Expert guide to e-discovery | Computer Weekly

Given that litigation is consistently on the rise, regulatory bodies continue to ramp up investigations, and local law enforcement is increasingly aware of the ease at which it can source evidence electronically, electronic discovery (e-discovery) is an area that businesses need to consider, review and improve.

The process of disclosure of evidence to the Post Office Horizon IT Inquiry demonstrates a lack of oversight and accountability, poor communication protocols and a flawed understanding of the corporate data landscape.

On the face of it, the process of discovery or disclosure in response to litigation or regulatory investigation is simple:

1. Find all the communications, documents and data relating to the issue.
2. Relevant parties (most commonly lawyers and/or investigators) review, deciding what is relevant to the issue.
3. Send the relevant, not privileged, documents to the other party.

Unfortunately, businesses are increasingly reliant on misleading information provided by large enterprise and cloud-based platforms that would have you believe they will take care of this process for you. This leads to the overconfident assertion that “we can do e-discovery”, by virtue of a module provided with a button to push. For example, look at Microsoft’s Purview or Google’s Vault.

The reality is, as witnessed in the Horizon inquiry, the process can be extraordinarily complex and resource-intensive.

Reviews of relevant evidence can be hampered, for example, by:

1. The ever-increasing volume and complexity of data: The sheer volume and variety of data generated by modern organisations poses a significant challenge in e-discovery. This data, often dispersed across various sources and formats, becomes increasingly complex to identify, collect and review effectively. Think: Microsoft Teams, Slack, WhatsApp, large language models (LLMs) such as ChatGPT, Microsoft Copilot, SAP to name but a miniscule number of sources.
2. Legacy data: As technological progress marches on, it forgets about data created in 1997, stored on backup tapes in 2010 or sitting in an accounting system that was live in 2015. For many litigations, the time periods being considered are typically at least two years old before they reach courts or inquiries, and in my experience often relate to issues from five or more years ago. Legacy data formats can be challenging to collect and review.
3. The evolving legal landscape: Disclosure guidelines for courts and regulators are constantly evolving, making it crucial for organisations and their counsel to stay abreast of the latest changes. Failure to adhere to these evolving requirements can lead to legal consequences and reputational damage. Regulatory priorities are constantly shifting and anti-money laundering (AML), fraud investigations and dawn raids are all on the increase. Great corporate liability for criminal offences, including the Failure to Prevent Fraud as an offence, due in 2024, should all be of concern to any business.
4. The multitude of interested parties: The subjects of the litigation or investigation and their need for privacy; their individual legal counsel; your in-house legal counsel, or outside legal counsel; third-party IT, software-as-a-service (SaaS) and cloud providers; e-discovery suppliers; law firms, the regulators, the courts.
5. The need for robust e-discovery tools: The complexity of e-discovery necessitates the implementation of reliable and scalable e-discovery tools. These tools (should) seamlessly manage data collection, processing, review and exchange of documents, ensuring compliance and efficiency. Technology use should accelerate the review process.
6. The risk of spoliation: Spoliation, or the accidental or intentional destruction of potentially relevant evidence, can have severe consequences for organisations. It is essential to establish clear e-discovery policies and procedures to prevent spoliation and protect the organisation’s legal interests.
7. The cost of e-discovery: E-discovery can be a costly process, especially for large organisations with vast amounts of data. Optimising e-discovery strategies and using technology in a legally defensible manner can help reduce costs and streamline the process.
8. Privilege, privacy, business secrets: There are a whole host of legitimate concerns around the disclosure of data. The data needs to be assessed for risk as well as relevance.
9. Strategic abuse of the disclosure process: In the matters I have personally been involved in, the parties look to make disclosure a core focus, often at the cost of making meaningful progress with the core legal issues. Small discrepancies coupled with a lack of transparency can be exaggerated and used to call into question the evidence, the corresponding legitimacy of legal arguments and the trustworthiness of those involved. A cynical individual could suggest that sometimes these arguments are brought about to distract from the less convenient legal matters at hand.

What at the outset seems like a simple task can very quickly become a full-time job for dozens of people. This complexity could suggest that a degree of error is excusable, but this is far from the truth.

Parties must sign a “statement of truth”, or equivalent, as to their understanding of the disclosure process and it’s accuracy. If such statements exist, but there are fundamental errors with the approach, there are obvious and significant questions that need to be asked.

Back in 2006, I wrote a blog about proactive approaches to electronic evidence disclosure. It sought to address many of these perceived issues, and the essence of that article has not changed over the past 18 years.

A proactive approach is still needed, much in the way boards are beginning to organise their approach to managing cyber. This could include things such as:

• Tabletop exercises.
• Data mapping.
• Detailed incident response guidelines and appropriate technical systems.
• Ensuring the involvement of all relevant employees, including those who really understand the data of the organisation.

To assist in addressing these concerns, consider the following recommendations for addressing e-discovery risks:

1. Develop a comprehensive e-discovery policy: A well-defined e-discovery policy should outline the organisation’s procedures for preserving, collecting and reviewing data for e-discovery purposes. Regularly review and update the policy to reflect changes in the law and technology. This should be closely aligned with existing IT and security policies, such as retention guidelines.
2. Educate employees on e-discovery: Provide regular training to all employees on the organisation’s e-discovery policy and procedures. This training should emphasise their responsibilities in preserving and handling data that may be relevant to legal proceedings. This can in turn help to reduce the costs and risks associated with disclosure issues.
3. Identify effective e-discovery software: Invest in robust e-discovery software or vendor relationships that can effectively manage the identification, collection, review and production of relevant data. Choose software that aligns with the organisation’s specific needs and data volumes.
4. Request management: Mechanisms to appropriately manage inbound requests should be considered where there are frequent or complex requests being generated by larger or numerous matters. The recording of what is being requested by whom is vital, and should not just be left to, for example, a junior individual in the IT department who understands how to export emails using the basic functions provided in your email system.
5. Regularly review e-discovery procedures: Conduct periodic reviews of e-discovery procedures to ensure they remain effective and compliant with the latest legal requirements. Evaluate the effectiveness of e-discovery tools and make necessary adjustments – this is especially true of legacy data.
6. Seek expert guidance when needed: For complex e-discovery matters, or those with potentially significant legal implications, consider engaging experienced e-discovery consultants and appropriate legal counsel. Their expertise can help navigate the complexities of e-discovery and minimise risks.