e-discovery and document discovery basicsnycachca.com/.../e_discovery_social_media...basics.pdf ·...

E-Discovery Social Media and Document

Discovery Basics Presented by:

David Rohde, J.D., LL.M. March 11, 2013

Epiq Proprietary and Confidential

Objectives

• What you need to need to know about your employees use of corporate email, social media, and the Internet

• What it means when responding to regulatory and litigation demands

• Changes in the law and rules and how effective policies and processes can mitigate risk, lower costs, and give you greater control over both your brand and the information entrusted to your care

• Relate your role to the overall litigation context • Understand the legal realities around eDiscovery

Epiq Proprietary and Confidential 2

Objectives--Approach

• Litigation/Regulatory Framework – Context – Process – Costs

• Litigation Readiness – Risk management/mitigation – Concrete steps

• Social Media – What – Where – Why – Risks – Unknowns


THE LITIGATION PROCESS

• Process: – Complaint – Motion to Dismiss – Answer – Discovery –

• Fact Discovery – Document Production – Depositions – Witness Interviews

– Motions for Summary Judgment – Pretrial Motions – Jury Selection – Trial


The Right to Electronic Discovery: Background

Courts • Federal Rules of Civil Procedure

– Effective December 1, 2006 – Impose significant obligations on clients and counsel

• State courts adopting new rules – Most modeled after the Federal Rules

• The right to electronic discovery is not new • “It is black letter law that computerized data is

discoverable.” Anti-Monopoly v. Hasbro, 1995 WL 649934 (S.D.N.Y. 1995).

• “[P]arties and their counsel are fully on notice of their responsibility to preserve and produce electronically stored information.” Zubulake v. UBS Warburg L.L.C., 229 F.R.D. 422, 440 (S.D.N.Y. July 20, 2004) ( “Zubulake V”).


Federal Rules of Civil Procedure: Electronically Stored Information (ESI)

• The 2006 Amendments to F.R.C.P introduced the term “electronically stored information”

• The Advisory Committee Notes further indicate that Rule 34(a)(1) "is expansive and includes any type of information that is stored electronically," and that it "is intended to be broad enough to cover all current types of computer-based information, and flexible enough to encompass future changes and development."


Disclosures and Discovery

26. Duty to Disclose; General Provisions Governing Discovery 27. Depositions to Perpetuate Testimony 28. Persons Before Whom Depositions May Be Taken 29. Stipulations Regarding Discovery Procedure 30. Deposition by Oral Examination 31. Depositions by Written Questions 32. Using Depositions in Court Proceedings 33. Interrogatories to Parties 34. Producing Documents, Electronically Stored Information, and

Tangible Things, or Entering onto Land, for Inspection and Other Purposes

35. Physical and Mental Examinations 36. Requests for Admission 37. Failure to Make Disclosures or to Cooperate in Discovery;

Sanctions Epiq Proprietary and Confidential 7

Discovery Process


Information Management

“Document retention policies, which are created in part to keep certain information from getting into the hands of others, including the Government, are common in business . . . It is, of course, not wrongful for a manager to instruct his employees to comply with a valid document retention policy under ordinary circumstances.” Arthur Andersen v. U.S., 125 S.Ct. 2129, 2135 (U.S. May 31, 2005).


Cost of Not Managing Information

• The costs of finding information are among the largest uncontrolled costs in any business

• Knowledge workers can spend up to 40% of their time looking for the right information with which to do their job

• Records and Information Management services transform a organization’s competitive agility and responsiveness in all of its relationships

Source: Association of Corporate Counsel

Business Objective—Policy, Process, Practice

The objective of creating and implementing a Records Management and Legal Hold Program is to: • manage information from creation to disposition, maintaining only

so much information as is required or necessary to fulfill the Enterprise’s legal, regulatory, and business purposes

The culture of continuing retention in and “business as usual” despite new policies…or even new technologies

•

Vs.

Discovery Plan—EDRM Model

• Identification: • Locating potential sources of ESI & determining its scope,

breadth & depth.

