Episode#8 - eDiscovery for Records Managers

Transcript:

Bill Tolson:

Welcome to the Information Management 360 Podcast from Archives360. This week's podcast is titled e-Discovery for Records Managers. My name is Bill Tolson and I'm the VP of Compliance and e-Discovery at Archives360. With me today is Bill Millican, president and founder of Millican, LLC. Bill, can you give us a brief rundown as to what your company does?

Bill Millican:

Thank you, Bill, and good morning or good afternoon, depending on where you are in the world. Basically, Millican, LC provides three types of services. The company holds the copyrights on the songs that we have written here at our company. Number two, we provide specialized counseling and advisory services for individuals and for certain types of organizations or departments within those organizations. And three, the longest service that we have provided is consulting services that have a strong link to the information management and governance industry.

Bill Millican:

We were officially founded in 2004. We've conducted all of these services at varying levels of activity and most of that has been depended upon Bill Millican's work and the other work that he does. In a nutshell, that's kind of Millican, LLC is. You can look us up on the internet at that particular address.

Bill Tolson:

All right. Well, also, I want to add that Bill Millican is a respected expert in information governance and records management, as well as e-discovery, and is a long-term member of the Kansas City ARMA organization. Bill currently serves as the Director of Education for the chapter, but has held positions with the Kansas City chapter since 1990, and is a former Director of Standards Development and Information Technology for ARMA International.

Bill Millican:

I've been a member of ARMA International since 1986 and before that the Association of Legal Administrators and my career has benefited greatly from memberships in those organizations. Along the way those memberships have brought to me into my professional career wonderful colleagues, wonderful, wonderful colleagues like the person I'm working with today that have provided for me opportunity to learn and to hopefully make myself better as a practitioner.

Bill Tolson:

All right. Well, thank you for that. So let's jump in to the discussion here. I may kind of set the stage around e-discovery and records management. As corporate litigation levels continue to rise, records managers are becoming more involved in corporate e-discovery response. In the coming discussion, we will discuss why this is and how records managers should prepare.

Bill Tolson:

By the way, I mean, one of the things I'm actually writing a blog right now around e-discovery and FOIA requirements based on COVID for state and local governments and the whole litigation and FOIA-inspired litigation is going to the roof because of the difficulties that states and governments were having. But that aside, Bill, let's first touch on what e-discovery is and how it affects an organization. You've been around e-discovery industry for many years. Can you briefly describe what an e-discovery response is and who in the company is usually involved?

Bill Millican:

Well, I love the way you set that up, can I briefly describe. I'm not sure. I'll do my best. I like to believe that I've had the good fortune of being around this e-discovery world since what I believe it began. As going back kind of been to the early part of the 1990s, '92 or '93, and as we arrive in this new millennial, I mean, the explosion of electronic information began to really significantly alter the way we were doing business. We were beginning to learn that an impactful modification to how records managers, information managers, how we really needed to alter the way we were doing business the way we saw information and work with it, the way it was being managed in our organizations and how that all of that activity begin to kind of move over and into the world of litigations.

Bill Millican:

So there was this script in the late '90s called The Sedona Conference around 1997. Group lawyers were really ahead of the curve. They began to see some of the difficulties that law firms and organizations were having at addressing this issue of discovery. And with the explosion of email and the electronic information, these two things began to come together. They were not comfortable.

Bill Millican:

So the advent of electronic information and the challenges it presented especially with the task of discovery, electronic discovery, were fast changing the world of business. And yes, I do suggest the entirety of the way we do business with reference to one of our areas of discussion, mining bills. Everything is potentially discoverable with very little being off limits. That's a very difficult discussion between lawyers and the courts.

Bill Tolson:

I found that to be an ongoing kind of misunderstanding for 20 years. Even some corporate lawyers don't realize that, but obviously trial lawyers do, but the idea that anything is potentially discoverable if it relates to a given case and if it's available to be discovered. And we could get into whole discussion about accessibility and all of those kinds of things, but this really surprises people. And I used to use this argument with employees using social media and even internal stuff saying, "Don't use your personal accounts," your email accounts for anything having to do with business because someday you might have given opposing counsel access to your personal email.

