Surviving the Departed Employee: eDiscovery Edition

Although Gloria Gaynor’s famous lyrics from I Will Survive pertain to lost love, they can also be rewritten for the departed employee dilemma.

At first, I was afraid, I was petrified.

Thinkin’ all the files were gone without you as my guide.

But our team spent so many days thinking how we’d done it wrong,

And we grew strong. And we learned how to get it done!

This author offers her deepest apologies to Freddie Perren and Dino Fekaris — the writers of this iconic anthem — for this display of terrible songwriting skills. But the sentiment holds true. While there is certainly danger in losing institutional knowledge, theft of confidential and/or proprietary information, and significant business disruption when employees leave, discovery-related risks must also be considered. Proactive planning and consistent implementation procedures can help mitigate these risks.

Failure to adequately preserve potentially relevant information can result in monetary sanctions, adverse jury instructions, or even a default judgment. Changes in employment status do not remove the preservation requirement. The case Knickerbocker v. Corinthian Colleges[1] — where plaintiffs were awarded monetary compensation and attorneys’ fees due to the automated deletion of two former employees’ email files — provides a stark reminder of the potential consequences of not utilizing appropriate procedures when employees depart.

On the flip side of the album are companies that save everything, either to ensure compliance or because team members want access to a departed employee’s work product and emails for future use. The over-preservation challenge is exacerbated when litigation holds continue in perpetuity — through an overabundance of caution or simple inertia around IT retention practices — creating a graveyard of company equipment and exponential data volumes that could cause ramifications in future cases. Read the blog post, When the Matter is Over, is it Really Over for your Data, for more information about the importance of proper data disposition protocols.

How do you overcome these evolving challenges? Plan, plan, plan. Then execute the plan. Consistently.

When an employee leaves, the organization must navigate a perilous path through an eDiscovery minefield. Controls, timing, and workflow automation are critical to ensure that a consistent approach is deployed rapidly prior to an employee’s departure. Luckily, with advances in technology, coupled with best practices and standard operating procedures, a corporation can build a defensible process to ensure that relevant content is retained, and that device reclamation occurs in tandem, so corporate assets can be rotated back into circulation.

Capturing at-risk evidence requires prompt coordination of actions from multiple parts of the organization, including HR, Legal, and IT. Here’s how to successfully execute your survival plan.

The first and most important component is performing a comprehensive custodian interview that includes identification of at-risk data and corporate devices. Employees should be evaluated according to their level of importance or risk vis-à-vis the active litigation portfolio, potential future litigation or investigations, or anticipation of legal action related to their employment or departure. This may seem daunting, as the frequency of employee turnover and involvement of multiple departments creates significant challenges.

These challenges can be minimized most efficiently through the assistance of technology, such as Evidence Optix®, which provides an organized, consistent, and centralized workflow for departing employee custodian interviews and data source tracking, including all preservation, collection, and disposition decisions.

Once custodians are ranked and meet the criteria for relevant content to be evaluated during the custodian interview, remote, targeted preservation and collection technologies, coupled with advanced search methodologies, can be executed quickly, with minimal involvement of the custodian. This significantly reduces the window of time to complete these tasks. No longer is it necessary to forensically collect computers and mobile devices, since the threshold of potentially relevant data is typically much narrower.

Advances in index in place technologies enable corporations to execute targeted, remote searching and collections across various data sources for an applicable custodian. Not only does this address email, computers, and file shares, it also supports MS Teams, SharePoint, One Drive, and M365 without an E5 license and throttling challenges. This can be instituted by IT immediately upon notification of collection decisions.

Other collection technology can capture computer content remotely based on an automated script that captures certain aspects of a device, such as a complete user profile in Windows. Alternatively, specific folders, cloud accounts, or other data locations can be selected by an interviewer with the departed employee’s assistance.

Mobile device collections have typically proven challenging, as many organizations default to a full forensic image of a device via a collection kit — a process further complicated by BYOD programs. This can take several weeks to orchestrate because direct access to the phone is necessary. In many instances, the only content needed is text messages or chat applications. The ability to remotely apply limiting criteria at the point of collection — including targeting specific applications, date ranges, and message participants — can drastically reduce the collection timeline and data volumes.

By proactively planning and executing these strategies, your organization can ensure compliance with eDiscovery obligations and avoid the pitfalls of over-collection, spoliation, and associated sanctions. With your plan in place, you will be happily singing:

No, not I — I will survive.

As long as I know how to plan, I know I’ll stay alive.

I’ve got all the sources saved and all the files at hand.

I will survive! I will survive![2]

[1] https://law.justia.com/cases/federal/district-courts/washington/wawdce/2:2012cv01142/185458/85/

[2] The author apologizes for putting this ear worm into your brain.