The Business Side of Security

About this Blog:

A look at efforts to make security a business process.

Bob Bragdon

eDiscovery: Watch out for FRCP changes!

to Identity Management |

In case you haven't noticed there have been some changes to the Federal Rules of Civil Procedure (FRCP), specifically rules 26 and 37. These rules govern the production of materials in a civil lawsuit during discovery. For those not admitted to the Bar yet, discovery is he compulsory disclosure of pertinent facts or documents to the opposing party in a civil action, usually before a trial begins. The reason I call your attention to these changes is that they define some fairly significant rules for electronically stored information (ESI).


For example, if you are sued by a former employee for wrongful termination you may be compelled during the discovery phase of the suit to produce all documents relating to that individual's work performance. This use to mean their personnel records and copies of any written correspondence (memos, letters, etc.) concerning the performance of that employee. Over the past several years there has been some level of debate over what a "document" is given that most records now reside in electronic format. It's sort of like the debate over what "is" is...it depends upon how it is used. What the FRCP changes do is to say that ESI is now clearly subject to discovery. It goes further to say that all data is subject to discovery regardless of storage format or location: e-mail, instant messaging, PDAs, laptops, etc. all fall under this. And there's more.


My prediction is that this will have a significant impact on how businesses store and maintain their data. FRCP Rule 26(f) says that businesses must have clear policies around data retention so that they can easily identify what data is applicable to a discovery motion. When a business cannot produce data subject to discovery that they should have had, subject to their own policies, they care subject to fines or other court sanctions.


For a business that does not have a retention policy in place right now, the burdens of this can be significant from both a cost and technology standpoint. And, I would wager that 90% of US businesses have not addressed this problem. It remains to be seen the true impact these changes will have...we'll have to wait and see how the case law falls out. But, in the meantime, I advise you to look at your own organizations and make sure that you understand what ESI you need to be maintaining, determine its business need, have a legal hold policy in place (stops the destruction of data subject to pending or anticipated lawsuits), have an understanding of your statuatory and regulatory document retention requirements, understand the varying statues of limitations, have a policy, and have a records retention and destruction schedule.


Here's a quick recap of the changes and their impacts:




  • Rule 26(b) - identifies electronically stored information (ESI) as being subject to discovery in a civil lawsuit, wherever that data resides: e-mail, PDAs, laptops, IM, archives, etc.



  • Rule 26(b)(2) - addresses the discovery of data that is not "reasonably accessible" so that it can be addressed up-front and determined by the parties whether it should be produced



  • Rule 26(b)(5) - covers the retreival of provledged information that was produced inadvertently during discovery



  • Rule 26(f) - requires that businesses know exactly where data and records are, what policies are in place to control the retention of those records, and requires a meeting between the parties to the lawsuit with 120 days of the suit being filed to negotiate discovery issues



  • Rule 37(f) - provides a "safe harbor" for the inadvertent destruction of ESI and documents but requires that businesses have a compliant records management program - which may be reviewed by the court



Please let us know how your organizations are addressing this issue.

Print
What is Tech Briefcase?
TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more
Bookmark content
Speed up your research efforts with content across the web.
Search and Store
Find the white papers you need. Create folders for any topic.
View Anywhere
Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.
Don't have an account yet?
WHITE PAPER
Reduce Email Archives up to 60%

Clearwell Are you considering implementing a proactive archiving and eDiscovery solutions? This paper summarizes 15 separate soft cost savings when implementing Symantec Enterprise Vault and the Clearwell eDiscovery Platform.

» Learn More

WHITE PAPER
Aberdeen Report: To Patch, or Not to Patch? (Not If, But How)

Secunia The report explores the correlation between the current use of patch management and the level of endpoint-related risk that companies are effectively accepting.

» Learn More

Browse CSO Blogs

See all CSO Blogs »

Recent Comments

RESOURCE CENTER