Two-minute guide to Electronic Data Discovery

Let the fear-mongering begin: the Federal Rules of Civil Procedure (FRCP) requirements are changing effective December 1, 2006, with new requirements for electronic data discovery (EDD). Images of a pale and blinking CIO walking through phalanxes of shouting reporters and photographers may come to mind. But the reality is not so dire.

What is electronic data discovery?
In civil cases (non-criminal lawsuits mostly) judges want everyone prepared. The FRCP rules of discovery lay out the process by which both sides get to search each other's files looking for evidence that supports their case. It's an existing process extended to electronic information.

So what's new?
Not much. Most of the changes are technical and not scary at all, like including EDD planning in pre-trial conferences. If you like there is a short summary of the rules at UScourts.gov.

What's interesting?

• Rule 34 acknowledges that "electronically stored information is explicitly recognized as a category . . . distinct from "documents" and "things." The courts recognize that computer information differs in three major ways from traditional documents:
  • Volume is often enormous.
  • The information is dynamic - easily overwritten, deleted or changed, often without anyone's specific direction or knowledge (BSOD, anyone?).
  • The information may be incomprehensible apart from the system that created or stored it.
• Rule 37(f) is the IT department's friend. It offers "limited protection against sanctions . . . for a party's failure to provide electronically stored information in discovery." The limits are:
  • The data must be lost in the routine operation of an information system.
  • The operation of the system must be in good faith - which may mean modifying IT operations to preserve data that might be needed for pending or reasonably anticipated litigation.

Buy or cry?
Some vendors will try to use the new FRCP rules to spook customers into buying costly stuff. Don't fall for it. Here's what to do:

• Your company's lawyers and record management folks are responsible for setting electronic data retention policy - not IT
• IT must take the lead, working with policy makers, in architecting an economic and effective infrastructure to ensure compliance
• IT needs a documented process whose ownership lies outside IT for unscheduled data destruction - such as when a VP wants all their emails to a client deleted - and staff must be trained on it.

If you want to know more check out this site. And relax, at least about EDD - you've got bigger problems.