IAPP-GDPR Web Banners-300x250-FINAL

Patricia A. M. Vinci

During the past two decades, privacy professionals have witnessed technological changes in the way business records are created, maintained and regulated, requiring adaptations to their privacy management practices. During that time, parties to litigation and the courts have wrestled with the issues surrounding electronic documents. On December 1, 2006, the Federal Rules of Civil Procedure were revised to address specifically, for the first time, the area known as electronic discovery. This article provides an overview of the prominent role electronic data now plays in litigation and the implications for all data types.

Generally speaking, "discovery" refers to that part of a legal proceeding during which the parties are required by law to produce relevant information in their custody and control. Production of information takes place in many different legal situations, including civil cases among companies and individuals; criminal prosecutions; and government agency investigations. Production also may be required in other circumstances. Internal company investigations, and merger or acquisition due diligence, are two examples. The "electronic" part of electronic discovery refers to information stored electronically, as opposed to hard copy (paper). Studies show that more than 90 percent of new information is now stored on computers and computer storage media, and in huge volumes. The term now used in the U.S. to refer to this data is "Electronically Stored Information" or ESI, as a result of the amendments to the Federal Rules of Civil Procedure. Although this article focuses on ESI, the principals outlined here can apply to all forms of information.

The Fulbright & Jaworski 2005 Annual Trends in Litigation Survey found that nearly 90 percent of U.S. corporations were engaged in lawsuits with electronic discovery — the number one concern of corporate counsel. One of the reasons that ESI causes such alarm is its volume. Massive volume is a result of a number of factors, such as numerous and proliferating sources of ESI; multiple reproduction of the same item; ease of creation and retention; and the relative low cost of storage compared to the paper volume equivalent. Electronic discovery is a deceptively simple term for a complex undertaking that can frustrate lawyers and their clients unprepared to meet the legal obligations of any ESI production scenario.

By combining their knowledge of the changing privacy landscape with an understanding of electronic discovery, privacy professionals can contribute to their companies' electronic discovery preparedness. One way to understand the importance of the electronic discovery process and its impact on any participating organization is to start at the end of the ESI story, when ESI is offered as evidence. All relevant information involved in the situations described previously is potential evidence. However, it will not be useful as evidence unless its origins can be reliably confirmed, that is, legally authenticated. Electronic evidence, such as email messages, memos and spreadsheets, must be authenticated to be useful evidence. But ESI is intangible, despite the fact that we see portions of it on our computer monitors. Therefore, knowing the possible end of the story (ESI as evidence), this article reviews the process from the perspective of a company's counsel charged with the task of conducting electronic discovery on behalf of a producing corporate client.

Preservation of ESI
Clients' and counsels' discovery responsibilities may begin even before a formal notice of legal action. Some jurisdictions require the preservation of potential evidence when the possibility of litigation becomes known or can reasonably be anticipated. In the discovery context, preservation of information is the company's first and fundamental duty.

The competent fulfillment of that duty must begin with the company's record retention and destruction procedures. Privacy experts within a company often possess detailed insight into the Records Retention Policy and Procedure, especially if they have participated in its creation, revision, maintenance and/or oversight. That expertise can prove crucial to the company when lawyers communicate the requirement of a "litigation hold," which is the suspension of routine document retention and destruction policies for the purpose of saving all potential evidence from destruction or alteration. "Spoliation" of evidence (its alteration or destruction) can result in serious consequences to both the company and its counsel, such as monetary sanctions and presumptions of law against the company (such as the inference of deliberate destruction). It is neither enough as a legal matter, nor as a practical matter, to tell certain individuals within an organization to "place a hold" on its destruction schedule. Detailed instructions must be promptly articulated to everyone in the company who may have access to relevant information. The definition of relevant will vary from case to case and must be delineated in several ways.

All possible sources of relevant ESI must be identified. ESI resides in many locations, such as: desktop personal computers' hard drives; laptop computers; handheld devices (any personal digital assistant "PDA"; mobile phones); email systems; servers; backup and archival tapes and other such media; CDs; DVDs; disks (e.g. floppies, Jaz, zip); voice mail files and their back-ups; and instant messaging records. This step also requires that key individuals (custodians) in the particular matter are identified and their information is given special preservation attention. The scope of the preservation duty is broad. It encompasses information not only known to be relevant to pending claims and defenses, but also that which is reasonably calculated to lead to the discovery of admissible evidence, and is reasonably likely to be requested. The Federal Rules of Civil Procedure require counsel to "meet and confer" about their lawsuit's electronic discovery and to make detailed disclosures. These mandatory meetings and disclosures occur very early in the life of the case. Including an e-discovery consultant sooner rather than later can keep the focus on the merits of the case and save the company time and money in the long run.

Collection of the discoverable information is next. The process of acquiring needed information must be done in a forensically sound manner, usually accomplished by experts, so that no ESI is inadvertently altered, destroyed, or missed, and so that the chain of custody is documented and preserved. Again, think ahead to the end of the story, when the company's attorney needs to use a particular email message as evidence in the company's defense. Success at that point may turn on proper collection techniques that took place early in the discovery process. Winning pre-trial discovery disputes may depend upon the effectiveness of the litigation hold and upon the historic, consistent implementation of the records retention policy. That policy must have demonstrated both the detailed, systematic control of information plus defensible compliance with the retention and destruction schedule prior to the start of the litigation hold.

Culling, Processing, and Reviewing
These steps are best accomplished by using the consulting, processing services, and tools offered by electronic discovery experts who have the know-how to manage large volumes of ESI as potential evidence and can deliver many types of ESI in a format that counsel can review before producing to a requesting party.

A Starting Point
Privacy professionals can enhance the company's readiness strategy with their specialized knowledge in areas such as information security, privacy, and data transfer. The benefits of anticipating and preparing for ESI discovery are many and include: future cost savings; process efficiency; minimal business interruption; litigation control; avoidance of sanctions and the resulting publicity; and risk management and assessment. Unprepared organizations may indeed look back upon the experience as overwhelming, when the company and its people were drowning in massive, disorganized amounts of data, searching for information with possible relevance. However, armed with the knowledge of what to expect, any company can both do business and be litigation-ready at the same time.

Patricia A. M. Vinci, Esq. is Counsel, Pitney Bowes Litigation and Document Services, part of Pitney Bowes Legal Solutions. PBLS is a leading single source provider of litigation and document services for law firms and corporate clients. Vinci's responsibilities include electronic discovery law, corporate contracts, and records retention. She can be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it


This article should not be construed as providing legal advice or legal opinions. You should consult an attorney for any specific legal questions.


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Advertise in IAPP Publications

Find out how to get your message in front the people you want to reach. Download a media kit now.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Registration Open

New! Intensive two-day GDPR training led by the sharpest minds in the field. It's a can't-miss event.

The Congress Is Cancelled

The IAPP Europe Data Protection Congress 2015 is cancelled. Click through to learn more.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»