A head-to-head match—and the winner is …

Ediscovery can feel like a fight sometimes, with every choice feeling like a struggle: when do you initiate a legal hold? Which custodians are subject to that hold? What data do you need to preserve? Then there’s the question of how best to preserve relevant data. Should you preserve data in place or preserve it by collecting it and transferring it to an external storage repository?

While the answer depends on your specific circumstances, here’s how the comparison might play out in a head-to-head match between collect to preserve (CTP) and preserve in place (PIP).

Round 1: Availability

When it comes to Slack data, the question of how to preserve data had been a moot point as the only way to reliably and defensibly preserve data from Slack was to collect that data into an external repository. Recently, however, Slack enabled legal holds for Enterprise Grid customers that permit in-place preservation. When implemented, Slack Legal Hold suspends the retention policy for relevant Slack content, such that held data is exempted from that destruction schedule including subsequent edits and deletes.

But there’s a catch: Slack Legal Hold is only available to customers who pay for the top tier of Slack plans, Slack Enterprise Grid. For everyone else using Slack—from the free plan through the Business+ plan—the only way to defensibly preserve Slack data is to collect it. Depending on the license level, the organization can export message content in JSON format to collect-to-preserve.

CTP: 10 , PIP: 9 .

Because PIP isn’t available to all Slack users, CTP wins this round.

Round 2: Cost

As they say, more money, more problems—and in ediscovery, the more data you collect, the more money it’s going to cost you (which is a problem in itself). For every gigabyte of data entering the top of your ediscovery funnel due to overcollection, there is a cost associated with transferring that data to an external repository and safely storing it there over the life of the matter. You also have to incur the cost for each gigabyte of data you need to be processed, reviewed, analyzed, and ultimately produced. It adds up fast.

With in-place preservation of Slack data, you don’t have to pay to transfer that data or store it anywhere—it’s securely locked down within the Slack infrastructure where it was created. If the matter resolves early, preserving data in place costs you zero dollars… once you’ve paid for an Enterprise Grid license, that is.

CTP: 9 , PIP: 10 .

For reducing costs, this round goes to PIP, tying the match at 19–19.

Round 3: Risk of Data Spoliation

The very point of preservation is to ensure that data is safely held for later use including ediscovery. Data that isn’t adequately preserved is vulnerable to spoliation, the loss or damage of data so that it is no longer available to the parties. While in-place preservation is, for the most part, highly secure and reliable, there are a few asterisks on that statement.

First, Slack’s in-place preservation doesn’t control data in shared channels. In a shared channel, Slack grants control over each message to the organization that created that message. Suppose that Organization A and Organization B share a channel where they discuss a project that is the subject of pending litigation. Organization B has set its Slack retention schedule for 30 days, while Organization A has—in recognition of its obligation to preserve data for litigation—implemented Slack Legal Hold to preserve its messages in that shared channel. After 30 days, Organization B’s messages disappear, leaving Organization A’s messages as a one-sided conversation.

Nor does in-place preservation protect channels from outright deletion. If a Slack user who’s subject to a hold actively participates in a particular channel, that channel is exempt from the organization’s retention period so long as the hold is in effect. But should the channel itself be deleted by an administrator while the hold is pending, its message and file data will not be saved.

By contrast, when you’ve collected data to preserve it, you know that data is locked down. It’s in a separate repository where no one can delete or modify it.

CTP: 10 , PIP: 9 .

This round goes to CTP, which pulls ahead to 29–28.

Round 4: Early Case Assessment Tools

When you preserve Slack data in place, it’s still in Slack. That’s the point, of course, but the result is that it's not easy to analyze, search or assess that data while it remains in Slack. Until you export—or collect—the data, you can’t begin early case assessment (ECA) to gain a deeper understanding of your potential litigation matter.

On the other hand, once you collect data into a discovery repository, you create the opportunity for advanced searches and data analysis. In-depth ECA might give you the jump on pending litigation, providing valuable insight into whether you should settle or stick to your guns.

CTP: 10 , PIP: 9 .

CTP wins another round, bringing the score to 39–37. So, is CTP going to win the day? Not so fast—the last round is a big one.

Round 5: Security Risks

When you preserve data directly in the program or app where it was created, as with Slack Legal Hold, you minimize the security risks inherent when transferring data to an external location. You also have fewer storage locations to secure and fewer opportunities for data breaches or security lapses.

If you collect data to preserve it, there will always be a higher potential security risk. Every copy in every storage location can become a target for hackers meaning there is always an amplified risk of secure data being a target. It goes without saying that every storage location needs to be secure, but with each, the risk of exposure can increase.

CTP: 8 , PIP: 10 .

This round goes to PIP by a 2-point margin, which means we end on a 47–47 tie.

Conclusion

There’s no clear winner when it comes to how you should preserve Slack data for ediscovery. Depending on your Slack license, you may not have the option of using Slack Legal Hold, in which case collecting to preserve wins by default as your only avenue to preserve data. You may be primarily interested in shared channels where you need to collect data to preserve both sides of the conversation. On the other hand, you may be concerned about limiting the cost of collection and data storage or avoiding the additional security risks associated with collecting data into a separate repository. The key is to understand and appreciate the pros and cons of both approaches so that you can make the right decision for your organization in each litigation matter.

[View source.]