A federal or state regulator, such as the SEC or a state attorney general, sends a company a preservation notice stating that it believes the company may possess “documents” relevant to an ongoing investigation and requests that the company “reasonably” preserve such evidence until further notice. The stated subject matter of the investigation is very broad and the notice requests the company preserve documents going back a number of years. “Documents” is defined broadly in the notice and includes not only emails, hard copy documents, Word documents, and even voicemails, but also categories that may be undefined and unfamiliar to many such as backup files, file fragments, and logs. The notice advises that the company may need to act to prevent routine destruction practices, including regular deletion of emails and recycling or rotation of backup tapes. The notice also states that if the company does not comply it could face civil or criminal liability.
How should the company respond? Should it attempt to comply in full, including suspending email deletion policies, suspending backup tape recycling or rotation schedules, and preserving documents such as backup files, file fragments, and logs? Or should it seek to narrow certain requests at the risk of appearing non-cooperative? This article focuses on two requests in a typical regulator preservation notice—the requests to preserve backup files and suspend backup tape recycling or rotation schedules—and examines the potential consequences of non-compliance with the requests, the ramifications of complying with the requests, and how a company can effectively narrow the obligations while minimizing the risk of losing cooperation credit.
Retain Counsel With Experience in Government Investigations and E-Discovery. Upon receipt of a preservation notice from a regulator, in-house counsel will want to engage outside counsel experienced in government investigations and e-discovery. Regulators will all but expect a company to hire outside counsel and often look at that decision as an indication of how serious a company is taking an investigation. Although it is commonplace for a company to engage counsel with government investigations experience, companies often overlook the importance of having counsel with significant e-discovery experience. Companies must make important decisions on e-discovery issues such as preservation very early on despite having little information regarding the scope of the regulator’s investigation. In fact, when a company receives a preservation notice, it likely does not even know whether it is a target of the investigation and almost certainly will not know how long it will be required to preserve documents.
The implications of e-discovery decisions can be long-lasting and very costly. For example, in 2014, General Electric Co. reported that it had spent nearly $6 million in one matter to collect and preserve documents and litigation had still not even been filed. It reported that it was spending over $100,000 a year to preserve those documents. Letter from Bradford A. Berenson to Federal Rules Advisory Committee (Feb. 7, 2014).
The Potential Consequences of Non-Compliance Are Severe. The consequences of failing to comply with a preservation notice can be severe and scare away most companies from even considering attempting to narrow the obligations in a preservation notice. First, as a preservation notice typically advises, failure to comply with the notice could result in civil or criminal liability. The SEC and other regulators can impose monetary sanctions for non-compliance and the Sarbanes-Oxley Act provides criminal penalties of up to 20 years for anyone knowingly destroying, concealing, or falsifying any record with the intent to impede an investigation. 18 U.S.C. §1519. Second, if the case ever goes to a jury, the judge could give an adverse inference instruction advising the jury that it could infer that the information in destroyed documents was unfavorable to the company. Fed. R. Civ. P. 37(e). Third, failing to comply with a preservation notice could indicate to a regulator an unwillingness to cooperate in the investigation and could threaten a company’s ability to obtain cooperation credit. Fourth, a regulator could interpret a failure to comply as an effort to dispose of incriminating evidence.
The Ramifications of Preserving Backup Tapes Are Significant. The preservation of backup files and the corresponding suspension of backup tape recycling or rotation schedules are often the most burdensome and costly requests to a company in a regulator preservation notice. At the outset, it is important to note that regulators generally do not provide in the notice any definition for the term “backup files”, but the reasonable interpretation of that term is that it covers files maintained in backup environments, including backup tapes. Nor do regulators’ notices typically distinguish between backup tapes used for traditional disaster recovery purposes and backup tapes used for routine data storage in the ordinary course. A regulator likely will not be amenable to excluding backup tapes used for routine data storage from preservation, whereas a regulator may entertain a request seeking to exclude disaster recovery backup tapes from preservation.
Many companies use backup tapes to periodically copy data from the company’s regular, everyday storage to a tape so that the data can be recovered if there is a hard disk crash or failure. Each tape represents a snapshot in time that generally contains data from one or more data sources and contains numerous employees’ data for various time periods. Because of the massive amount of data that most companies generate, backup tapes are generally overwritten after some period of time and reused. Backup tape recycling or rotation schedules can vary widely by company and by industry depending on many considerations, including regulatory requirements. Suspending the backup tape recycling or rotation schedule forces a company to purchase massive amounts of additional storage, at significant cost, and can result in a company preserving a copy of all company data every day, day after day after day, as long as the preservation obligation exists.
In addition, once the decision is made to suspend the recycling or rotation schedules, a company may be forced to continue running outdated systems or programs that it had scheduled to decommission or risk not being able to access the data on the backup tapes from those systems or programs in the future. Companies must decide whether to pay license fees and upkeep costs to keep those systems or programs running or let the systems or programs go out of use and attempt to later restore the systems or programs or rely on a specialized data recovery company to extract data from the tapes. As a result of near certain complications surrounding preservation, companies are forced to pull significant human resources away from normal company operations to prepare and implement a preservation plan, monitor compliance, and troubleshoot as issues arise. Furthermore, if a regulator actually requested a company pull data from backup tapes, many companies would have significant difficulties identifying which backup tapes contain the requested information.
Tips on Narrowing the Scope. In light of these potential consequences, can a company attempt to narrow the obligation to preserve backup files and suspend backup tape recycling or rotation schedules? Many attorneys assume the answer is no because of the risks discussed above, but that assumption paints with too broad a brush. To be clear, there may be situations where attempting to narrow these requests is not an option. However, in the appropriate situation, a company can attempt to narrow these preservation requests and there are a few things a company can do to maximize the chances that the regulator agrees with its position and minimize the chances it jeopardizes potential cooperation credit.
First, in what may seem like an obvious warning to most, a company should always communicate to the regulator any decision not to comply with the preservation notice as written. There is no better way to watch the risks discussed above become reality than to decide your company or client is not going to comply with the preservation notice and fail to advise the regulator of that decision. Second, counsel should be prepared to discuss the preservation efforts the company is undertaking in response to the preservation notice in order to demonstrate to the regulator that the company is taking the preservation request very seriously and the steps taken by the company are reasonable and sufficient. Third, counsel should thoroughly understand and be prepared to explain in detail to the regulator a company’s data retention policies and the difficulties and consequences of implementing the requests at issue in the preservation notice. Finally, specifically with respect to the topic of backup tapes, it is critical that counsel make clear that the company utilizes backup tapes for potential disaster recovery purposes, as opposed to routine storage (although counsel should be aware that there could be documents on disaster recovery backup tapes that are not available elsewhere).
Conclusion. Keeping these considerations in mind, a company may find a regulator willing to bend on its preservation expectations, which may in turn provide some relief from otherwise onerous preservation obligations and significant costs that could saddle a company for years.
Robert Lindholm is of counsel in Nelson Mullins Riley & Scarborough’s New York office. Lucie Cohen is a partner at the firm’s South Carolina office.