• Preservation: • Ensuring that ESI is protected against inappropriate alteration

or destruction.

• Collection: • Gathering ESI for further use in the electronic discovery

process.

• Processing: • Reducing the volume of ESI and converting it, if necessary, to

forms more suitable for review & analysis. Epiq Proprietary and Confidential 12

Discovery Plan (Contd.)

• Review: • Evaluating ESI for relevance & privilege.

• Analysis: • Evaluating ESI for content & context, including key patterns,

topics, people & discussion.

• Production: • Delivering ESI to others in appropriate forms & using

appropriate delivery mechanisms.

• Presentation: • Displaying ESI before audiences (Trial, Hearings, Depositions

and Appeal).


Three Most Important Rules of Discovery #1

Rule #1

The Standard is . . .

REASONABLE



Rule #2 Federal Rule of Civil Procedure 1: These rules govern the procedure in all civil actions and proceedings in the United States district courts . . . They should be construed and administered to secure the just, speedy, and inexpensive determination of every action and proceeding.



Rule #3 Federal Rule of Civil Procedure 26(b)(1) (Scope in General): Unless otherwise limited by court order, the scope of discovery is as follows: Parties may obtain discovery regarding any non-privileged matter that is relevant to any party's claim or defense — including the existence, description, nature, custody, condition, and location of any documents or other tangible things and the identity and location of persons who know of any discoverable matter. For good cause, the court may order discovery of any matter relevant to the subject matter involved in the action. Relevant information need not be admissible at the trial if the discovery appears reasonably calculated to lead to the discovery of admissible evidence. All discovery is subject to the limitations imposed by Rule 26(b)(2)(C).



If a litigation involves discovery,

55-90%

of the money spent will be on discovery

Discovery Costs $$$

Information Explosion


ESI Volume


Email • 1.5 GB Lotus Notes (NSF file) is 13,500 emails and 4,500 attachments

GB • 1 GB is about 75,000 pages (pick-up truck full of documents)

Email Average

• Average # of pages in an email is 1.5 (100,099 pages per GB)

Word • Average # of pages per Word document is 8 (64,782 pages per GB)

Spread sheet

• Average # of pages per spreadsheet is 50 (165,791 pages per GB)

Power Point

• Average # of pages per PowerPoint file is 14 (17,552 pages per GB)

CD ROM • Average # of pages on a CD ROM is 32,500 (650 MB)

Defining Electronic Discovery: All Discovery includes E-Discovery

“The Motion has been made and seconded that we stick our heads in the sand.”


ESI is Not Paper

How is ESI Different than paper discovery? • Over 99% of new information stored in the

United States is stored electronically • ESI is different than paper

– Persistent (“delete” is a misnomer) – Dynamic (easily changed/damaged) – Ubiquitous (copies can exist in many places at

once) • Volume is the enemy • Not understanding what you are agreeing to can be

costly


Defining Electronic Discovery: Types of E-Discovery

• E-mails • Instant Messages • Word processing documents • Faxes • Voice mails • Digital Images and Graphics • Internet usage history • Deleted, Fragmentary and Residual Data • Spreadsheets • Drawing Files (CAD, Engineering, Scientific) • Databases and Websites • Video – YouTube, Security Cameras, Web and Video

Conferences • GPS Data


Defining Electronic Discovery: Sources of E-Discovery

• Computer Hard Drives • Company Servers/Network Storage Devices • PDAs and SmartPhones (BlackBerry/iPhone/Android, etc.) • CDs, DVDs, External Hard drives • USB Removable Drive/Memory Sticks/Flash Drives • I-Pods • GPS Units • Disaster Recovery Sites • Off-Site Storage • Employees’ Homes - including kitchens, car trunks, mini-

warehouses, etc. • Third-Parties – e.g., application service providers • Social Networking Sites – Facebook, Twitter and Second Life


E-Discovery and Document Discovery

Preservation


Preservation

Preservation - Assume Everything You Write At This Point Will Be on The Cover of the NY Times!


