RECORD RETENTION AND DESTRUCTION - American Bar …

1 RECORD RETENTION AND DESTRUCTION CURRENT BEST PRACTICES CH1 10542698 i RECORD RETENTION AND DESTRUCTION CURRENT BEST PRACTICES August 8, 2003 TABLE OF CONTENTS PAGE Records RETENTION - An Essential Part of Corporate Compliance By R. Thomas Howell, Jr. and Rae N. The DuPont Records Management Excerpt From DuPont Records Management Guide ..22 Electronic Evidence & The Sarbanes-Oxley Act of 2002 By Michele Challenges of Corporate Counsel in the Land of E-Discovery Lessons from a Case Study By Daniel L. Pelc and Jonathan M. Electronic Discovery and Computer Forensics Case Law (Organized by Topic) Kroll Ontrack, Inc..42 Discoverability ..42 Procedure.

2 47 Production of Data ..53 Spoliation ..64 Sanctions ..69 Work Product Doctrine & Privilege ..72 Experts ..76 Computer Forensic Sample Preservation Letters Kroll Ontrack, Zubulake v. UBS Warburg, LLC et al..89 ii Electronic Records: What to Look/Ask For By Lori J. Marco and Katie M. RECORDS RETENTION - AN ESSENTIAL PART OF CORPORATE COMPLIANCE By R. Thomas Howell, Jr. and Rae N. Cogar1 It is impossible for an organization to achieve acceptable legal compliance without an appropriate and functioning records RETENTION program, for two distinct but important reasons: 1. Records RETENTION is an important substantive component of many of the laws with which most corporations must comply; and 2. Retained records are often the vehicle by which compliance is established.

3 As stated in Documents, What Documents? by Michael E. Arruda, Margaret Prinzing and Shruti Rana, January/February 2003 issue of Business Law Today at page 23, a good policy typically has two principal elements: (1) a schedule identifying the RETENTION periods (minimum and maximum) for all documents covered by the policy, and (2) a framework for the administration of the Determination of the schedule of appropriate legal RETENTION periods involves consideration of both federal and state regulatory requirements, contractual obligations, intellectual property requirements and statutes of limitations. These various legal requirements must then be harmonized with business considerations, which may extend the legal RETENTION periods. The records RETENTION program must also deal with the demands of litigation, investigations and audits. Care must be taken not to violate regulatory or company privacy requirements, and a system must be in place to halt regular RECORD DESTRUCTION in the face of certain investigations and litigation.

4 Finally, as the Andersen/Enron situation so dramatically demonstrated, careful implementation of a document RETENTION / DESTRUCTION policy when under fire is critical. Failure to do so exposes an organization to multiple risks, including sanctions, considerable costs and adverse inferences. 1 R. Thomas Howell Jr. is of counsel with Seyfarth Shaw in Chicago, IL. Rae N. Cogar is Senior Consultant with Cohasset Associates, Inc., Hamburg, N. Y. 2 Developing the appropriate substantive records RETENTION policy may be easier than appropriately and consistently implementing it. Implementation involves training and education, capability assessment, assigning and monitoring responsibility and updating the policy to ensure that it reflects current legal requirements and business needs. WHAT IS A BUSINESS RECORD ? Every company should define what constitutes a business RECORD . Having a definition will make operational recordkeeping decisions easier.

5 Records are created for a variety of reasons, including: complying with government regulatory or statutory reporting requirements, documenting daily business activities, documenting research and development methods for possible patent applications, as well preserving the legal rights of the business. For whatever reason a RECORD is created, there is a useful life of that RECORD -- a period of time when the RECORD is important for business decisions. Although the balance of this paper will deal with those items that are determined to be records, consideration should also be given to everything else. Every organization s files, hard drives and other repositories contain a great deal of material that will not be designated a RECORD , for business purposes, and subject to the RECORD RETENTION policy. The RETENTION policy should also identify this information and provide guidance on what to do with this material. Such material might be drafts, records retained only for informational purposes or personal material.

6 For the most part and for several obvious reasons, such material should be purged pursuant to a consistently followed program or policy at regular, frequent intervals. It should be noted that computer systems create records and systems that back them up on a regular basis and those records would be considered a business RECORD for Information Technology departments as they provide information on the functioning of the computers. There must be a well-defined method for managing material defined as records retaining what is needed and eliminating what is not. While a standardized methodology has been developed for creating records RETENTION programs, there is no off-the-shelf program that can be installed one day and in use the next. Each RETENTION policy is created to the specifics of the individual business. Although there are many records management software programs available, the results of these programs rely on information contained in the company s records RETENTION policies and procedures.

7 Developing that information is a significant undertaking. 3 beginning THE PROCESS Inventory The place to start is the development of a records RETENTION schedule. This is done by identifying what records a business has through a records inventory. The inventory includes records created by all departments and users, in all media formats, and found in all locations. Once the inventory has been completed, how long each RECORD is to be retained must be determined. Records that are created to comply with federal or state regulatory and reporting requirements will have the same RETENTION requirements for most businesses. However, accounting records created by Company A may not have the same RETENTION requirement as similar records created by Company B due to the difference in the internal use of those records. Typically, specific legal requirements apply to less than 25% of a business records. Index To find records in a timely manner, quality indexes must be maintained of all RECORD holdings.

8 This includes not only the active and inactive records, but documentation pertaining to the DESTRUCTION of records. Only with these types of records, and the proper authentication thereof, can the bona fides of a good RECORD RETENTION policy be established. RETENTION CRITERIA Legal Factors One important factor to understand is that RETENTION periods stated for any regulatory or statutory purpose are considered minimum RETENTION periods the shortest period of time a RECORD must be held. Legally compliant RETENTION schedules should be viewed as the time when disposing of a RECORD can first be considered, rather than when you must dispose of a RECORD . Decisions are frequently made to retain records longer than their prescribed minimum due to other factors; an on-going business use, internal audit requirements or historical value. Whenever RETENTION periods are lengthened, a determination must be made identifying the potential risks and costs to the company.

9 It is also desirable to review pertinent statutes of limitations when determining records retentions. Statutes of limitations define the time period an organization can sue or be sued on a matter, or the time period in which a government agency can conduct an investigation or audit. While statutes of limitations in themselves are not required RETENTION periods, they should be a factor in determining risk for a company when deciding how long to retain records. A decision can also be made to eliminate 4 records before the prescribed minimum RETENTION period has run. Such a decision will have its own set of risks that should be carefully considered. All decisions relating to extending or shortening prescribed RETENTION periods should be documented and retained. This documentation will help others to understand why such decisions were made, which may be pertinent in subsequent litigation to support the reasonableness of the records policies, as the cases discussed below demonstrate.

10 Business Factors By understanding how a RECORD is used within a company, better decisions can be made about the RETENTION of that RECORD . The best method to determine a RECORD s RETENTION is using the team approach -- a team that includes the records manager, legal counsel, business manager, technology manager and a representative from the area or department that creates or uses the RECORD . The collective knowledge of this team will enable informed records RETENTION decisions. Implementation Once RETENTION periods have been determined, agreed upon and signed off by management, the next step is to develop the policies and procedures that will govern the implementation of the schedules. One of the most important policies relates to the suspension of records DESTRUCTION in the event of imminent or current litigation, receipt of subpoenas, government inquiries, audits, or any other type of event that might warrant such action. When the records may be needed beyond the defined RETENTION period, a methodology should be in place which immediately notifies all appropriate persons of these actions.