When it comes to e-discovery, there’s no hiding in the cloud
As more and more businesses look to the cloud to address their IT/IS needs, new challenges in digital “document” management are created, including for e-discovery. E-discovery — that is, identifying and producing electronically stored information (ESI) that may be relevant to issues in a legal dispute — is an inevitable part of running almost any business in the digital age, and may become even more demanding with the rise of cloud computing.
The cloud’s benefits
Cloud computing offers many advantages to business users, such as not needing to upgrade storage capacity. A business realizes such advantages by contracting with one or more cloud service providers (CSPs) to store its data on remote servers (which may be located outside the United States), through private or public networks of servers, or a combination of both.
When served with discovery requests in a lawsuit to which it is a party, or with a subpoena in an action it is not involved in, a responding party has the burden to identify, preserve, and collect electronically stored information located in the cloud. Although a business’s digital information may not reside on its own servers when it outsources to a CSP, courts have held that a business can be compelled to produce information even when actual possession of the information is in the hand of a third party such as its CSP.
The Federal Rules of Civil Procedure define discoverable data as ESI that is “in the responding party’s possession, custody, or control.” Courts have stated that data in the possession of the third party is in the responding party’s possession, custody, or control if the responding party “has the right, authority, or practical ability to obtain the information from the third party.” Also, a party has a duty to preserve data that may be discoverable in a lawsuit as soon as it reasonably anticipates that the lawsuit could occur.
The cloud’s challenges
Applying these rules to the cloud, a business will not be able to minimize or avoid its discovery obligations by hiding behind the fact that its data is stored or maintained remotely in the cloud and it does not have direct control over the data. Where hardware and servers are located remotely, there can be huge difficulties in searching for information that is contained on them and that is responsive to discovery requests; for example, commonly used methods like keyword searches may not work as well or at all.
(Continued)
In addition, a business’s data can be spread across its CSP’s servers and constantly moving between them, as well as intermingled with and/or inseparable from the data of other, non-litigant users in a public cloud. Further, the business cannot access a CSP’s operating servers or other hardware to suspend automatic deletion functions, which can lead to information-preservation issues. (Of course, discoverable information should still be protected by the attorney-client privilege and other privileges, regardless of where it resides.)
Recommendations
The key to addressing these issues is for businesses to include in their CSP agreements provisions for litigation and discovery procedures that permit them to live up to their e-discovery obligations when they are parties to a lawsuit or served with a nonparty subpoena. At the very least, if a business’s CSP lacks the tools necessary to handle discovery, the CSP must be able to accommodate a third party’s discovery-management application.
A business should also make certain that its internal information-management and retention policies contain provisions for complying with its e-discovery responsibilities.
Businesses need to be prepared to demonstrate reasonable discovery compliance when their ESI is in the cloud so that, in the worst-case scenario where data is irretrievably lost or deleted, harsh sanctions will not be imposed by a court in light of its good-faith, adequate efforts to comply.
Donald A. Daugherty is an attorney in the Milwaukee office of Whyte Hirschboeck Dudek S.C., where he leads the firm’s Business and Commercial Litigation Team. He can be contacted at ddaugherty@whdlaw.com.
Click here to sign up for the free IB ezine – your twice-weekly resource for local business news, analysis, voices, and the names you need to know. If you are not already a subscriber to In Business magazine, be sure to sign up for our monthly print edition here.