Preservation


Preservation: Trigger

In litigations or investigations, there is something called a Duty to Preserve. Technically, this means a party should start preserving all information as soon as they “reasonably anticipate” the litigation or investigation. When that duty is “triggered” is the subject of a large body of case law, for example: “The duty to preserve material evidence arises not only during litigation but also extends to that period before the litigation when a party reasonably should know that the evidence may be relevant to anticipated litigation.” Silvestri v. General Motors Corp., 271 F.3d 583, 591 (4th Cir. 2001). “The mere existence of a dispute does not necessarily mean that parties should reasonably anticipate litigation or that the duty to preserve arises.” Goodman v. Praxair Services, Inc., 632 F. Supp. 2d 494 (D. Md. 2009) (J. Grimm). Epiq Proprietary and Confidential 27

Preservation: Trigger

Knowing when that “trigger” happens is a pain point for many lawyers – they consider: • The kind of complaint or threat; • The party making the claim; • The business relationship between the accused and accusing parties; • Whether the party making the claim is known to be aggressive or litigious; • The likely strength of a potential claim; • The likelihood that data relating to a claim could be lost or destroyed; • The significance of the data to the known or reasonably anticipated

issues; • Whether the company has learned of similar claims; • The experience of the industry; and • Whether the relevant records might be being retained for some other

reason.


Preservation: Who

Does the company have to keep every single document from every employee? NO The duty to preserve extends to those employees likely to have relevant information -- the "key players" in the case. Zubulake IV, at 217-218.


Preservation: What

.

Does the company need to keep every single document from a key player? NO The company only has to keep those documents that are relevant to the “claims, defenses, counter claims, damages, mitigation, or impeachment” in the case.

Practical Point: Because it is often hard to know what will be important, many clients engage vendors to collect the entire hard drive, network drive etc. for key players so they know it is preserved.


Preservation: What

.

Computers and network drives are considered “accessible” and will probably always have to be collected and reviewed – but what about data that is not so easy to get (e.g., backup tapes, old mainframe data)?

The rules have an exception for “Inaccessible Data” As a general rule, the litigation hold does not apply to inaccessible data like backup media(e.g., those typically maintained solely for the purpose of disaster recovery) BUT, if backup media are actively used for information retrieval, they are no longer “inaccessible.”


Preservation

Responsible Persons • “[T]he obligation to preserve evidence runs first to

counsel, who then has a duty to advise and explain to the client its obligations to retain pertinent documents that may be relevant to the litigation.” Telecom Int’l Am., Ltd. v. AT&T Corp., 189 F.R.D. 76, 81 (S.D.N.Y. 1999)

• Courts have found that obligation to preserve runs also to senior corporate officers. In re Prudential Ins. Co. of Am. Sales Practices, 169 F.R.D. 598 (D.N.J. 1997)


Preservation: How?

Because there are many ways to manage electronic data, and the data exists in so many locations (laptop, cell phone, iPad), parties can choose the best preservation method for the case Practical Point: Many companies choose to COLLECT the data and hold at a vendor or a secure server in the company so they can be sure it won’t go missing.


Preservation: How?

Use Litigation Hold Notices: • Key People and IT Personnel • Explain Case • Explain Relevant Information in normal language (No

Legalize) and be brief • Explain Where Information Could Be • Explain HOW to Preserve • Remind Employees to Keep Litigation Confidential • Have a Single Point of Conduct (SPOC) • Track Who Got The Holds and What Version • Do not ask employees to preserve information without telling

them how (or if they cannot)! (e.g. voicemail)


Preservation: Potential Problems . . .

