We regularly advise clients that the starting point for privacy and data security risk management is to understand what data is being held. Knowing what data is being held (and preserving it) also is a key component of compliance in litigation. Indeed, the need for companies to data map their information long before litigation arises has increased urgency in light of a recent ruling.
In Pension Committee , the judge who issued the series of seminal Zubulake opinions, which essentially defined electronic document retention and discovery nation-wide, calls for litigants not only to identify key data keepers but to identify key data very early in litigation. Some of the new holdings described in Hogan & Hartson’s Litigation Alert (link below) are likely to become as influential as the discovery-altering Zubulake decisions.
In Pension Committee Judge Scheindlin finds, among other things, that the failure to issue a written litigation hold for relevant individuals and data constituted gross negligence because that failure is likely to result in the destruction of relevant information. Severe sanctions, such as dismissal, monetary sanctions, and adverse inference instructions, were therefore presumptively appropriate absent contrary indications of good faith. Failure to appropriately collect and preserve electronically stored information from all key players may now also be considered gross negligence, and even failure to collect and preserve from less-involved employees may be considered negligent. Additionally, companies must be even more conscious of the fate of, and process in place to handle, former-employee data for fear of being found grossly-negligent if a preservation duty has attached. For more information about this important decision please see the attached Litigation Alert which was drafted by two members of our Electronic Information Group.