E-Discovery Toolkit


The following e-discovery topics and samples are provided for informational purposes only and are not to be construed as legal advice. The e-discovery topics provided are issues for institutions to consider when e-discovery requests might involve university data; however the topics are neither all-inclusive or exhaustive, nor is every topic applicable to every college or university. Samples contained in this document should be seen as a starting point for discussion and may need to be modified as appropriate for the intended use. For the foregoing reasons, we highly recommend that any intended use of the topics and samples be reviewed by appropriate general counsel at your institution. If you have questions or comments regarding this toolkit, please contact the Higher Education Information Security Council.

Laws and Rules Driving E-Discovery

The Federal Rules of Civil Procedure (FRCP) govern the evidence discovery process for litigation in Federal and U.S. District Courts. Prior to December 2006, the FRCP included no specific provisions dealing with electronically stored information (ESI), which led to ad hoc and inconsistent decisions being made with regard to ESI discovery. Through the actions of the Advisory Committee on Civil Rules, amendments to the FRCP that specifically dealt with ESI were enacted. Many state evidentiary rules apply to the production of electronic information as part of the discovery process in state courts Provisions of particular interest in the FRCP are highlighted below. (Source: Adler, M. Peter, "Federal E-Discovery Rules – Hindrance or Opportunity?" EDUCAUSE Live! webinar, January 9, 2007)

1) Electronic discovery and the means of handling ESI discovery issues must be addressed very early in the progress of the case. Included may be such issues as sources of relevant ESI, burden and cost of retrieving and preserving it, the form in which it must be provided, and access privileges. (FRCP Rules 16, 26, and 34)

2) ESI that imposes an undue burden or cost to make it accessible need not be provided initially, but may later need to be produced, as determined on a case-by-case basis. Examples of ESI data that might not be reasonably accessible include, but not limited to:

See the Sedona Conference for guidelines.

3) The presumption is that the responding party will bear the cost of producing the requested ESI; however, the court may decide otherwise.

4) The duty to preserve relevant ESI may precede formal proceedings. This duty includes the requirement to suspend information destruction policies and procedures affecting the relevant ESI. As stated in FRCP Rule 37(f), however, "Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system." It is important to note that similar provisions may exist for state courts as well.

Resource: The Federal Rules of Civil Procedure (FRCP)

When Does the E-Discovery "Clock" Start?

The duty to preserve relevant ESI may commence upon:

What is Subject to E-Discovery

Electronically Stored Information (ESI)---All electronically stored information and data subject to possession, control, or custody of an institution regardless of its format and the media on which it is stored. ESI includes, but is not limited to: electronic files; communications, including e-mail and instant messages sent or received, and voicemail; data produced by calendaring software; and information management software. In addition to specific data that are electronically stored and readily retrievable, ESI includes data that may not be visible that is generated by computer hard-drive, e-mail and instant messaging, information management software, handheld computer devices (ex: Blackberry), telecommunications devices, and back-up storage devices. ESI may be stored on different electronic devices and removable devices (ex: internal and external drives, PDAs, smart phones, servers, laptops, backup tapes, thumb drives, CDs, DVDs) and may also reside at different locations (e.g., on the home or work systems, institutionally-owned or personal systems, in departmental files, etc.).

1) Data Files

2) System Files

3) Electronic Communications

Sources may include:

1) Hardware Devices (Samples)

2) Software Applications (Samples)

Locations may include:

It is very important that ESI is preserved in its original electronic form so that all information contained within it, whether visible or not, is also available for inspection.

Source: Victor, Ira, "The E-Discovery Tidal Wave: Plan Ahead or Drown", 2009 Government Technology Conference

Roles and Responsibilities of Personnel Involved in E-Discovery May Include

Legal Counsel
End Users Who Receive a Litigation Hold Notice
IT Employee Who Receives a Litigation Hold Notice
Records Manager Who Receives a Litigation Hold Notice

Best Practices to Consider Prior to a Litigation Hold Notice (i.e., what to do to prevent an e-discovery request from becoming an all consuming monster)

Given the need to directly discuss issues of existence, accessibility, and form up front, institutions must know where and how electronic information is stored and the cost of production prior to start of litigation. Bad organization, poor records retention practices, or an ad-hoc response to e-discovery requests is no longer an excuse. (Schaufendel, May 2007)

Failure to respond or to respond in a timely manner to an e-discovery request can result in adverse inference jury instruction (i.e., a judge instructing the jury to assume that the missing evidence would have been adverse to the party that failed to produce it) and/or fines and penalties.

