Global Crisis Management Series:  This post is part 4 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

Depending on the matter, data collection and management can be among the most daunting and logistically difficult tasks. Ensuring that the full relevant universe of data is being preserved and considered and that accurate recordkeeping is being performed is essential to managing large volumes of information and, in turn, facilitating fact-finding goals and risk assessment.

Data Preservation

After identifying all of the individuals who are likely to have relevant information, a company should take steps to preserve any such information for the relevant timeframe. Not doing so can lead to future issues regarding credibility and may impact the ability to evidence important facts. The first step for preservation is to identify the types of information that may exist. This often includes considering physical evidence, servers, local drives, audio recordings, instant messaging and other business software, smartphones, shared databases, visitor entry logs and other security data, personal information managers, videos, pictures or graphics, and hardcopy documents, among other sources and formats of data. Take a broad view at the identification stage, for example, by potentially including information held by assistants of key individuals, off-site storage locations, information in hardcopy format, social media applications or home office computers.

The scoping and initial fact-gathering steps taken early in an investigation will determine the universe of potentially relevant individuals and sources of information from which to collect data. It is important during the initial fact-gathering stage to ask individuals about where relevant information may be located. Organizational charts should be located if possible, as they can be essential to data preservation and collection. As with all aspects of an investigation, preserving and collecting data is typically an iterative process, and investigators should take care to document and update all records pertaining to data collection and processing steps in real time. This ensures consistency and will assure investigators that all information collected is current.

In some circumstances, issuing hold notices to employees and taking steps to preserve centrally stored information is important to ensure that employees do not inadvertently destroy relevant information. Investigators should work with IT departments to confirm that any and all relevant automatic deletion procedures in place are disabled. The spoliation of evidence, inadvertently or otherwise, only disrupts the fact-finding process. In the context of an investigation that involves external parties, such as auditors or regulators, such spoliation could erode trust between parties and reflects negatively on the team conducting the investigation.

Recordkeeping for Data Collection and Storage

Often times, investigations require collecting, storing and managing large amounts of data. There are many tools to keep track of data that will be reviewed as part of an investigation stemming from a crisis. For smaller investigations, this is perhaps ably handled in-house with the help of internal IT departments. But it is likely that larger investigations will rely on data vendors specialized in collecting, processing and hosting data. Investigation teams and external counsel are often more likely to have experience in handling larger amounts of data covering multiple investigation topics. Incorporating discipline and flexibility into the data collection and management process is crucial to ensuring that the investigation is complete, thorough and verifiable. Establishing a data collection protocol achieves each of these goals and serves as a basis for communication between those managing the investigation and the stewards of the relevant data. At the very least, good data collection protocol logs information about relevant data depositories, IT systems, group data location and storage, custodians, archives, data formats, dates of collection, volume collected and all relevant collection notes, including identifying technical details of the data and process used to copy or extract it.

Whether the investigation is entirely internal or independent, overseen by regulators or auditors, the technical details matter. Good recordkeeping of what has been collected and processed, when, where and how will prevent confusion at a later stage in the investigation when such questions may resurface. For example, many regulators require certain metadata to be produced and retained. Good recordkeeping of technical details of collection and processing can save a lot of time at a later date if and when such details become more relevant.

An open dialogue between the investigation management team and the data vendor service ensures that logistical questions do not overshadow the fact-finding of the investigation. For this reason, investigators benefit greatly from making sure to track what data was collected by whom, the chain of custody, and how data was or should be labeled and hosted. Each of these considerations should be made against the backdrop of understanding (and balancing) the data privacy regimes for each relevant jurisdiction, which can be critical to deciding how data is collected, stored, reviewed and produced.

Data Review

All data review should follow a review protocol that outlines the facts and issues so that reviewers are able to effectively and efficiently sort through what can be potentially very voluminous amounts of information. The protocol should lay out how potentially relevant data will be initially identified (through the use of electronic keywords or otherwise), how the data will be categorized by the initial reviewers, and what information will be elevated for further review by more senior investigators. Not all data will be in document form—each investigation should consider at the collection stage the various formats in which the data exists and, if not in document form, how best to review that data and convey that information to other team members. For example, listening to audio recordings, taking appropriate notes or creating transcripts of relevant discussions may be necessary for certain matters. In other cases, it may be necessary to analyze large sums of numerical data using transaction testing or a more involved forensic review. Again, good recordkeeping is crucial, as it enables efficiencies at the information analysis and production stages. Investigators should balance pacing the review with the virtue of being able to quickly identify information at a later point according to specific categories and classifications. Moreover, depending on the goals of the investigation, identifying potentially privileged information at this stage will allow for a quicker and more efficient assessment method for maintaining that privilege throughout the course of the investigation, especially when sharing information with authorities or other entities is a focus of the investigation.

Data Production

Before responding to a production request, consider whether the request is within the sending authority’s jurisdiction. Identify whether there are any legal impediments to complying with the request, such as jurisdictional limitations, attorney-client privilege and work product protections, data privacy and blocking statutes or employees’ rights and privileges. Early consideration of these issues will help avoid potential waivers.

Open a dialogue with the requesting entity early on and negotiate the scope and timing of the requested information, especially when requests are broadly drawn. The requesting agency might be amenable to limiting the scope of the request if the investigatory team is willing to help them quickly discern the relevant information. These negotiations can also help build rapport and demonstrate that the company is taking requests seriously. Staying organized should also mean quicker and more effective responses to requests, which also enhances the company’s credibility with the requesting entity.

Keeping detailed production logs is important, as there inevitably are questions post-production regarding what was provided to whom, when and why. A good production log contains as much information as is sufficient to understand the contents and circumstances of the production, including (i) the date, format and recipient(s) of the production; (ii) information sufficient to later identify or locate the data within a broader universe of productions; (iii) details regarding the circumstances underlying the request for information; and (iv) a summary sufficient to identify the contents of the production.

Staying organized at the document collection, review and production stages is vital to the success of the project and the ability to maintain efficiencies during an investigation. Implementing good recordkeeping and process controls for the lifecycle of the matter is the best quality control measure that can be taken to guarantee a comprehensive investigation.