A. Leavers and Changers

B. Deleted, Fragmentary or Residual Data

C. Legacy Data

D. Social Media

E. Voice Mail

F. Email and IM’s

G. Third Parties (accountants, sub contractors, lawyers, etc.)


Federal Rules: Sanctions Safe Harbor

Rule 37(e). Failure to Make Disclosures or Cooperate in Discovery; Sanctions. Electronically Stored Information. • “Absent exceptional circumstances, sanctions cannot

be imposed for loss of electronically stored information resulting from the routine, good faith operation of an electronic information system” – Must show information was lost by routine operation

of an information system – Must show that the operation was in good faith

E.g., intervention to modify or suspend some features of a system’s routine operation to prevent the loss of information that is subject to a preservation obligation


E-Discovery and Document

Discovery Basics

COLLECTION


Collection


Collection

• Hold in place – May be initially viewed as least costly

• Considerations include: – Feasibility – Number of custodians – Type of data – Nature of complaint – Duration of hold – Custodial self-preservation concerns

• Collect to preserve – Cost and burden – Potential for over/under preservation – Difficult to manage in “ongoing” preservations


Collection Options

Determine Collection Methodology

• Overview of collection methods – Forensic copy: A forensic copy is an exact copy

of the entire physical storage media. Forensically-sound: A copy of the reasonably accessible data contained in an information repository, accomplished using appropriate tools

– Self Collection: Relies upon an individual to locate and transfer information from an information repository to the requesting party

– Third-party: Relies on a vendor to collect – Internal IT Resources: relies on your IT resources to

execute on the collection plan Epiq Proprietary and Confidential 40

E-Discovery and Document Discovery

Sanctions


Learning the Hard Way


Sanctions

Sanctions for Violating Preservation Obligations • Adverse inference sanction, allowing jury to infer that deleted emails

contained evidence harmful to defendant; directly leads to verdict in excess of $29 million. Zubulake V

• Court strikes defendant’s answer and enters judgment for plaintiff on issue of liability, where defendant reformatted computer hard drive a day before court-ordered inspection. QZO, Inc. v. Moyer, 594 S.E.2d 541 (S.C. Ct. App. 2004)

• Court enters judgment in plaintiff’s favor on issue of liability where defendants failed to produce e-mail and electronic documents and failed to preserve computer hard drives. Metropolitan Opera Ass’n v. Local 100, 212 F.R.D. 178 (S.D.N.Y. 2003).


Sanctions

Sanctions for Violating Preservation Obligations Contd. • 9th Circuit upholds dismissal, finding that plaintiff’s “behavior

amounted to willful spoliation because he knew he was under a duty to preserve all data on the laptop, but intentionally deleted many files and then wrote a program to write over deleted documents.” Leon v. IDX Sys. Corp., 2006 WL 2684512 (Sept. 20, 2006).

• Court dismisses wrongful termination claim because employee intentionally deleted documents on his home computer after receiving notice he may be required to produce it. Plasse v. Tyco Corp., 2006 WL 262344 (D. Mass Sept. 7, 2006).


Statistics


5% 95%

Social Media…it’s everywhere your staff wants to be

Preliminary Issues

• Existence of a Social Media Policy

• Standard Contract Terms of Social Networking Sites

• Healthcare Content on a Third-Party Site

• Labor Relations Issues

• Use of Social Media in Hiring Decisions

• Does Your Social Media Policy Reach *ALL* Employee Conduct

Healthcare Industry Issues

As adapted from a recent post on David Harlow’s HealthBlawg, the key issues for consideration include the following:

•”Privacy and security rules, under HIPAA as well as other federal and state laws, and the ever-diminishing ability to fully de-identify protected health information •Professional responsibility codes, including both professional society codes of ethics and state regulations promulgated by boards of registration in medicine •Malpractice liability for professional advice rendered via social media •Liability under Federal Trade Commission rules for failure to disclose a financial relationship in conjunction with an online rating, review or other commentary •Trouble with the National Labor Relations Board if employee discussion of working conditions in unreasonably limited (even in non-union shops)”


Specific Risks

• Lack of a Social Media Policy – Lack of employee training (both on/off clock) – Document the policy and the training

