As soon as litigation is reasonably anticipated, a legal hold should be put in place. The risk of failing to do this is that valuable data will be lost. A delay in preservation may result not just in lost evidence your adversary, but it could result in lost evidence that benefits your defense.
Should I respond to an external legal hold notice? If an opposing lawyer sends a legal hold notice demanding that you preserve documents, you do not need to cede to it. First, you may want to reply in writing to demonstrate what you are doing to preserve documents. This may help you later if the adversary tries to claim that you failed to preserve documents. Second, you may object to the notice – to the extent that it has no basis in fact, is overly broad, intended to harass or otherwise objectionable. That does not mean that you will not have a duty to preserve; rather, it may be that the scope of duty is not as expansive as requested.
How do I determine what is relevant? Determining what data to preserve is a fact-specific endeavor and depends on the nature of the claim; thus, for example, if the claim is that you engaged in deceptive sales practices, you should preserve all marketing materials, advertisements/commercials, and anything else published to consumer about your products and services. If, for example, the claim is that you failed to install a security product correctly, then you should preserve all account information, installation and maintenance records, and any other data generated by the product. Fortunately, the courts have recognized the duty to preserve is not unlimited; nevertheless, you should not be undertaking this obligation without the advice of counsel.
Are there any consequences for failing to preserve documents and data? An internal legal hold notice is not a get out of jail free card. You must actually preserve the information. The consequences for failing to preserve can be severe, such as sanctions in any resulting litigation. This could include a financial penalty or the loss of certain defenses. All personnel should be advised of these risks when receiving an internal legal hold.
Should I seek help? Litigation is serious – even when merely threatened. You certainly will need a lawyer, but you also may need an outside information technology consultant to manage the process. This may help later challenges are made to the methods you used to preserve and collect evidence.
Timothy J. Pastore, Esq., is a Partner in the New York office of Montgomery McCracken Walker & Rhoads LLP (www.mmwr.com), where he is Vice-Chair of the Litigation Department. Before entering private practice, Mr. Pastore was an officer and Judge Advocate General (JAG) in the U.S. Air Force and a Special Assistant U.S. Attorney with the U.S. Department of Justice. Reach him at (212) 551-7707 or by e-mail at [email protected].
