This article can also be found in the Premium Editorial Download "Storage magazine: Learning data retention lessons from Warner Bros.."
Download it now to read this article plus other related content.
A 30-day or 60-day deletion policy is irrelevant once the court discovers copies of data outside the boundaries of the company's deletion policies. "It's not what you should have been doing but what you actually have that matters," notes Diamond. He recommends companies ban the use of external storage media wherever possible and document this practice. "It makes it harder for users to move data, but it protects the company," he explains.
Oliver at Pooley & Oliver LLP adds that companies must come up with destruction policies and implement them before they get into litigation. "It's easy to come up with a policy, but you must execute on it," he says. It requires close integration of management with IT groups, and there's often tension between the policy and the employees of the company (see "Data destruction best practices," below). Stories abound of firms preparing for litigation and shredding paper to "look clean," he says. The problem is, "there's always a copy somewhere; it's hard to keep these things contained," he adds.
|Data destruction best practices|
undermine the stated legitimate business reasons for the policy.
Oliver tells the story of a "major name brand" on the East Coast that never thought about the scope of the documents its employees were hoarding. It received a discovery request and had the standard 30 days to respond. The firm paid $1 million a month to Pooley & Oliver to have a crew of lawyers go through boxes and boxes of email printouts. Another example was a CEO about to make a deposition who suddenly revealed that he had his own personal email archive. "We had to sift out all the privileged documents ... that was a fun all-nighter," jokes Oliver.
David Bayer, VP of marketing and alliance development at Stratify Inc., a legal discovery software provider, suggests that if you're going to have a shred day "make sure it has a policy around it."
This was first published in August 2007