• Lack of an Organizational Use Plan – Your advertent use may be problematic if not intentionally

planned • Inadvertent posting of patient information

– Access to Social Media is most often unrestricted – Smartphones and tablets operate independent of the

organization’s infrastructure • When PHI or other sensitive information is posted, it is

unencrypted – Once posted, virtually impossible to delete; breach may

have occurred


Examples of Use

• Employee of the Month—posts a picture holding the award certificate to Facebook—patients are identifiable in the background—Potential HIPAA violation attributable to facility

• No Good Deed Goes Unpunished—Facility creates a Facebook page and a resident posts that her condition has improved—the Facility has to be careful of its employee’s response: – Patient self-identified, but – Did not consent to an unlimited discussion of her condition


Deleting Info from Social Media

• “Information obtained in the public domain, such as social media sites, is there forever and has the potential to be indexed endlessly in many different types of data warehouses,” said Chris Apgar, CEO and president at Apgar & Associates.

• “The risks are great and can include patient harm, lawsuits, data breaches, regulatory audit and reputational damage to your clinic or patients.” – Chris Apgar, CEO and president at Apgar & Associates


Social Media Policy

• Coverage: – organizations should establish policies and procedures for

managing risks related to privacy, reputation management, and employment issues

• What about an employee’s use of Social Media “off-the-clock” – Problems arise when an employee uses a company-sponsored site to

post negative comments or reveal confidential/protected information

– Employers could be liable for defamatory statements made by an employee, if the person had the authority to speak on the company's behalf

• Proving “speaking authority” is still litigation

– Employees can create a hostile work environment from home, on the road, or at work

• Email • Instant Messaging • Texting/Sexting • Facebooking • Cyber-stalking


Policy’s Reach

• From a recent NLRB Decision… • “Employees have a Section 7 right to discuss their

wages and other terms and conditions of employment.”

• “Here the Employer’s rule limits employee discussion of terms and conditions of employment to discussions conducted in an ‘appropriate’ manner, thereby implicitly prohibiting ‘inappropriate’ discussions of terms and conditions of employment.”


Policy’s Reach

• “The policy does not define what an ‘appropriate’ or ‘inappropriate’ discussion of terms and conditions of employment would be, either through specific examples of what is covered or through limiting language that would exclude Section 7 activity.”

• “We concluded that employees would therefore reasonably interpret the rule to prohibit protected activity, including criticism of the Employer’s labor policies, treatment of employees, and terms and conditions of employment.”


“Good Social Media Policy”

• Avoid vague and overly broad terms – “Any” and “All” without qualifiers should be used sparingly

• Provide specific examples of what is prohibited

– Sharing confidential, protected, or patient data – Trade secrets – Proprietary information – Disparagement that touches on protected classes (age,

sex, sexual orientation, race, national origin, etc.) – Harassment, threats of violence

• Include a “savings clause” – Policy does not prohibit protected conduct


NLRB Guidance--Summary

• Social media policies should be narrowly tailored

– Work with employment counsel to tailor—likely can’t forbid: – the use of social media to post pictures – employees “making disparaging comments” or sharing wage

info or working conditions – engaging “in inappropriate discussions about the company,

management, and/or coworkers.” – employees from using the company’s name, address or other

information

• Should not prohibit “concerted activity” via social media (NLRA Section VII activities) – Vague standards, and per-case review

• Union and non-union employees alike are covered by the NLRA


Other Social Media Considerations

• Fair Credit Reporting Act – strict rules when using information gathered from pre-employment

checks – If the social media info impacts the hiring decision the dispute

resolution process kicks in – Social media is fluid and complicates this process

• Negligent Hiring – If you find troubling info on a social network page, and you ignore it,

and later the employee acts out, it may give rise to a claim • Password Requests

– Asking for passwords to social media websites is troubling to many; – The Social Networking Online Protection Act (SNOPA), is pending in

Congress and would bar employers from requiring access to online content from applicants and current employees

– Some states have passed similar protections...


NLRB in a Certain Amount of Limbo

• Noel Canning v. National Labor Relations Board, 12-1115, 12-1153, U.S. Court of Appeals for the District of Columbia (Washington)—challenged the validity of the “recess” appointments of NLRB members

• “The court held that Obama’s recess appointments to the U.S. National Labor Relations Board last year, made after Republicans refused to consider his nominees, were “constitutionally invalid” because the Senate wasn’t in recess at the time.” – Tom Schoenberg, Bloomberg

• Casts doubt on more than 200 NLRB decisions—including certain social media policy/use cases… Epiq Proprietary and Confidential 58

http://www.bloomberg.com/news/2013-01-25/obama-nlrb-recess-appointments-unlawful-court-says.html

Social Media Terms and Conditions

• Indemnity: Facebook – “ If anyone brings a claims against us related to your actions or your content on Facebook, you will indemnify or hold us harmless from and against any and all damages . . . of any kind . . .”

• Dispute resolution via arbitration or court? – Up to Facebook

• Location of court (venue)? – Up to Facebook

• Which law applies(choice of law)? – Up to Facebook


Social Media Terms and Conditions

• Changes to Terms and Conditions: – Facebook 9/08: “We reserve the right, at our sole

discretion, to change, modify, add, or delete portions of these Terms of Use at any time without further notice. . . Your continued use of the . . . Site after any such changes constitutes your acceptance of the new Terms of Use”

– Facebook 5/09: “We can change this Statement so long as we provide you notice through Facebook . . . and an opportunity to comment. . . . We can make changes for administrative or legal reasons upon notice but without opportunity to comment.”


Social Media Claims Against the Organization

• It’s not just the regulators who may be interested in how the organization uses social media…

• Claims may be brought by employees for: – Discrimination in hiring decisions – Improper discovery of personal information – Unlawful Invasion of Privacy – Illegal Background Checks

• Maintaining appropriate disclaimers… – Patient care should not be provided via Social Media – Use disclaimers and provide only general advice and

information • Comments and Responses can be troublesome!


Proactive Use of Social Media

• Monitoring use and responding to complaints in the forum in which raised – Twitter and Comcast vs. Taco Bell

• Comcast proactive • Taco Bell “asleep at the wheel”

– Monitored and Deleted Posts • How a consumer’s “voice” is heard is one thing—you can

gate-keep the page if comments are open—deleting the comments because you don’t like what your reading is another…Chapstick found this out the hard way…


ChapStick


Where do Lost ChapSticks go? Comments deleted… Butt Seriously ChapStick FB page is born…

Insurance

• Once your have engaged in the use of Social Media channels, consider reviewing or obtaining Employment Practices Liability Insurance

– If you have it, review the policy for terms of coverage

– If you don’t have it…consider getting it!


Email and Instant Messaging

• Use is integral to business • Some ERM systems link to email for workflow • Portability of access and separating work from

personal accounts – BYOD (Bring Your Own Device) – Security and HIPAA regulations – Loss and ability to wipe – Use for unintended purposes

• From Sunday’s NY Post: – ‘Buff’oon teacher loses job after using school e-mail address in

personal ads – Email Lives Forever! – Informality is a pitfall (Standard & Poor and JP Morgan) – IM and Texting are even worse!


Litigation Readiness Considerations

• Inventory of Records – Accessible and Inaccessible

• Records Retention Policy

– Audit for completeness, accuracy and compliance – Cover ESI and Social Media

• Social Media Policy

– Training – Monitoring

• Legal Hold Policy and Process

– Determine Scope of Data/Documents to be Preserved – Issue the Litigation Hold – Terminate “Routine” Operations that may destroy

data

• Discuss Impact of Preservation – Burdens/Cost/Feasibility/Duration

• Communicate with third-parties

– Employees – Counsel – Vendors


Q & A

David D. Rohde, JD, LL.M. Senior Director, Consulting Epiq eDiscovery Solutions 917.399.7771 – mobile

mailto:[email protected]?subject=Sedgwick Inquiry