Bill Millican:

Exactly. One of the lessons we learned, in many cases a hard lesson that we learned as we left the '90s and we begin making our way through the first part of the decade of the 2000s; it became painfully apparent that the information custodian, the records and information managers, were being strongly compelled to step their game just very relevant and pursuant to what you just commented, the comment you made, Bill. Not only did we need to have back-up tapes, directories and devices and other types of media and mechanisms, but we had to know where they were, how old they were, and the biggest part of this was the scary part of them what was on them. From about 2000 to 2008, these challenges continue to grow. And while Rule 26 of the FRCP begin to help, the challenges remain. The role that records and information management professionals would never ever, ever be the same. The margin between information manager and information technologist was beginning to erode, disappear.

Bill Tolson:

You brought up back-up tapes, which was really interesting back in the 2006 Amendments to the Federal Rules of Civil Procedure where they actually mentioned the discoverability of back-up tapes and brought up the whole idea of accessibility. And I remember 2006, several cases came up immediately. Corporate lawyers won't really following and many corporate lawyers assumed that back-up tapes were not discoverable because of their inaccessibility. And I think one of the first cases to decide this after the amendments to the FRCP was with the best bi-case at Minnesota. And the judge came back and said, "No, I'm sorry. If the opposing counsel can make a good enough case, the back-up tapes might hold certain aspects of the only discoverable content for a given topic, then yes, you have to pay to restore them." And restoring back-up tapes insertion for discovery is not cheap. So obviously, most companies did not want to hold back on back-up tapes.

Bill Millican:

I mean, you've got back-up tapes that might be at certain age and maybe the technology upon which they run or used to run you don't even have that anymore. But probably somebody does and therein comes the elevated cost that you got to go find them. You have to pay for their use of their technology so that you can abide by what the court has decided that those back-up tapes and the date that might be on them is actually discoverable. It's a risk that is in my personal opinion is far too high.

Bill Tolson:

That's where you're getting the idea of recycling back-up tapes instead of keeping them forever. I used to work for Iron Mountain years ago and Iron Mountain is really a real estate company because they store so many documents and back-up tapes. And there were companies that used Iron Mountain that had back-up tapes gong back 25, 30 years. You imagine opposing counsel finding that out and just to mess with the defendant's counsel saying, "I want to know what's on those. That is just an absolutely nasty thing."

Bill Tolson:

Since then with the 2015 amendments to the federal rules, the whole idea of back-up tapes they further kind of zeroed in on accessibility. It's tougher to force the defendant's lawyers to go back into back-up tapes and the plaintiff's lawyers have to make a real good case as to why they think those are the only places that specific data could be found. And you look at cost specification, the judge might say, "Even if Mr. Plaintiff is true, the cost to do it is outweighed by the case so we're not [inaudible 00:10:53]."

Bill Tolson:

So you and I several times have talked about how information governance and e-discovery are or in related or dependent on each other. Give us your thoughts on this.

Bill Millican:

This is really nice segue as we kind of move through this sequence of topics through this discussion. But it's sort of humorous that some believe IG sits beneath e-discovery while others believe the opposite. We'll leave that discussion at debate for now. Suffice it to say to say that the two are molded into the same discussion and for me personally, they cannot nor should they be separated.

Bill Millican:

Governing information using the most contemporary philosophies and methods technologies must be facilitated, must be facilitated and accomplished with e-discovery in mind. To not take that approach for the information governance professional is not only insufficient, but it's foolish. We already know adversely all information is discoverable. Meeting that it is a viable candidate to be presented to the court during the process of information.

Bill Millican:

I'd love to have a discussion with group of a hundred information governance professionals and ask them how they're doing with that. Therefore, that professional must and I do mean must, I don't mean maybe, kind of, sometimes, I mean must appropriately govern the organization's information with electronic discovery in mind. This then means that the IG professional must work hand-in-hand in perfect concert.

Bill Millican:

I hope this is answering your question, Bill. With the e-discovery organizational leadership, this is kind of an off-the-cuff, but very serious comment that I have made I don't know how many times in the last 10 or 12 years a lot. The continued resistance of the realm in IG professional to believe that IT in realm IG, information governance, simply speak a different language and the two shall never agree, that is incorrect foolish and the individual who believes that should be replaced today. So that's how I feel about that.

