A Capital Novus White Paper
Revised Spring, 2012

Envision this scenario. A company with nationwide operations generates huge amounts of electronically stored information as a necessary result of its day-to-day functions. The company’s IT department routinely and prudently backs up that information to tape. This is as it should be. Those tapes are the company’s insurance against costly, crippling data loss in the event of server failure.

The IT team recycles the backup tapes on a well-defined schedule. Again, this is as it should be. The alternative would be to buy so many new tapes and store so many old ones that the expense would be ruinous.

Then the company is sued. Let’s say that employees in California bring wage-and-hour claims that necessitate discovery of electronic information – HR records, Accounting records, on and on.

The plaintiff’s bar smells blood. Employees in Texas and Illinois bring similar actions in their state courts, each with its own requests for production. Before long the company faces a dozen or more overlapping litigation holds that render the IT department’s tape recycling schedule moot. There will be no recycling, no destruction of information on those tapes, until the cases are settled which may be months or years in the future. Meanwhile the meter runs – new tape purchases, additional storage costs, additional IT time and energy, additional effort to manage retention schedules that have been thrown into chaos.

How does a company comply with multiple litigation holds while retaining some semblance of control over its backups? This is a dilemma that is becoming all too common – perhaps one that your organization will face.

A company that is caught in this bind must necessarily seek a way to reduce the amount of legacy data without destroying data that is potentially relevant to any of the various litigations. This is easier said than done. It may be reasonable to negotiate with opposing counsel or to petition the court for approval of a solution. While this approach may sometimes bear fruit, that is the exception not the rule.

Managing a reduction effort is fraught with potential exposure to spoliation liability. This is partly because of the inherent difficulty of the task, but even more because of the challenges posed by adversaries attempting to take full advantage of any misstep. The effort requires a cautious application of the corporate risk management function. To be fully defensible a procedure for the reduction of legacy data must be:

1. Transparent on its face
2. Designed to reflect good faith and a neutral mindset
3. Founded upon a wholly reasonable legal analysis (in conformity with prevailing decisional law and best practices)
4. Fully protective of relevant data requiring preservation
5. Considerate of the contingency of “extraordinary circumstances”
6. Applied only to data that is unnecessary to retain.

In practice the reduction effort must surmount two significant challenges:

1. It must employ a valid process for determining what legacy data has no litigation value.
2. It must be rigorously documented with a historical record from beginning to end.

The Reduction Process

After the company has established its guidelines for what data should be destroyed, the next step is to devise a means of identifying which media in the data stores meet the criteria for destruction. In most cases this means taking a sample of the media, restoring the content of the tapes, and evaluating that content against the guidelines for preservation/destruction. How should the sampling take place? There are two important considerations here:

1. The sample size
2. The sampling methodology, i.e., how the sample is selected

When determining the size of the sample set of media to be investigated, the most important consideration is that the sample be small. Reviewing the relevant decisional law, the cases that have addressed the issue of sample size hold, in the main, that the purpose of sampling is not that the results be submitted into evidence, but rather to demonstrate cost, overall burden, and likelihood of recovery of relevant data. Therefore, a smaller set, less onerous to capture and manage, is acceptable.

By definition a sample will provide an incomplete picture of the precise quantity of discoverable information existing on backup tapes. It will provide concrete information on a subset of the tapes, and presumably a reasonably reliable indication of whether further restoration and review and the burden involved is justified.

Optimally (from the perspective of the company being sued), the result of the sampling will support the unlikelihood of recovering new relevant data, the prohibitive cost, and the overall burden of the process of restoring and investigating backup tapes, when one “balances all the equities.”

