UK firms remain averse to e-discovery

What do UK firms risk by not having data disclosure readiness policies in place?

More UK IT departments are implementing policies to manage electronically stored information (ESI) and e-discovery to help stave off potential litigation issues.

But many still see little point in spending money preparing for legal requirements that may never affect them. And they are hampered from implementing suitable policies by the large volume of information that needs to be stored, and a lack of time and manpower to perform the necessary maintenance of data archives over long periods.

A survey of 431 IT managers was conducted by Kroll OnTrack earlier this year. It found that while the majority of UK companies (80 per cent) have a document retention policy, only 41 per cent of those policies are specific to ESI disclosure readiness – the ability to produce computerised files to aid legal or compliance investigation on demand and within a specific time when required. And 30 per cent did not know whether or not they had an ESI disclosure readiness strategy.

The report also highlighted differences in opinion as to whether the IT or the legal department should take responsibility for implementing ESI-readiness policies, with 35 per cent saying it would result in a lot of extra work for IT and in-house counsel (18 per cent).

Martin Carey, managing director at Kroll Ontrack UK, believes that far from discouraging companies to invest time, money and manpower in addressing the issue, the current economic climate is prompting more firms to pay ESI disclosure readiness more attention.

“If I were a business short of money, I would want to know where my information is, how it flows, where it was created, backed up and purged,” he said. “I would want to spend money on creating inventories of tape stores to understand what is on them and know the risks involved in holding that data.”

Many IT departments clearly do not hold the same view. A straw poll of more than 100 data storage and IT professionals attending a seminar on backup and archiving technology at last week’s Storage Expo show in London revealed only three people in the audience who had ever been affected by an e-discovery issue.

“We did it twice in total and we struggled. It made me wish all our data was sitting in a large cloud that did not belong to us but which was indexable to make the data easy to pull off,” said one attendee who wished to remain anonymous.

“But from my experience, such a rare occurrence did not warrant the effort to change things in preparation for something that would not happen more than once every two or three years.”

Carey said: “One of the reasons why such a large chunk of people has no litigation hold procedures is that it is such a big task. It involves data mapping, systems architecture analysis, backup and data accessibility, and it is difficult to do that without spending money.”

Many of the data storage professionals attending the Storage Expo seminar reported that the real challenge for them is choosing the right storage technology to host data over a number of years, yet still being able to find specific items of data that need to be extracted.

Tape is by far the cheapest option for long-term data archiving, but is not as suitable for e-discovery as more expensive disk-based systems, for example.

“Using disk-based archive systems makes e-discovery a lot easier because you can put software over the top, and keeping that sort data on a tape means it is harder to destroy if a specific file is in the middle of it,” said Anthony Drewery, head of IT operations at Virgin Holidays.

Virgin Holidays is required to archive data for seven years, but other organisations need to retain information for a lot longer – 40 years for one public sector employee attending Storage Expo, and "indefinitely", said another.

Kroll Ontrack legal consultant Tracey Stretton acknowledges that European firms may only act when litigation costs them money due to a failure to provide electronic data when requested, something more likely to happen to large firms in the finance and pharmaceutical industries, for example.

But she argues that implementing efficient e-discovery procedures can deliver return on investment simply by improving overall data management practices.

“For smaller businesses it is about limiting the risk profile. If they do not face litigation, they often find other drivers, such as the need to run the business more efficiently,” she said.

Stretton points to companies in the US which have faced severe financial penalties for failing to produce data when requested, but says there are no similar penalties within the EU as yet.

“They [European firms] might argue that the relative lack of penalties is not severe enough to make them interested, as there are not penalties to punish, but they could lose a legal case if information goes missing and adverse inference could be drawn from any failure to produce evidence,” she said.