HR.BLR.com: eDiscovery 101 for Human Resources

Originally published by HR.BLR.com.

By Rene Novoa, senior manager of eDiscovery and Digital Forensics

In today’s digital world, it’s increasingly common for businesses to go “paperless.” Oftentimes, the conversion to digital includes documentation prepared and maintained by human resource (HR) departments. These documents could include everything from handbooks and company policies to employee reviews and payroll documentation.

Choosing to keep important files and documents stored in computers, rather than file cabinets, has many benefits, including search-friendliness and storage efficiency. Electronically gated and stored files also include metadata that keeps track of when, how, and by whom the files were created, modified, viewed, transmitted, and deleted—potentially useful information that is unavailable in paper form.

Although going paperless with company data has many benefits, these benefits also present new challenges when it comes to data organization and preservation, especially in the event of an HR-related lawsuit.

In the event that a possible HR-related lawsuit is on the horizon, HR is often responsible for preserving and providing all relevant company data from each of the devices where that data may live. The preservation of digital communications, including internal e-mail and social media posts, can also create large volumes of data that may be important in employee-related litigation.

This is where eDiscovery comes in.

What is eDiscovery?

eDiscovery, or electronic discovery, is the process of sifting through a large amount of data and finding any pieces that may be relevant to a specific legal action or dispute. This process is called upon when electronically stored information (ESI) must be provided for use in litigation, a lawsuit, or an investigation, such as the alleged unlawful firing of an employee. eDiscovery may also be used to find data related to suspected employee misconduct.

Some of the possible HR-related scenarios or allegations that would require eDiscovery include:

• Employee misconduct
• Employer misconduct
• Employment discrimination
• Worker safety and OSHA compliance
• Employee privacy
• Negligent hiring
• Negligent retention
• Harassment
• Retaliation
• Union relations
• Copyright infringement
• Theft of company property, physical or intellectual
• Defamation (of an employee or of the company)

When pending or actual litigation arises, it is important for the HR department, as the primary caretaker of ESI, to understand how and where the data is stored. The goal is to allow the company to identify and access relevant data as fast and efficiently as possible. This process is most effective when the HR and IT departments work together with in-house and/or outside legal counsel and an eDiscovery service.

Preparing for eDiscovery

eDiscovery doesn’t have to be scary. Some simple proactive measures, known as information governance (IG), can make the eDiscovery process both more streamlined and effective, should the need arise.

Work with your IT department to put the following IG policies into place:

1. Develop an ESI lifecycle plan

Learn and keep track of how long your company is legally required to maintain specific files. Use that information to develop a plan for storing ESI that must be retained and for destruction of data once its retention period has ended.

2. Use current storage technology

Oftentimes, technology moves forward more quickly than your files. Be sure to always keep all data on current devices. You do not want important data to get trapped on obsolete technology, such as floppy disks.

3. Be organized

Making sure that file names and folder names are clear and easy to understand ensures that the correct ESI can be located quickly when needed. It helps to decide on a naming convention and stick to it.

Anybody tasked with searching your company’s ESI should be able to answer the following questions:

• Who has access to this file?
• What is this information?
• Where is this information stored?
• When was this file created or last modified?
• Why is this information being retained?
• How is this data being stored/protected?

4. Security

Maintain proper cybersecurity that conforms to government or industry regulations. Install appropriate firewalls, password protection, encryption, and other measures as detailed in published industry regulations and as recommended by your company IT or chief security officer (CSO).

5. Back it up

The court is not kind to those who have lost relevant data due to hard drive crash and ineffective backup. Maintain and regularly test effective data backup measures. Loss of relevant data due to a hard drive crash and ineffective backup has been cause for spoliation fines.

6. Educate

Make sure any person who has access to data that must be maintained for legal or regulatory purposes has full understanding of company IG policies as they relate to the data that person wishes to access. For example, a manager must be aware of IG policies as they relate to employee reviews. A payroll clerk must be aware of IG policies as they relate to final paychecks.

Keep these policies in mind. When it comes to eDiscovery, the best advice we have for HR professionals is to be prepared. Consider identifying an eDiscovery partner and legal counsel and retaining these partners before the need arises. Your eDiscovery partner, along with your company’s IT department, can help to develop a plan and workflow for each possible situation. Arming yourself with a basic understanding of eDiscovery and a plan should allow everything to go smoothly.

Rene Novoa is a certified forensic investigator and manager of eDiscovery and digital forensics at DriveSavers. Since joining DriveSavers in 2001, Novoa has performed data recovery on thousands of storage devices plagued with mechanical failures, physical damage and logical corruption. Over the past 5 years, he has focused his efforts on developing proprietary forensic processes for failed devices. His understanding of emerging technologies helps solve new forensic challenges. Rene manages high-level client relationships and is the Vice President of the North Bay HTCIA chapter.

Read more: http://hr.blr.com/HR-news/HR-Administration/Employee-Privacy/eDiscovery-101-Human-Resources/