A 30-day or 60-day deletion policy is irrelevant once the court discovers copies of data outside the boundaries of the company's deletion policies. "It's not what you should have been doing but what you actually have that matters," notes Diamond. He recommends companies ban the use of external storage media wherever possible and document this practice. "It makes it harder for users to move data, but it protects the company," he explains.

Oliver at Pooley & Oliver LLP adds that companies must come up with destruction policies and implement them before they get into litigation. "It's easy to come up with a policy, but you must execute on it," he says. It requires close integration of management with IT groups, and there's often tension between the policy and the employees of the company (see "Data destruction best practices," below). Stories abound of firms preparing for litigation and shredding paper to "look clean," he says. The problem is, "there's always a copy somewhere; it's hard to keep these things contained," he adds.

Data destruction best practices

1. Establish a well-defined destruction policy and clearly identify the legitimate business reasons that support the policy.
2. Implement the policy on a consistent basis. Failure to do so could undermine the stated legitimate business reasons for the policy.
3. Maintain an updated database showing all sources of electronically stored information, the type of information stored, and details such as file names and date ranges.
4. Establish the means to quickly and adequately implement "litigation holds" on any electronic information that might be relevant to actual or likely litigation.
5. Designate a single management-level employee to serve as the company's representative on the issue of the organization's destruction policy--both the business reasons that support such a policy as well as the measures undertaken to meet litigation hold requirements. This person will serve as the organization's spokesperson on the facts that demonstrate "good faith" in connection with the organization's destruction policy.

Oliver tells the story of a "major name brand" on the East Coast that never thought about the scope of the documents its employees were hoarding. It received a discovery request and had the standard 30 days to respond. The firm paid $1 million a month to Pooley & Oliver to have a crew of lawyers go through boxes and boxes of email printouts. Another example was a CEO about to make a deposition who suddenly revealed that he had his own personal email archive. "We had to sift out all the privileged documents ... that was a fun all-nighter," jokes Oliver.

David Bayer, VP of marketing and alliance development at Stratify Inc., a legal discovery software provider, suggests that if you're going to have a shred day "make sure it has a policy around it."

< PREV PAGE   |   1  |   2  |   3  |   4  |   5  |   6  |   NEXT PAGE  >