In case you haven’t noticed there have been some changes to the Federal Rules of Civil Procedure (FRCP), specifically rules 26 and 37. These rules govern the production of materials in a civil lawsuit during discovery. For those not admitted to the Bar yet, discovery is he compulsory disclosure of pertinent facts or documents to the opposing party in a civil action, usually before a trial begins. The reason I call your attention to these changes is that they define some fairly significant rules for electronically stored information (ESI).For example, if you are sued by a former employee for wrongful termination you may be compelled during the discovery phase of the suit to produce all documents relating to that individual’s work performance. This use to mean their personnel records and copies of any written correspondence (memos, letters, etc.) concerning the performance of that employee. Over the past several years there has been some level of debate over what a “document” is given that most records now reside in electronic format. It’s sort of like the debate over what “is” is…it depends upon how it is used. What the FRCP changes do is to say that ESI is now clearly subject to discovery. It goes further to say that all data is subject to discovery regardless of storage format or location: e-mail, instant messaging, PDAs, laptops, etc. all fall under this. And there’s more.My prediction is that this will have a significant impact on how businesses store and maintain their data. FRCP Rule 26(f) says that businesses must have clear policies around data retention so that they can easily identify what data is applicable to a discovery motion. When a business cannot produce data subject to discovery that they should have had, subject to their own policies, they care subject to fines or other court sanctions.For a business that does not have a retention policy in place right now, the burdens of this can be significant from both a cost and technology standpoint. And, I would wager that 90% of US businesses have not addressed this problem. It remains to be seen the true impact these changes will have…we’ll have to wait and see how the case law falls out. But, in the meantime, I advise you to look at your own organizations and make sure that you understand what ESI you need to be maintaining, determine its business need, have a legal hold policy in place (stops the destruction of data subject to pending or anticipated lawsuits), have an understanding of your statuatory and regulatory document retention requirements, understand the varying statues of limitations, have a policy, and have a records retention and destruction schedule. Here’s a quick recap of the changes and their impacts: Rule 26(b) – identifies electronically stored information (ESI) as being subject to discovery in a civil lawsuit, wherever that data resides: e-mail, PDAs, laptops, IM, archives, etc. Rule 26(b)(2) – addresses the discovery of data that is not “reasonably accessible” so that it can be addressed up-front and determined by the parties whether it should be produced Rule 26(b)(5) – covers the retreival of provledged information that was produced inadvertently during discovery Rule 26(f) – requires that businesses know exactly where data and records are, what policies are in place to control the retention of those records, and requires a meeting between the parties to the lawsuit with 120 days of the suit being filed to negotiate discovery issues Rule 37(f) – provides a “safe harbor” for the inadvertent destruction of ESI and documents but requires that businesses have a compliant records management program – which may be reviewed by the court Please let us know how your organizations are addressing this issue. Related content opinion Don’t let social media get you in trouble As social media has become more pervasive, it has run headlong into the inevitable intersection between our personal lives and our work lives. How to best manage that intersection is something everyone should understand. By Bob Bragdon Jan 14, 2019 4 mins Privacy Security opinion Remember: It’s not all about the 1s and 0s Don't forget the role of physical security in protecting your assets...even the digital ones By Bob Bragdon Nov 07, 2018 4 mins Physical Security Security opinion The rolling tide that is GDPR … say hello to the CCPA Think you dodged the GDPR bullet because you’re not in Europe? Guess again. California just brought that home for millions of businesses. By Bob Bragdon Aug 01, 2018 4 mins Regulation Compliance Privacy opinion The story of Mary Good information security isn't just about the 1s and 0s By Bob Bragdon Jun 20, 2018 4 mins Data and Information Security Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe