Revised Data Retention Rules

The ISC SANS Diary mentioned New Data Retention Rules in an entry yesterday. As frequently occurs when reading an article on one site, a link leads to another and yet another site. The ultimate destination on this occasion was the Newsletter of the U.S. Federal Courts, "Electronically Stored Information Target of New Rules",Vol. 38, Number 11 — November 2006.

For many years, one of the duties in my "work life" has been records management. In years past, we were a "paper society". With a computer on most office worker's desk and a laptop in the hands of most executives, we seem to be producing volumes more data than ever before. Thus, as an individual, and not an attorney, I can appreciate the five amendments the Advisory Committee on Civil Rights had reported to the Judicial Conference:

"(1) requiring parties to give early attention to issues relating to electronic discovery, including the form of production, preservation of information and problems reviewing electronic information for privilege;"

"(2) relieving parties from searching for inaccessible electronic information, e.g., information on backup tapes;"

"(3) retaining privilege protection for documents inadvertently disclosed;"

"(4) requiring parties to agree on the form of production of electronic information or present the issue promptly to a judge for determination;"

"(5) limiting sanctions for loss of electronic information as a result of routine operation of computer systems, e.g., automatic purging of e-mails."

Early agreement on the method of producing electronic data during the discovery period is beneficial to both sides of the table. In the event such an agreement includes converting paper documents to electronic, arrangements for scanning and conversion to PDF files can be expedited. Situations where the volume of electronic data is significant, it is likely that a server will be needed for storing the data prior to submission. Having time to make such arrangement can be significant in meeting critical deadlines.

Similarly, where agreement cannot be met on the form of electronic information, having the channel of submission to a judge for determination (Item 4) should result in a monitored process of negotiation.

From my perspective, item numbers (2) and (5) ("relieving parties from searching for inaccessible electronic information, e.g., information on backup tapes" and "limiting sanctions for loss of electronic information as a result of routine operation of computer systems, e.g., automatic purging of e-mails") significantly reduce the strain on the IT organizations. Companies with sound records management policies in place, neither retain backup tapes in long-term storage nor maintain e-mail logs indefinitely on company servers. In addition to degradation to the media over time, the costs of the server space alone is prohibitive to long-term storage. Further, as both hardware and software become obsolete, maintaining the means for retrieval becomes exceedingly difficult.

In the realm of the corporate data retention policy, employees must keep in mind that data stored on both their office desktop or laptop computer as well as their personal home computer are "discoverable" and subject to corporate records management policies. Thus, should you "work at home" and "records management time" comes around in your company, you are also responsible for proper disposal of obsolete documents on your home computer. As handy as it may be to replicate your office electronic mail file to your computer hard drive, remember that it will then be subject to discovery in the event of litigation.

Although some attorneys may not be in favor of the revised data retention rules, I appreciate the significance of having national rules to provide uniformity within the courts. Situations where requirements differ from state to state places an undue burden on IT organizations to meet such individual state rules.