Guideline number: DM-08
Date issued: 7/10/2010
Date last reviewed: 2/13/2017
Date of next review: 6/30/2024
Version: 3.0
Approval authority: Vice President and General Counsel; Vice President and CIO
Responsible office: Office of the General Counsel; Information Assurance
I. Overview
The identification, preservation, production, and management of electronic information associated with litigation cases is generally referred to as the eDiscovery process. Amendments to the Federal Rules of Civil Procedure (FRCP), effective December 2006, and amendments to the Michigan Court Rules, effective January 2009, specifically address the litigation discovery process for electronically stored information (ESI). To comply with these rules, the University of Michigan is obligated to make good faith efforts to preserve ESI that could be relevant to pending or reasonably anticipated lawsuits and to potentially retrieve and produce this information in the course of the litigation process.
II. Guideline Purpose
The purposes of these guidelines are to:
- Ensure that the university complies with eDiscovery obligations;
- Ensure that individuals—data holders, their managers, and their IT providers—are aware of their responsibilities to promptly respond to eDiscovery requests;
- Provide a repeatable, streamlined eDiscovery process for the Office of the General Counsel (OGC) and for others involved in this process; and
- Protect the privacy of personally identifiable information (PII) that may have been captured during the eDiscovery process in compliance with university policies.
The guidelines are specifically intended for data holders, IT providers, department managers and department administrators who are requested by OGC to hold, preserve and produce electronic (and other) information associated with a given dispute. The guidelines also serve as general awareness information for IT providers and others across the university.
III. Guidelines
These guidelines apply to all campuses including Flint and Dearborn and are generally consistent with the process used in Michigan Medicine. The guidelines do not cover disputes involving HIPAA-related information that are handled by OGC and the Michigan Medicine Compliance Office.
In general, electronically stored information (ESI) relevant to a dispute must be preserved. This includes information that is centrally stored (in email and other file servers), information that is locally stored on desktops, laptops, home computers, PDAs, CDs, flash drives, smart phones, etc., and also information that is outsourced or stored in the cloud, to the extent that the data holder has the ability to ensure such information is preserved. While the focus of these guidelines is on electronically stored information, paper and other media containing information relevant to a given case should also be preserved and are addressed by these guidelines.
There may be some cases where relevant information does not need to be stored, for example, multiple generations of backup storage do not need to be preserved if a master copy is preserved. In other cases, the difficulty of preserving/producing certain information may be deemed unreasonable. Any such exclusion must be specified and approved by OGC.
These guidelines do not include detailed instructions for how to preserve, search, or produce ESI in a specific technical environment. Such instructions vary and need to be provided by the appropriate IT support staff.
IV. Responsibilities
While individuals have particular responsibilities concerning eDiscovery, it is essential that the eDiscovery process is collaborative and all lines of communication remain open. For example, in order to ascertain the scope of potential eDiscovery, OGC will require reliable information from Data Holders and User Advocates concerning the underlying facts of the dispute and the location of relevant ESI. Similarly, Data Holders and User Advocates may have questions for OGC that arise throughout the process.
-
Office of General Counsel (OGC): OGC is the owner of the eDiscovery process and has overall responsibility for initiating the eDiscovery process, notifying individuals of their responsibilities, and monitoring and managing the process. Specific responsibilities include:
- Determining the need to issue a preservation/litigation hold;
- Involving the IT User Advocate in the eDiscovery process as appropriate;
- Determining the scope of the hold and, in conjunction with IT providers and/or the User Advocate, identifying the types of systems and media that need to be searched, the searching criteria, and the appropriate collection methods;
- Issuing preservation/litigation holds;
- Collecting and reviewing relevant ESI and non-electronic information;
- Ensuring the confidentiality and integrity of private personal information or other sensitive information that may have been captured as a part of a litigation hold;
- Issuing instructions to release a litigation hold;
- Monitoring, managing, and working to further improve the overall litigation process.
-
IT User Advocate (UA): The User Advocate (UA) function is part of Information Assurance, and is generally responsible for investigating potential violations of information policies and for ensuring that the privacy of individuals is protected when information assets containing private personal information are accessed. In the context of eDiscovery, the User Advocate assists OGC, in particular in cases where individual data holders are not available or when OGC determines that it is not appropriate to engage data holders.
