How to navigate the next data frontier in eDiscovery

Growing communication channels present challenges to collecting, preserving, reviewing and processing data.

In brief

• As the volume of data increases, challenges related to preserving metadata, capturing system data accurately, and restoring deleted data increase as well.
• Access to personal social networking accounts is often limited due to each site’s terms of service protecting an individual user’s privacy.
• Workplace collaboration and communication tools are replacing many office environments and creating new sources of eDiscovery.

The variety of communication channels continues to broaden as we see more widespread adoption of social media, encrypted messaging and collaboration platforms. The growing channels present challenges to collection, preservation, reviewing and processing data.

Legal teams must increasingly understand the most popular types of information to properly evaluate the issues that may be relevant, including ephemeral messages and noncustodial, persistent communications and then apply technical leading practices for properly managing the data in a complicated litigation or investigation.

Data could determine the difficulty of discovery

The discovery and disclosure of novel, nonstandard electronically stored information (ESI) poses many of the same problems as managing common Microsoft Outlook and Office files. As the volume of data increases along with the number of different channels, each with its own storage location, the challenges related to preserving metadata, capturing system data accurately, and effectively restoring deleted data increase as well. These are critical considerations because the time and costs of locating, reviewing and preparing nonstandard data formats for production may be much greater than more familiar forms of ESI prompting potential arguments about proportionality in a contentious dispute.

After all, users now create and share content on an array of platforms. The most popular platforms, based on usage data among adults in the US, have historically been YouTube and Facebook followed by Instagram, Pinterest, LinkedIn, Snapchat and Twitter.1 Regardless of their popularity or penetration, these platforms are among the most challenging to preserve, collect and review in eDiscovery.

Social media data is common, yet complex

Seeking the discovery of social media accounts is commonplace in litigation but access to personal social networking accounts is often limited due to each site’s terms of service protecting an individual user’s privacy, and the resulting challenges of preserving and collecting potential evidence for processing. The ease of communication with friends, family and colleagues produces voluminous material that incorporates many file types. They can include blog entries or posts, comments, replies, online and offline status notes, images and emojis, among others. The array of formats and communication threads make it challenging to draft effective discovery requests because the context, including multi-subject threads with short headings and emoji, is an important part of the inquiry.

Collaboration tools are transforming communication habits

Workplace collaboration and communication tools like Google Meet, Slack, Microsoft Teams and Zoom are replacing many office environments and creating entirely new sources of eDiscovery, which is a trend that has accelerated during the pandemic. This growth can outpace an organization’s terms of use, ownership, retention and storage policies. These “virtual office” collaboration tools further complicate these issues by mirroring social media features to make them familiar to users, while routine eDiscovery problems associated with exponential volumes of data, context-sensitive messaging, and attachments persist in these environments.

Messaging is making eDiscovery more complicated

Most individuals use more than one messaging application on their mobile devices when they communicate for work or with family and friends. Popular tools include Facebook Messenger, Snapchat and WhatsApp, among others. As a result, potential evidence could reside in various locations requiring multichannel eDiscovery to align relevant parties, notes, emojis and other connections. Some apps support ephemeral messages that do not persist in RAM or other storage mediums.

Further complicating the management of this material, users — not organizations — typically operate these tools, which can directly impact document retention policies and protocols, and other eDiscovery-related practices. However, the organization might own the equipment itself despite the proliferation of bring-your-own-device (BYOD) policies. The increasing support for BYOD plans, where the individual owns the hardware and grants an employer access to the data, also confuses the collection of relevant records given the need to bifurcate personal and institutional information.

The challenges of novel, nonstandard data

The combined user-generated, often inaccessible, and impermanent character of social media records, collaboration data and messaging app data make preserving, collecting and reviewing these nonstandard file types materially more complex. Therefore, when requesting this material, discovery teams should recognize that:

• User-generated content apps may contain unique file types and metadata.
• Metadata preservation is a crucial consideration in exporting any account-related data.
• The user’s shared activity log is an essential component of the collection.

In addition, several platforms, such as Snapchat, support ephemeral messages that exist within the app’s infrastructure, as well as on the devices of the sender and receiver for a specified time before the contents self-destruct. While a party may not be capable of preserving this communication, it may need to save messaging server logs to each user’s send and receive activity.

Discovery connected to the logs of these messages, as well as social media in general, can implicate an individual’s privacy rights. Courts generally do not permit parties unfettered access to a litigant’s social media account and will balance a plaintiff’s need for information with a defendant’s burden of production and privacy interests. For example, in Canada, the existence of a Facebook page is insufficient to grant a “fishing expedition.”2 In the US, under the Electronics Communications Privacy Act of 1986 and the Stored Communications Act, social network profiles are often protected and require a showing that password-protected data, as opposed to publicly-available details, is relevant and reasonably calculated to lead to the discovery of key evidence.

Nonstandard data considerations in eDiscovery

There are several considerations for managing nonstandard file types that can directly affect a legal team’s approach to preserving and collecting eDiscovery. The amount of data at issue, number of data sources, accessibility of key files, level of encryption, sensitivity of the data, available IT resources and time constraints all factor into a litigation strategy.

Since the duty to preserve potentially relevant evidence generally includes all forms of social media, professionals drafting legal hold notices should specifically refer to these platforms, citing both personal and corporate accounts, if applicable, and accompanying metadata in the document. Given the variables associated with modern discovery, it is essential to select a vendor that can recognize and adapt its practices to novel, nonstandard data formats, and monitor the document collection and production of such material. That provider should also be capable of quickly identifying, analyzing and proposing recommendations to address exceptions and technical issues in collecting, processing and reviewing data.

It should support that effort by avoiding unnecessarily broad discovery requests of user-generated content. The extent of that content on any given platform can be vast and may well be subject to privacy protections. Instead, identify and engage critical custodians, then target efforts on sources that can potentially store relevant ESI and use well-documented questionnaires and processes to uncover new forms of data.

Sophisticated discovery teams will leverage focused collection tools on a range of potential data sources identified by the key custodians. Using analytics and early-case assessment technology, practitioners can produce tracking reports that highlight the most valuable content regardless of the platform on which it was created.