Bill Tolson:

I agree with that. It's pretty easy to prove, I mean, to respond to an e-discovery request and to show up to the early confer meeting. The opposing counsel is going to want to know what data you have, what repositories, where are they. You have anything that you consider inaccessible all of those kinds of things. Being able to, number one, talk about that, but also the ability to actually find potentially relevant data is made so much easier, so much faster, so much less costly if you have an already standing information governance program because then you know where all your data is.

Bill Tolson:

I don't know how many times when I was on the e-discovery side consulting business. You'd walk in and the clients, even legal folks, you ask them, "Okay, where's the data? How many shared point servers do you have? How many files shares? Where are they? What geographies?" They'd just give you blank look like, "I don't know. No one has ever asked me that before." And what they didn't understand was this is an issue, number one, for cost and speed because you don't have an eternity to respond to discovery.

Bill Tolson:

But it's also a liability in that you may have thought that you found all relevant data. But six months later or two days later you might find that there was a whole series or repositories that you didn't even know existed and you didn't check to see if there was relevant material there. And if the courts get a hold of that, then you're really looking at some major fines potential of returning of the case all kinds of stuff. There's so many aspects of it. I'll give a very brief example here and I may have mentioned this in the previous podcast. But if I can, I think it was 1998, 1999. DuPont, DuPont Company, very well known chemical company. I'm sure they do all kinds of other stuff.

Bill Tolson:

Company that size deals with a lot of lawsuits, a lot of e-discovery. They went back and just for 1999 they took and looked at nine e-discovery litigation cases and how much, what they actually did to respond to e-discovery. And of those nine cases, they figured, and I have a link to this on some of my blogs, they actually found and reviewed 24, 25 million pages of documents for running to the e-discovery process at a cost of 20 or 30 million dollars in discovery just those nine cases. After the fact doing this research, they found that of the 25 million documents that they actually spent money on reviewing half of them, 11, 12 million of them we're actually expired and should not have existed. So they spent 11, 12 million dollars on reviewing documents that should not have been there and that falls directly back on records management information governance. Because if they had actually disposed of those records when they should have, they would have saved 12 million dollars.

Bill Millican:

Let me just say this about that particular topic, which I'm hoping that we kind of expand on this topic of keeping of what you need to keep and getting rid of what is no longer useful in the proper ways. The idea, the thought, the approach that one an IG professional has oversight of an organization's records their corporate or not, they believe that their oversight has some type of arterial boundary is a disastrous approach just like you just explained, just waiting for something really, really bad to happen. And so I have been maybe a more vocal than I should have been, sometimes a bit I don't want to say cruel, but very clear that the information governance going back 30 years, the records manager needs to be deeply involved in the world of information technology.

Bill Millican:

So information is information, data is data, records are records, terminologies are terminologies. And we all kind of play around the net world on this side of the courtroom. But the court as you know, Bill, have little interest in how the organization or the business world chooses and I say chooses to define information. We've said this before. Virtually, any and all information is discoverable. Therefore, the contemporary IG professional must, and I just said this four or five minutes ago, must approach the governance of all information from this position. It's discoverable and I've already said this I'm going to say it one more time and I don't think I'll say it again, but I'm not going to promise. If I were working with an organization and heard the statement, "Well, that information is just not in my purview and responsibility," I would recommend that person be replaced today.

Bill Tolson:

I have a great story that goes directly on that. I won't take the time to do it right now, but I absolutely agree with you on that. Let's continue here. So Bill, records managers continue to be focused on obviously corporate records management, those records that are defined and called out by regulatory compliance requirements. In my experience and based on research I've seen, one of the big ones was CGOC organization mostly run by IBM but still very good, that only about 5% of records or 5% of data within a company can be classified as records. And I run across this in years past where the records management group was focused on those 5% of information or files within a company. The other 95% is kind of left to do prearranged.

Bill Tolson:

So with that in mind, Bill, if records managers are only really looking at corporate's records managements for clients, why should they or why are they involved in e-discovery response at all? Because the vast majority of corporate information is not records. I've never had an actual records manager kind of give me a good explanation for that. So hopefully I'd love to hear your idea on the subject.

