Staying in control of eDiscovery practices

07
Oct
2014

Simon Price

Trends in mobility have disrupted the enterprise world. Simon Price, UK Managing Director at Recommind, looks at what mobility means for eDiscovery practices and how legal practitioners can retain control. 

The advent of mobile devices – everything from laptops to smartphones and tablet computers – has had an irreversible impact on the way that organisations conduct business. While employees have always found ways of moving information electronically, gone are the days when they had to transport business information on a USB stick or send work files as attachments to their personal email addresses.

Now the convergence of omnipresent networks, cloud storage and smartphone devices means that it is easy to move information across mobile devices and locations.  

However, mobile devices have added another layer to the challenge of continuing to discharge a duty of competence in a digital era. Ultimately, dynamic forms of evidence still need to be retained as part of the eDiscovery process. To ensure a company’s litigation process remains defensible, organisations now need to design a plan for monitoring, collecting and preserving electronically stored information (ESI) across multiple channels to ensure that responsive data is available to be analysed as part of the eDiscovery process. 

Usage policies

Regardless of whether an employee is using a company-issued mobile device or a personal smartphone under a Bring-Your-Own-Device (BYOD) policy, the business needs to start by identifying the custodians using mobile devices to access corporate information. Once armed with this information, organisations can then start to develop usage policies designed to protect corporate interests. 

It is imperative that businesses introduce policies determining who owns corporate data that resides on the device and how ESI is preserved. Written agreements should articulate if an employee has a reasonable expectation of data privacy, how employees should handle company information and the enterprise’s right to access data on the device for legal matters.  

Cloud connections

Businesses also need to consider that mobile devices don’t store information in the same way that laptops do; work emails are stored on third-party cloud servers and mobile apps sync content over the cloud. With a single swipe of the screen, confidential corporate emails or client discussions can be redirected to public cloud providers outside of the enterprise firewall without the business even knowing. 

As a result, organisations need to go beyond just taking the appropriate steps to govern the data maintained on mobile devices. Businesses also need to track where the corporate information that is accessed through multiple devices is being sent or stored. For example, what if an employee is using their mobile to send emails from their work email addresses to their own personal email addresses; is this acceptable behaviour? What is the content of those emails and do they contain anything sensitive that shouldn’t leave the company firewall? Alternatively, what if an employee is uploading corporate documents to a file-sharing site that is later accessed using a mobile app? What corporate information is being placed into the folder and who is able to access it? 

Duty of competence 

Given that a single person can have hundreds of communications a day across several channels, this can easily add up to billions of documents once scaled across an entire organisation. As a result, businesses need to be able to quickly recognise the information contained in emails, spreadsheets, social media posts or online transactions to keep control of where confidential enterprise information is being directed. In cases where ESI is being stored with third-party providers, such as a personal email account or a storage collaboration platform, these new tools need the ability to integrate with cloud-based platforms to collect, process and review the relevant enterprise information. 

With the volume and variety of digital communication growing at an exponential pace, the ability to join the dots between information patterns is at the heart of tracing the roots of information. To manage the growing amount of information and ensure that organisations can preserve ESI as part of legal requirements, businesses need the help of next generation technology that provides a picture of patterns in unstructured information flows. By representing behaviour visually, businesses can get a better understanding of what type of corporate information is being moved and where it is being directed to stay in control of ESI.  

Ultimately, it’s impossible to anticipate or address every legal risk associated with mobile device use. However, organisations can ensure that a company has a reasonable plan in place to tackle the security or eDiscovery implications that may arise. By developing a holistic approach, businesses can be prepared and continue to execute a duty of competence in a digital age.