Specific responsibilities include:
- In conjunction with OGC, identifying relevant computing environments and searching/preservation approaches;
- Ensuring the confidentiality and integrity of private personal information or other sensitive information that may have been captured as a part of a litigation hold;
- Conducting searches and preservation when data holders are not available and in other cases as instructed by OGC;
- Assisting departmental IT staff in complying with OGC requirements relative to a litigation/preservation hold;
- Providing consulting and support in conducting search, preservation, and production and in protecting sensitive information;
- Providing guidance and templates for departmental eDiscovery instructions;
- Packaging ESI from multiple sources, if appropriate, and providing it to OGC.
-
Data Holders: Data holders are faculty, staff, or students who may hold information relevant to a given case in their records and are requested by OGC to preserve these records. Specific responsibilities include:
- Complying with OGC instructions relative to litigation cases;
- Engaging their local IT support staff and/or the UA to assist in preservation, search, and production functions;
- Preserving applicable information. This may include suspending any personal practices regarding destruction of relevant ESI (such as deletion of emails or voice mail) and disabling known automated delete functions;
- Conducting searches per OGC provided criteria to identify relevant ESI;
- Collecting and preserving relevant information without alteration;
- Providing relevant personal or university-owned devices to OGC or as instructed by OGC; and
- Notifying their departmental management of the litigation hold.
Note: As a general rule, and in accordance with Privacy and the Need to Monitor and Access Records (SPG 601.11), data holders are expected to maintain business records separate from personal records; preservation and production should not typically include their personal information. However, there are cases where personal information of data holders may be captured in the eDiscovery process. Efforts will be made to protect the confidentiality of such information.
-
Departmental IT Staff: Departmental IT staff members may be notified by OGC or Data Holders of litigation holds so that they can support and assist the data holders in their areas. Specific responsibilities include:
- Documenting departmental instructions for suspending deletes, search, preservation, and production;
- Assisting department data holders in conducting search, preservation, and production activities, engaging the UA if necessary.
-
Departmental Management and Administration: Departmental managers and administrators are notified by Data Holders of litigation holds involving data holders in their departments and are expected to support these individuals. Specific responsibilities include:
- Ensuring data holders comply with OGC requests relative to eDiscovery;
- Ensuring data holders are supported and assisted by departmental IT staff;
- Conducting preservation and search of non-electronic media for individuals who may not be available as requested by OGC.
- Assisting in the preservation of the litigation hold by ensuring that devices or files are maintained as instructed especially if the Data Holder is no longer able to do so.
Department managers and administrators are encouraged to maintain and administer appropriate document retention policies in order to responsibly manage the ESI related to that department’s activities. Such retention policies should be explicitly subject to any directions from OGC concerning discovery matters.
V. References
- Privacy and the Need to Monitor and Access Records (SPG 601.11)
- Personally Identifiable Information, Sensitive Data Guide, Safe Computing
- Educause E-Discovery Guideline and Toolkit
Attachment 1: The eDiscovery Process Flow
Process Steps
1000 Identification
| Responsible | Process Steps |
|---|---|
| OGC |
|
| OGC; UA | Identify the types of systems and media that need to be searched, the searching criteria, and the appropriate collection methods |
| Data Holders; Departmental IT Staff; Departmental Management & Administration | Assist OGC and the UA in identifying individuals, systems, media types, and collection methods. |
| OGC |
|
2000 Preservation/Collection
| Responsible | Process Steps |
|---|---|
| Data Holders |
|
| UA |
|
| Departmental IT Staff | Assist department data holders and the UA in conducting search, preservation, and production activities |
| Departmental Management & Administration |
|
| OGC | Monitor the hold and ensure participants are conducting preservation activities as instructed |
3000 Production
| Responsible | Process Steps |
|---|---|
| OGC | Issue production notification and instructions
|
| Data Holders; UA |
|
| Departmental IT Staff |
|
| Departmental Management & Administration | Collect and package non-electronic materials for individuals who are not available and provide to OGC |
| OGC |
|
| UA | Assist OGC as needed
|
4000 Release Hold
| Responsible | Process Steps |
|---|---|
| OGC |
|
| Data Holders; UA | Release/delete data as instructed by OGC |
5000 Ongoing eDiscovery Management Activities
| Responsible | Process Steps |
|---|---|
| OGC |
|
| Data Holders; UA | Continue to retain any data that was included in a preservation/hold request until specifically instructed by OGC to purge |
| Departmental IT Staff | Document departmental instructions in applicable environments for suspending deletes, search, preservation, and production |
| UA |
|
| Departmental Management & Administration | Monitor department involvement in any litigation cases and inform OGC if data holders terminate or transfer |
Attachment 2: Frequently Asked Questions
Adopted from Educause (2006)
What do “electronic discovery” and “data preservation” mean?