Bill Millican:

The term records manager while that term that position title may still be used here, there and I still have a few business cards that have that on it from way, way, way days gone by, right, but truthfully, Bill, Mr. Tolson, that position title should not be used any longer. And for the express reason that it's inaccurate, it's insufficient, it does not cover all the bases that it needs to cover, it muddies the water. There are things that are defined as records, I mean, within a particular schedule it's going to be a category like that maybe. But the truth is when you declare a particular thing, an item, a piece of information as a record, that has some particular significance.

Bill Millican:

But in today's business world, that is a misnomer that should be laid aside. We should keep it. We should know what the means. We should know why we get rid of it and we should move forward with either an information manager or an information governance professional if it's perfectly into the world of information technology and e-discovery. Going back to 15 minutes ago, those two things are inseparable.

Bill Tolson:

By the way, I agree with you. And that's why for years now, I've tended to not use the term records manager unless I was standing in front of a records manager and they sort of insisted, you could tell by their body language. I have tended to refer to the whole profession as information management. Because in many companies, records management organizations have evolved beyond the whole compliance thing and understand that in today's world especially with social media and chat functions and collaboration software. Anything can have content in it that may be susceptible to compliance. So I like the idea of calling the whole area, the whole topic of information management profession versus a records management. I think that's what you were saying, correct, Bill?

Bill Millican:

It is what I was saying.

Bill Tolson:

Great, we agree.

Bill Millican:

Yes, we do.

Bill Tolson:

All right. So another interesting question that you and I have discussed in the past is the role of an effective information management program plays in controlling, reducing e-discovery cost. And I know we mentioned this at the start, but a little bit deeper dive into this. The whole idea of like I mentioned originally if you're not managing your information, then your e-discovery process is going to be difficult, costly, and slow.

Bill Millican:

I'll make this quick. This is very clear. This is not difficult to understand. Years ago back in the '90s and early 2000s, I used to travel the country and teach organizations how to develop and manage retention and disposition programs. I would always start those out with three questions. Do you have a retention program? Everybody raised their hand or most everybody. And I would ask the question, how is it working? Well, I got lots of real expressions on faces, right? And then I explained a little bit about that second question, how often are you legally, ethically and responsibly destroying information? And I would use the term information and in paren I would put records although I really meant information.

Bill Millican:

The expectation is this. I am interested in how an organization is going about processes, policies, and facilitating and managing those to always know exactly how much information they have, where it is, and all that information that comes along with it. And are you able to determine if your information amount is growing or is it being reduced through your program?

Bill Millican:

So at the end of the day what I believe is necessary for an organization to stay healthy is to not only ingest, but to make sure that they are ridding themselves of information that they no longer need and that is potentially dangerous for them. In fact, I would tell them straight up, "If you don't do that, you don't have a program. You might have something on a piece of paper, but you don't have a program. You have a document."

Bill Tolson:

Exactly. And what you just referred to we talked it out before around defensible disposition. We'll talk about that in a minute, but that is a hugely important part.

Bill Tolson:

The other part of your discussion just then was if you have an effective information governance type of process within your company, then in reality you already are preemptively preparing for litigation. And I've pushed the whole idea of preemptive or proactive litigation preparedness for years that really is part of information governance. If you're capturing data, if you're securing it but also if you're applying retention disposition policies to it and then putting it into maybe a long-term archive for ongoing management and defensible disposition once things expire, then you have basically finished a big part of your e-discovery collection process.

Bill Tolson:

Because you don't have to... I've done kind of decentralized collections before and it's maddening. I mean, I found relevant e-discovery content on digital camera memory sticks, like email that somebody had actually put in there. And if you're centralizing the stuff much, much better than that, that really is part of the preemptive litigation preparedness and stuff. And again, we're talking about legal defensibility, the ability to fully respond to an e-discovery while lowering your overall e-discovery cost.

Bill Tolson:

So I have made arguments to C-level groups before that an effective information management, information governance program will dramatically cut your e-discovery litigation cost. That is usually a way for them to say, "Oh, wow. Okay, we'll budget it now."

Bill Millican:

The courts actually absolutely love that. When they see an organization that does it the right way in governance or information and ingested properly, records it and then disposes of it legally, ethically, morally in the proper mechanism with all of the right processes and protocols and policies and authorities and from personal experience, they love that. It's a headache for them. And it's the reason we have all these new iterations of Rule 26, trying to get organizations to do what they need to do.