Institutions should consider the following best practices to mitigate the risk of having significant unplanned business interruptions and costly diversion of staff and technology resources by an e-discovery request:

1) Set up an E-Discovery Team. The Team should assess institutional readiness, provide support during litigation, and apply lessons learned to update processes, policies and procedures as needed. The Team should include members from legal counsel, compliance, records management, IT, key business areas, and risk management.
2) Inventory institutional information assets (i.e., what does the institution have), their nature (i.e., how are they stored and format), and their location (i.e., where is it located) specifically for confidential information. Include back-ups, convenience copies, etc.
3) Identify and define institution roles and responsibilities for information owners and custodians.
4) Define a clear and sound records retention/management policy and procedures for paper and digital information and communicate it to all employees.

5) Ensure that the records retention/management policy and procedures cover the entire information life-cycle from creation to destruction and that the procedures are repeatable.
6) Audit the records retention/management policy to ensure appropriate enforcement.
7) Define and implement a process for handling and coordination e-discovery requests. Just like a disaster recovery plan, the process should include roles, corresponding tasks, and communication channels.
8) Define and implement a process and procedures regarding the manner IT department shall handle e-discovery requests and retaining information in response to a litigation hold notice.
9) Provide IT staff with appropriate training in e-discovery searching and/or retain a third-party service provider to perform the e-discovery searching.
10) Use appropriate technology to automate or support compliance with the records retention/management policy.
11) Review periodically ESI archiving technologies to ensure that they can recover potentially required ESI, in addition to their backup and disaster recovery capabilities.

In implementing the best practices listed above, institutions should be aware of four common misunderstandings regarding e-discovery: (Henry, March 2008)

E-Discovery Models

1) The Electronic Discovery Reference Model (EDRM)
EDRM is a widely-referenced guideline for managing the e-discovery process, which was developed through the efforts of over 125 organizations. First launched in May 2006, the goal of the EDRM is to facilitate the transfer of ESI between discovery steps. Participants have continued enhancing the model since 2006 and have created a content rich website. In brief, the EDRM divides the e-discovery process into the six major stages depicted in the diagram and descriptions that follow.

Stage 1: Information Management--Getting your electronic house in order to mitigate risk and expenses should electronic discovery become an issue, from initial creation of electronically stored information through its final disposition.

Stage 2: Identification--Locating potential sources of ESI and determining its scope, breadth and depth.

Stage 3: Preservation--Ensuring that ESI is protected against inappropriate alteration or destruction.

Stage 4: Processing--Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review and analysis.

Stage 5: Production--Delivering ESI to others in appropriate forms and using appropriate delivery mechanisms.

Stage 6: Presentation--Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms.

The process model is conceptual, not prescriptive, i.e., not all stages are necessarily needed in all cases and the order in which they are undertaken may vary depending upon the nature of any given case. It is also an iterative model. Stages are repeated as needed to adjust and refine ESI collected. As one proceeds through the process, the volume of ESI should decrease as its relevance increases.

An overarching step not explicitly included in the model is the meticulous documentation of data collection methodology – how data was preserved (Preservation step) and collected (Collection step) – and process. Data produced during an e-discovery request may not make it to court for several months and, possibly, even years. Accurate recollection of how the institution fulfilled the request and the steps taken to produce it, and the capability to explain it or repeat it, will be essential. (Tower-Pierce, March 2008)

2) Sedona Conference "Commentary on Legal Holds: The Trigger & The Process"

The "Commentary on Legal Holds: The Trigger & The Process" paper provides the general guidelines below, along with helpful illustrations for fulfilling the duty of collecting and preserving information relevant to anticipated litigation.

Triggering the Duty of Preservation

Implementing the Legal Hold

3) Models Used in Institutions of Higher Education

Graphic Revised February 3, 2009. Information Security Office – University of Texas at San Antonio. (ISO: Information Security Officer; OIT: Office of Information Technology)

Issues Associated with E-Discovery and Potential Gaps

Is Outsourcing an Option?

Institutions of higher education that do not have the storage, technology, and/or human resources to adequately respond to an e-discovery request may decide to utilize third-party service providers for assistance in retrieving, storing, sorting, and/or reviewing information. Also, third-party service providers may be able to assist with cost estimates in cases when arguing that information is not reasonably accessible is needed.

The downside of outsourcing is that e-discovery services are not cheap and it may be difficult for institutions of higher education to determine if particular services are effective or necessary and/or to justify the cost associated with these services.

Resource: Best Practices For The Selection Of E-Discovery Vendors

Lessons Learned (the hard way)

Other Resources

#Top of page

Questions or comments? Contact us.

Except where otherwise noted, this work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).