“Discovery” is the process by which relevant information is exchanged between parties in a lawsuit. It is conducted via the exchange of information, production of documents, production of written statements, and the taking of depositions. Federal and state courts have long recognized that electronic data is subject to the same discovery rules as other evidence relevant to a lawsuit. The issue has received national attention because of a series of court rulings resulting in the imposition of large sanctions on parties for their failure to preserve electronic data and because of amendments to the Federal Rules of Civil Procedure that took effect on December 1, 2006.
According to these federal rules, the university and all of its faculty and staff members are now under a legal duty to preserve all evidence, whether hard copy or electronic, that might become relevant to the lawsuit upon notice that a lawsuit has been commenced against the University or if it is reasonably anticipated that a lawsuit may be brought (or a charge filed) against the university.
What information needs to be preserved?
Generally, the university is required to suspend routine or intentional purging, overwriting, re-using, deleting, or any other destruction of electronic information relevant to a lawsuit, including electronic information wherever it is stored—at a university work station, on a laptop, or at an employee’s home. It includes all forms of electronic communications—e.g., email, word processing, calendars, voice messages, instant messages, spreadsheets, videos, photographs, information in PDA’s, and data in any other locations where electronic information may be stored. This electronic information must be preserved so that it can be retrieved—if necessary—at a later time. The information must be preserved in its original electronic form, so that all information contained within it, whether visible or not, is also available for inspection—i.e., it is not sufficient to make a hard copy of electronic communication.
What will I have to do as a “data holder”?
You will be notified of the duty to preserve electronically stored information through a notice called a “litigation hold” (or a “preservation hold”). You will then be asked to cooperate with the Office of the General Counsel (OGC), the User Advocate, and your local IT personnel to ensure that all potential sources of electronically stored information in your possession or under your control are identified and preserved. You should be careful not to delete, destroy, purge, overwrite, or otherwise modify existing electronic data relevant to the case. You should also be careful to disable any automated purge or delete functions that may destroy relevant information. You should notify OGC if you believe other sources of relevant information exist of which OGC is not aware.
Who is involved in the preservation hold process?
While different individuals have particular responsibilities concerning eDiscovery, it is essential that the eDiscovery process is collaborative and all lines of communication remain open. For example, in order to ascertain the scope of potential eDiscovery, OGC will require reliable information from the Data Holders and User Advocates concerning the underlying facts of the dispute and the location of relevant ESI. Similarly, Data Holders and User Advocates may have questions for OGC that arise throughout the process. Detailed information regarding the responsibilities of the OGC, User Advocate, Data Holders, Departmental IT Staff and/or Departmental Management and Administration is outlined in the Guidelines section of this document.
For how long do I need to preserve this information?
OGC will notify you when you are no longer obligated to retain the preserved information. Generally, this will be when the statute of limitations has expired with respect to the claim or—if litigation has been commenced—when the lawsuit and all appeals have been concluded. If at any time you question whether to continue holding this information, you need to check with the OGC contact identified in the litigation/preservation hold before destroying any information.
Do I need to also preserve data on my home computer?
Yes, the same rules apply to any computer that stores information potentially relevant to a lawsuit. Thus, if you use your home computer for university-related business (including email on your university email account or on a personal account such as Gmail, etc.), you must preserve the data on that computer as well.
How will I know what information I need to preserve?
OGC will specify the search criteria that you will need to apply to select required information. Retrieved information should not be filtered, unless so instructed by OGC. OGC will segregate the information at a later time as needed.
Can I take personal or sensitive material that isn’t relevant to the case off my computer?
You may remove data from your computer (or segregate it from the data that will be preserved) if you are absolutely certain that it is unrelated to the claim (e.g., correspondence entirely unrelated to university employees or university business, income tax returns, your music library, etc.). However, note that it is often difficult at the beginning of a lawsuit to be certain about what might later turn out to be relevant. So, you should examine each and every file you are considering deleting—i.e., do not make wholesale deletions of data. An attorney representing the opposing party about what data you may have destroyed may question you under oath at a later date.