Typically, the actual size of the sample set is less significant than the sampling methodology, i.e., the manner in which the sample set is selected. The Sampling Methodology involves 3 primary considerations:

1. The sampling method should conform with techniques found in the established case law;
2. To the extent possible, the sampling methodology should be crafted in a manner appropriate to the facts of the legal disputes;
3. Selection of the sampling method must involve an examination of the manner in which data has been backed up on the system(s) (i.e., how the backup tapes are organized; how data is distributed across backup tapes; the server sets backed up; whether the backups are full backups, incremental backups, global snapshots, TSM-type backups with multiple randomly selected tapes comprising one full backup set, etc.)

We suggest that the first sampling method to be considered for reduction of legacy data should be based on systematic non-random selection, also called the nth name sampling technique. In this method, after the sample size has been determined, every nth record is selected. As long as the data set is not ordered in a way that makes this technique result in a non-representative sample, systematic selection results in a sample that is as useful as a random sample and is simpler to effect.

This methodology is marked by the deliberate selection of backup tapes for sampling that is calculated to capture the largest quantity of potentially responsive data. Neither the court nor opposing counsel would countenance a methodology that deliberately minimized the quantity of potentially responsive data.

Supplemental notes on sampling methodology:

• Category of Tapes: the methodology may involve selecting a specific category of backup tapes, such as those associated with targeted custodians or specific servers.
• Time Frame of Tapes: the methodology may also include incremental sampling which involves restoring and reviewing data from tapes that are separated from each other by intervals of time. The validity of this approach is based on the likelihood that such tapes are more likely to contain different data sets.

Typically sampling can be accomplished by conducting a search with a list of key words and phrases on differentiated sets of tapes that fall within designated categories. A more broad-based approach where search protocols are applied across the entire universe of media may be used as well.

A significant obstacle to the reduction of legacy data is the intimidating size of the undertaking upon initial viewing. One way to surmount this obstacle is to proceed in increments, undertaking the reduction of the legacy data stores that are the most amenable to a solution based on the principles set forth in this writing. Such an approach has the benefit of creating the authentic perception that the organization is proceeding with appropriate caution to grapple reasonably with a highly complex situation.

The Historical Record

To meet the second challenge set out above, the steps in the formulation and execution of a data reduction plan must be detailed in a historical record. To a large extent, this is a matter of understanding and documenting the actual burdens and dangers confronted by the corporation.

The historical record should include information about:

1. The existing inventory of legacy storage media affected by the litigation holds;
2. The burdens faced by the corporation in maintaining the legacy data stores and the reasons for data reduction;
3. The decision making process that went into the selected data reduction methodology;
4. A comprehensive description of the reduction plan itself, fully documenting the actual process of data reduction, sampling protocols, and documentation that the plan was actually complied with;
5. A description of the projected costs and other burdens to be confronted in the course of disposing of unnecessary data;
6. A description of the determining factors considered in making the final cost-benefit calculations (with a focus upon the procedures put into effect to assure that data that must be preserved is not lost or otherwise compromised);
7. The opinions about the process tendered by outside counsel and third party experts.

Two additional sets of documentation should be maintained:

1. Approvals: written approval for the disposition of legacy data from business managers, counsel and other interested parties (experts, opponents, courts, regulators, etc.) when appropriate
2. Destruction Certification: documentation of the data disposed of with a “Destruction Certificate” (commonly used in the disposition of paper records) or other documentation specified in the organization’s records management policy.

Safe Harbor

It is worth recalling the Safe Harbor concept memorialized in the amendment to FRCP 37 wherein reliance upon a neutral, good faith records management system provides a sanctuary from spoliation, absent “extraordinary circumstances” (such as a litigation hold). This concept should be considered to include both the use of automated systems to dispose of electronic records as well as “manual” systems to cull and dispose of data.

A reasonable, transparent and neutral system by which legacy data stores are investigated and reduced may well fall under the rubric of a Safe Harbor. Such an argument may be open to attack because of “extraordinary circumstances”, but it is reasonable to demand that those circumstances be balanced against the expense the company would incur by being forced to maintain all legacy data in perpetuity.

In sum, the impact of The Safe Harbor Rule should be considered in calculating risk.