Bill Tolson:

Yeah, absolutely. Totally agree the whole idea that if you're standing in front of a judge because of an e-discovery argument between counsel. I've seen judges basically. Well, they have records retention schedule to have retention disposition for your stuff and if a GC from a company says, "Well, no your honor." And by the way, it's not required by law, but it shows the judge especially your intent to play by the rules or at least use best practices around business data so it's one of those kind of. If you don't, it's a red flag to the judge to say, "Well, gee, what do these guys trying to hide?"

Bill Millican:

Yes.

Bill Tolson:

We don't have a whole great deal of time left here, Bill, but we can still touch on some of these. What are the challenges and risks information governance professionals face when participating in e-discovery collection and potentially review activities?

Bill Millican:

First of all and foremost and most important, the IG professional must understand and know what e-discovery is and within that get the assistance of others of helping to find their role. They have a very critical role. The IG professional must understand and embrace the fact that the world of records management really no longer exists. And that's a hard one for folks, Bill, to get. But if they look at the world, if they look at information, they'll understand that if they're still holding on to records management, every day they get further behind.

Bill Millican:

The IG professional must alter and advance their ability to knowledgeably and accurately discuss the relationship between those two things, or maybe three, information governance, e-discovery and information technology. It's imperative. I have suggested this and I'll throw this in now the if the IG professional is not spending four to six hours every single week, 250 hours a year minimum, at improving their understanding of what's really going on in this world of electronic management, information governance, e-discovery that every day, every week they fall further and further behind. And I see it, listen to it all the time.

Bill Millican:

So those are the three things they must do. I have tried with this local group of ARMA to really more deeply introduce them to e-discovery as you well know. They're coming around pretty good.

Bill Tolson:

I've noticed that as well. A couple of other gotchas that I have seen in real life in information governance professionals kind of have difficulty with during e-discovery is the idea of maintaining chain of custody. But even more so, its understanding that in e-discovery response the opposing counsel with the judge's supervision that once data is deemed to potentially relevant to a case it must be protected. Most people who'll be listening to this podcast will understand the whole idea of litigation holder or legal holds.

Bill Tolson:

But also you get into the idea of maintaining the pristine nature of a given files metadata. And that's where non-IT people might get into issues because they might find something in a search and simply depending on the kind of system they're on simply by clicking on it and opening it they might be changing metadata. And if you have an opposing counsel who knows this stuff and more and more they are, they're going to ask the other side. Is this the original metadata? Did you open it? Did somebody look at it? Did anybody try to alter it or even inadvertently?

Bill Tolson:

So the idea of doing a search for content, the if management professionals absolutely have to be schooled from IT as well as legal as to what they can and can't do to individual files. Because you may be setting your company up, for example exfoliation or a detection of evidence charge of relevant materials. I have found that still to be a misunderstanding by many just because the corporate lawyers and the IT folks don't bother to train the information governance professionals as to what the gotchas here and how to make sure you don't kind of overstep.

Bill Tolson:

So Bill, I know we're getting close so let's maybe finish up on a couple more here really quickly. So we've mentioned defensible disposition the topic, once or twice you're doing our discussion already. And defensible disposition for those who don't know is the regular disposal of valueless, unneeded and/or expired information in the information management process. So it's like Bill Millican had said. Once a piece of information is no longer needed for the running of the business, doesn't have any real reference value anymore or has gone beyond the regulatory compliance time periods, it should be deleted.

Bill Tolson:

But this is one of the areas I have found many companies, maybe the majority of companies, still do not look at the need to get rid of any information through a defensible disposition process. I know you have some great thoughts on the whole idea of defensible disposition, Bill. What do you think?

Bill Millican:

I was fortunate before I got into law firm management as a records manager back in the 1980s. I had 15 years of corporate accounting, so as an accountant. So I was very fortunate and all along the way I have been a musician, a vocalist, composer. Those two things provided for me a foundation of really strong structure of falling processes and policies or else you go to jail, right? And so I brought that in here. So I'll make these statements, okay?

Bill Millican:

Making sure that the process and the policy for retaining and disposing of information has been created and developed in a legally accepted manner and that it is managed thusly. Organizations are always better served by structure. They can have a creative department or something like that and all of them should. But they need to make sure that the process is overseen and facilitated by authorized personnel and that all facets of the policy are followed, all facets of the policy are followed.