I already deleted something that might be relevant—should I be concerned about that?
The duty to preserve information generally arises when you receive a preservation or litigation hold notice or when you otherwise reasonably anticipate litigation. Information not normally preserved before that time should not create a problem.
What if I am involved in an ongoing matter relating to the person who is suing the University?
You must also preserve any new electronic information that is generated after receipt of a litigation hold that may be relevant to the dispute (such as an employment claim by a current employee where relevant new documents may be created during the ongoing employment relationship).
Who will pay for the cost of preserving ESI?
The costs associated with complying with the e-discovery requirements will generally be handled in the same manner as other litigation expenses are presently handled. Internal costs, such as time spent by employees and applicable storage costs will be absorbed by the department. If preservation appears to cause unusually high expense, the User Advocate and/or OGC may be consulted to recommend a course of action.
Who will be looking at my data?
Initially, no one will review your data. If and when a discovery request is made, you may be asked to conduct a search of the data or the User Advocate will conduct the search. The User Advocate will also store all preserved data. OGC (and possibly others) may need to review electronically stored information to assist in answering the lawsuit or to comply with discovery obligations.
Who decides what data will be turned over to the opposing party?
The same rules of relevance and privilege that apply to “paper” discovery also apply to the discovery of electronically stored information. Before any data is turned over to the opposing party, OGC will review it for relevance and determine that it is not otherwise protected or privileged.
What format or media should I use to preserve and produce required information?
In general, information should be preserved in its native form. It may include references and hidden information that should be preserved as well. For production, OGC will specify the required format and media type that will facilitate access to the information.
Since when did we have to go to all this trouble?
Electronically stored information has been discoverable since the 1980’s. Because of the egregious misconduct by several defendants and because of the ever-widening use of computers, over the last several years the courts have developed rules specific to the preservation of electronic data. The new amendments to the Federal Rules of Civil Procedure addressing electronic discovery took effect December 1, 2006.
What if I don’t want to disclose my data?
The university and its employees have a legal duty to preserve, and subject to the rules governing discovery, turnover electronically stored information. In short, the law does not offer us a choice. Failure to abide by the law may result in judicially imposed monetary sanctions and adverse findings in the litigation. We will take steps to protect your privacy and to ensure that protected/privileged information is not disclosed, but ultimately the court will be the arbiter of whether sensitive information must be disclosed. You may also want to refer to SPG 601.11 which addresses your and the university’s responsibilities relative to privacy and the need to monitor and access records.
Will I be called to testify in court about information that I have preserved?
This will be very unlikely. Generally, any questions around the accuracy and completeness of preserved information are addressed internally with OGC, the User Advocate, and the data holder. On rare occasions, the User Advocate may be called to testify about a particular case.
What should I do with my electronic data if I leave the university?
If you plan to leave your employment with the university during the pendency of a lawsuit for which you have received a preservation hold, you should confer with OGC or the User Advocate before relinquishing control of your computer.
Do Litigation Holds apply to backup and disaster recovery storage?
The answer to that is “it depends.” This is a judgment call that would be generally left to OGC. The considerations are whether the information on such sources is likely to be discoverable and not available from other reasonably accessible sources. If in doubt, OGC should be consulted to make this determination. OGC, in turn, may solicit advice from the User Advocate and from other IT providers.
What if I have additional questions?
Contact the attorney or legal assistant who issued the preservation or litigation hold notice. For general information, contact one of the following legal offices with whom you most frequently interact:
- Office of the General Counsel
5010 Fleming Bldg.
503 Thompson Street
Ann Arbor, MI 48109-1340
734-764-0304
[email protected] - User Advocate
For technical assistance relating to data preservation and production
[email protected] - Office of the General Counsel: Michigan Medicine
300 North Ingalls Bldg, Room 3B04
Ann Arbor, MI 48109-5476
734-764-2178
[email protected] - Office of Technology Transfer
1600 Huron Pkwy, Bldg 520, 2nd Floor
Ann Arbor, MI 48109-2590
734-763-0614
[email protected] - Development Legal Office
9000 Wolverine Tower
3003 S. State St.
Ann Arbor, MI 48109-1288
734-647-6095
[email protected]