SEC Director of Enforcement on Penalties for Data Preservation Failures

In October 2023, the SEC's Director of Enforcement Gurbir Grewal addressed the New York City Association.   See the transcript posted here.  In remarks which emphasized the need for businesses to be proactive in complying with financial regulations, the Director stressed the need to preserve electronic data.  In the past two years

the SEC has fined more than 40 companies over a $1.5 billion for failing to preserve electronic communications.  Most of the noncompliance was a result of employees failing to follow data preservation policies.   A key problem was that communications were being conducted outside of official channels.

In December 2021, J.P. Morgan Securities had to pay a $125 million penalty because its employees were communicating about business using text messages, personal email, and WhatsApp, and no steps were taken to preserve the data.  The violation was particularly egregious because the individuals responsible for implementing J.P. Morgan’s policies communicated outside of official channels themselves.   In this press release, Gerwal warned businesses to, “scrutinize their document preservation processes and self-report failures”.   Businesses that find their data preservation processes fall short of the requirements of securities laws are encouraged to report the problem by emailing BDRecordsPreservation@sec.gov.

Gerwal pointed out that the ability of a company to provide the SEC with summaries of financial analyses, locate key documents, and make data custodians available for interviews may lead to a mitigation of the amount of penalties that they are ordered to pay.

Thanks to Amy Sellars of CBRE for pointing out Gerwal’s remarks at yesterday’s ACEDS webinar on the 2023 Legal Industry Collaboration Data Survey.

Hold and Data Preservation Notices

The 2021 edition of the Thomson Reuters Electronic Discovery and Records and Information Management Guide provides checklists for legal holds and preservation notices. It’s interesting to compare the recommendations in this textbook against the tips suggested by two Zapproved employees based on experience, which was discussed in last night’s tip.

Here are some tips left out last night:

- take steps to preserve native files and metadata.

- image a backup of any relevant digital media.

- don’t redeploy hardware which may contain relevant data.

- “Forbid forensically naive network administrators or other members of the information technology department from

checking out or otherwise investigating relevant devices.” Id. at 244.

- State the name of the case, the venue, and the causes of action

- state the business relationship between the requesting party and the company.

- instruct that the current retention schedule be suspended.

Checklist for Litigation Hold Compliance

Here's a quick checklist on how to get custodians to be more cooperative based on the advice provided by Claira Hart and Lindsey Tsai of ZApproved on the ACEDS webinar, How Lean Teams Can Increase Custodian Compliance With 5 Easy Tips .

1. Simplify the language of the litigation hold -

   1. Don't use a lot of legal language.

   2. Don't force the potential custodian to review a long set of instructions. Consider cutting any unnecessary language. This is given as an example of a notice which is too short:

This is an example of a notice which is too long:

This is just right:

2. There should be a clear 'call to action'

a. The custodians shouldn't be confused by the notice.

b. A notice shouldn't prompt the custodians to ask a lot of questions.

c. Litigation hold software should prompt the custodian to accept the notice.

d. Compliance should not be difficult.

e. Give contact information for a real person to answer any questions.

3. Make sure the notice has good formatting.

a. Put custodians' obligations in a bulleted list.

b. Highlight particularly important instructions.

4. The litigation hold notice should be clear.

a. Provide detail on the data sources which should preserved

b. Use an eye-catching subject line with a phrase such as 'ACTION REQUIRED'.

c. Specify a date range for the data to be collected.

d. Prepare a log of where data has been collected from.

5. Make clear who the legal hold notice is from, whether it's the general counsel or someone else.

6. Give a deadline by which a response is required.

7. Provide suggestions on where data can be found.

8. Provide automated reminders to the custodians reminding them of response deadlines.

9. If there is no response, escalate the effort to collect data to a custodian's manager, or the system admin.

10. Use a single message consolidating multiple holds for more than one litigation matter.

11. Track custodian compliance with metrics showing the percentage of employees who have responded.

12. Make sure that you are focusing on active employees, and are aware of who has been terminated.

13. Provide training on litigation holds which are tailored to specific departments.

14. Be sure the hold notice is not misinterpreted as spam or a phishing exploit.

15. Work with IT to confirm that the email with the hold notice is not flagged as an external notice.

16. Prepare a defensible, easy to replicate template for your legal hold.

17. Make sure that hold notices follow a consistent format and 'cadence' with standardized intervals for reminders.

18. Identify someone who will draft the hold notices, and someone who will give them final approval.

19. Not closing out holds in a timely fashion can create risk for a business.

20. Provide contact information for a subject matter expert.

21. Ask about data stored on devices not provided by the company.

22. Ask each potential custodian if they know of anyone else who should be a custodian.