The ever-changing landscape of data sources used in modern organizations presents significant challenges to data preservation and discovery compliance. Successful organizations address such challenges by ensuring that employees who possess or control the company’s data understand their role in taking reasonable steps to preserve relevant data when litigation or investigation is anticipated. Such efforts are key to avoiding negative consequences, up to and including sanctions that may be awarded under Federal Rule of Civil Procedure 37(e)[1] and its state law counterparts.
Implementing and regularly updating a training program for employees that comprehensively addresses legal hold data preservation is not just a “nice to have,” but an organizational necessity to help avoid some of the pitfalls associated with spoliation allegations.
Why Should an Organization Enact and Maintain an Evergreen Legal Hold Training Program?
A legal hold training program offers far-reaching benefits, both legally and operationally, that help mitigate an organization’s overall risk.
1. Mitigating Legal and Financial Risk
An effective legal hold training program reduces the risk of losing information that should have been preserved by equipping employees with practical guidance on how to maintain data subject to legal hold. Moreover, an effective training program demonstrates that an organization takes its discovery obligations seriously. This can bolster arguments that the organization “took reasonable steps to preserve” data and did not “act[] with the intent to deprive” parties of data, if faced with questions regarding its data preservation. Organizations that neglect this essential training are more vulnerable to legal penalties, financial damages, and reputational harm from legal hold failures. See, e.g., Trade Grp., Inc. v. BTC Media, LLC, No. 4:23-CV-00555-P, 2024 WL 3513475, at *4 (N.D. Tex. July 23, 2024) (sanctioning organization under Rule 37(e)(1) for failure to take reasonable steps to preserve upon a finding that its employee failed to turn off autodelete on his cellphone, resulting in the destruction of relevant text messages); Skanska USA Civ. Se. Inc. v. Bagelheads, Inc., 75 F.4th 1290, 1313 (11th Cir. 2023) (upholding sanctions under Rule 37(e)(2), taking as evidence of intent that the company “took no action to educate its custodians and administrators about the litigation hold”).
Practical legal hold training highlights not only the important role employees can play in protecting the company, but also the potential consequences for employees who fail to fulfill that role, including reprimand, termination, and even individual legal consequences. See, e.g., WeRide Corp. v. Kun Huang, No. 5:18-cv-07233, 2020 WL 1967209, at *16 (N.D. Cal. Apr. 24, 2020) (ordering spoliation sanctions against a company and an executive personally due to the executive’s spoliation). Informing employees of these potential consequences reduces the risk they will fail to preserve relevant data, which in turn mitigates risk that the organization will face allegations of spoliation.
2. Enhancing Data Security and Information Governance Goals
Training employees on how to manage data subject to legal hold also supports broader data security and information governance goals. Data is increasingly stored in a variety of formats and locations, including on physical devices, in the cloud, on third-party platforms, and/or within personal communications. Ensuring that relevant data is appropriately preserved, regardless of format or location, requires employees to be well-versed in the specifics of data management systems and how to handle data per legal hold directives.
Legal hold training teaches employees to distinguish relevant data from irrelevant data, which reduces over-preservation of irrelevant data. Reducing the volume of irrelevant data preserved for a particular litigation or investigation not only reduces storage costs but also supports information governance objectives by reducing the amount of data that exists outside of normal data management and retention practices. Reducing the amount of data in an organization’s possession also mitigates the risk of data breach and resulting negative exposure.
3. Fostering a Culture of Compliance and Responsibility
Employee training on legal hold data preservation fosters a broader culture of compliance within the organization. When employees understand the gravity of data preservation and their role in supporting legal and regulatory obligations, they are more likely to take their responsibilities seriously and view compliance efforts as a core function. By embedding these concepts into the company’s culture and expectations, leadership demonstrates the organization’s commitment to ethical conduct and legal compliance. A culture of compliance fosters the idea that it is every employee’s role and responsibility to safeguard the organization’s legal standing, contributing to better organizational outcomes.
When Should an Organization Implement or Update a Legal Hold Training Program?
1. Upon Establishment of a Legal Hold Data Preservation Program
The best time to implement training is when a company institutes or updates its legal hold program or protocols. Employees across the organization should be trained on the legal hold procedures, their role in complying with the preservation requirements, and the potential consequences for non-compliance.
At this stage, the organization should tailor its training program to address general employees and critical stakeholders involved in data preservation, such as managers, department heads, the legal department, and IT professionals. By providing early training, the company can quickly implement data preservation in response to any legal matters that may arise without unnecessary delays or confusion. If the organization’s data preservation efforts come into question, early implementation of a robust legal hold training program bolsters the defensibility of the company’s preservation practices.
The training should be regularly revisited to consider any new data sources or emerging complexities, as well as updates to case law and commentary.
2. When Litigation or Regulatory Risk Is Identified
A legal hold should be implemented once an organization reasonably anticipates litigation or an investigation, regulatory or otherwise. At this time, it may be necessary to launch a targeted training initiative for employees who may have relevant data. Depending on the facts, specific departments may need tailored guidance on which data types to preserve for the particular legal hold and/or how to maintain data integrity while the legal hold is pending. Depending on an organization’s litigation and investigation profile, it may prefer to conduct targeted training for legal hold custodians instead of requiring company-wide training, especially if some employees may never be subject to a legal hold.
Training when a legal hold is issued must clearly instruct employees on what to do, including compliance with data retention policies and reporting procedures and how to handle all manner of relevant electronic communications while the legal hold is pending (including documents, emails, ephemeral messaging, mobile devices, and SMS text data). The training should also make clear who to contact with any questions about the scope or nature of the hold.
3. During Significant Organizational Change or Growth
As organizations undergo mergers and acquisitions, organizational changes, or technological changes, the scope of their data management and retention obligations may change. Ensuring a legal hold training program remains evergreen is critical whenever roles, responsibilities, access, and usage of technology or data change. Additionally, new employees and employees with new responsibilities should receive training to integrate them into the company’s existing data preservation protocols, ensuring that the entire organization adheres to the same standards regardless of size or complexity. This proactive approach helps safeguard against potential gaps in compliance and the risk of data loss.
Conclusion
Due to the ever-changing data landscape, a company’s ability to navigate the legal hold process competently and consistently is more important than ever. Successful organizations recognize that early implementation and regular reevaluation of a training program that comprehensively addresses their legal hold obligations fosters a culture of compliance and responsibility contributing to information governance and data security objectives in addition to mitigating legal and financial risk.
[1] Federal Rule of Civil Procedure 37(e) provides a two-tiered standard for determining whether sanctions are appropriate if there is spoliation of electronically stored information (ESI). Both subparts require that ESI which “should have been preserved in the anticipation or conduct of litigation” and “cannot be restored or replaced through additional discovery” was “lost because a party failed to take reasonable steps to preserve it.” Fed. R. Civ. P. 37(e). Subsection (e)(1) of the Rule authorizes sanctions “no greater than necessary to cure the prejudice” to a party from the loss of information, without a further showing of intent. Id. at (e)(1). Subsection (e)(2) authorizes more severe sanctions, such as dismissal or an adverse inference, upon a finding that the spoliating party “acted with the intent to deprive another party of the information’s use in the litigation.” Id. at (e)(2).