Bill Millican:

I mean, the chain of custody has been around for decades, decades. This wasn't something new with electronic information. We may have written things down. We may have clicked them on, checked them on a computer or something like that with a piece of software, but it's always been present. Make sure that each facet is properly authorized and recorded. Make sure that the retention and disposition reports are reviewed, validated, and signed off on. And make sure that the established schedule is followed and that no other influence alters that schedule.

Bill Millican:

Bill, you said it 10 minutes ago. E-discovery is best served and I mean best served. That first helm left-sided, the ADRM as you're looking at it is information governance. It used to say information management. So before that whole process starts information governance has an enormous and exciting opportunity to influence that workflow from left to right and then circle back around and start again.

Bill Millican:

So this idea, this philosophy of retention and disposition for me personally, Bill Millican, is probably the most exciting, effective, impactful process in all of the world of governing information.

Bill Tolson:

Well, to follow up on this topic we've been talking about and this is one of the things that I still find surprising, but I still run across of this. I continue to hear from companies that they're not sure if they're allowed to actually delete data. Is retaining non-regulated data required by law when a judge throw the book at you if your company only kept data for maximum of two weeks? The bottom line is no. It's short of retention disposition or legal hold, there is no law anywhere that says you have to keep data for [inaudible 00:36:21].

Bill Tolson:

Bill Millican had mentioned The Sedona Conference. They put out lots and lots of very, very interesting, very good reports. And a couple of years ago, they put out one around this whole idea of defensible disposition. But The Sedona Conference put out a guidance report 2019 basically saying absent a legal retention, legal hold or regulatory preservation obligation, organizations may dispose of their information at any time. It could be one day.

Bill Tolson:

I know in the Samsung versus Apple case several years ago, Samsung basically had a policy that says, "We only keep email two weeks and then it's deleted," and that obviously caused some litigation whole problems. We don't get into that right now, but what do you think about this? I'm sure you want to disagree with me that you don't have to keep data forever just because there's no law that says you have to. But do you run across clients that still or hesitant to delete data?

Bill Millican:

Oh, my, yes. And sometimes those reasons are very good and it usually is related to certain pieces of information, not all of it. The users, the creators of information usually have a very good idea of why they need to keep that. And through proper discussion kind of vetting that and agreeing upon that, you can find agreement. There may be no rule of law over it. But if legal hold shows up and within the legal hold, there's specific types of information that are noted. It certainly makes it a lot easier to determine what is applicable to the legal hold. Some things may be, some things might not be, but if you've got your program in place, you've got your policies, your processes in place.

Bill Millican:

Bill, you and I both know that determining what qualifies for the legal hold is oftentimes a simple review and a click of a button.

Bill Tolson:

Yeah, yeah. As we close up here, I wanted to mention one thing that I'd meant to earlier on. It's the whole idea of information governance being a huge benefit for e-discovery. Also, information governance is really an absolute necessity now when looking at a lot of the new privacy laws. And the idea of what of my personal information are you keeping, how are you using it, who you have sold it to and so on and getting all the way down to the right to be forgotten or the right to erasure. If you don't know where all of your data is, then responding to a right-to-be-forgotten request within a given short amount of time can be almost impossible.

Bill Tolson:

And by the way, if you missed some because you didn't know that data was sitting on some employee laptops somewhere and you didn't know it was there, then you could be looking by GDPR for example massive funds. Just the kind of close out the topics on that.

Bill Tolson:

So Bill, I think that wraps up the Information Management 360 Podcast. I want to thank you for the insightful and fun discussion today on a very salient subject that I believe records managers will find helpful.

Bill Tolson:

If anyone has questions on this topic or would like to talk to the subject matter expert, please send an email mentioning this podcast to info@archives360.com and we'll get back to you as soon as possible. You can also email Bill at wfmillican, M, I, L, L, I, C, A, N @gmail.com to post some questions and get his thoughts on this. Also, check back with us on the Archive360 resource page for new podcast with leading industry experts on a regular basis.

Bill Tolson:

So with that, Bill Millican, I very much appreciate you participating in our podcast today. It was fantastic.

Bill Millican:

Thank you.