It’s been a challenging 2020, as each of us adapts to our new pandemic reality. In the United States as of today, Covid-19 has infected more than 2.4 million and taken the lives of over 124,000, with southern and western states surging ahead of the northeastern states as Covid hot-spots. Meanwhile, in the wake of
12 reasons to govern our information
They say that the right time to plant a tree is yesterday. In a world of data dangers and opportunities, the time to elevate how your business governs its information is now. That’s easy to say, but with all of the conflicting priorities facing companies today, for many it’s hard to get started, or to
Why govern our information? Reason #3: “Your” data may actually belong to others … and you’re responsible to take care of it.
As you toss and turn in bed, you picture yourself on a strange playing field with other athletes swirling around you. You have absolutely no idea what sport you are playing, nor a clue what the rules are. It all feels beyond embarrassing, and downright dangerous.
This is not just a bad dream – it’s the reality for companies possessing third-party data without clarity on what rules and responsibilities apply.
Most companies possess some data that they do not truly and solely own. Perhaps your company signs a nondisclosure agreement and obtains others’ information while evaluating a business opportunity. Or maybe your company is a service provider that receives or generates data on behalf of customers or clients. Your company has possession of the data, but it remains responsible to the third-parties if there’s a problem.
What kinds of problems? Well, what if the third party’s data is lost, corrupted, misappropriated, hacked, or held for ransom? What if the cost of maintaining the information, after the work concludes or need passes, becomes onerous? What if the information becomes relevant in future litigation? Who is authorized to make decisions about the information when the unexpected happens, and who is responsible for the expenses and exposures?
Information Governance – your organization’s strategic approach to managing information compliance, cost, and risk while maximizing information value – is tailor-made for this commonplace scenario. Here’s how it works:
Continue Reading Why govern our information? Reason #3: “Your” data may actually belong to others … and you’re responsible to take care of it.
Why govern our information? Reason #12: Unnecessary business data causes unnecessary litigation costs
“If your clients don’t have a records management system, they may as well take their money out into the parking lot and set it on fire.”
– Former U.S. District Court Magistrate Judge John Facciola
We all know that ediscovery is expensive, and various research reports have so confirmed. The definitive Rand study, Where the Money Goes: Understanding Litigant Expenditures for Producing Electronic Discovery, found that median costs for collection, processing, and review are $17,507 per gigabyte (roughly 3,500 documents or 10,000 e-mails). The math is not pretty – a case involving 482 GBs of source data could exceed $8 million in ediscovery costs.
And on top of that are preservation costs. The Preservation Costs Survey demonstrated that large companies incur significant fixed costs for preservation (for in-house ediscovery personnel and also for procurement and maintenance of legal hold management and data preservation technology systems), averaging $2.5 million annually. More significant is the cost of employee time lost in complying with legal holds. While companies with up to 10,000 employees incur the average time cost of over $428,000 per year, costs for the largest companies exceed $38 million per year.
There is indeed great complexity in how to cost-effectively process huge amounts of data through the ediscovery funnel. Tighter management of ediscovery processes continues to be important.
But as we ponder how to cut costs, let’s not confuse symptoms with causes:
Continue Reading Why govern our information? Reason #12: Unnecessary business data causes unnecessary litigation costs
12 reasons to govern your information in 2018
2017 was rife with data dangers. Nary a day passed without headlines of massive data breaches and ransomware attacks; Russian election-meddling through WikiLeaks and social media; fake news; and presidential tweet-storms. Disruptive information-driven technologies continued to emerge, from block-chain to biometrics, IoT, AI, and robotics. Meanwhile, the sheer volume of our personal and business data inexorably grew.
What better way to start 2018 than with a renewed commitment to Information Governance? So, here are a dozen reasons why your organization should govern its information, in 2018 and beyond:
Continue Reading 12 reasons to govern your information in 2018
Why govern your information? Reason #2: Your information risks and opportunities arise from a single source – your data. Your response strategies should be synchronized too.
Our firm’s elephant icon is a nod to The Blind Men and the Elephant, the familiar, age-old parable for how we often do not see the big picture, but instead only the parts we directly encounter. And so it goes for organizations’ data. Individual company functions and departments often have their own, limited perspectives on information, seeing only the risks and opportunities with which they are directly familiar. Limited perspective yields limited perception – not a good thing for identifying, understanding, and controlling organizational risk.
I actually prefer a slightly different version, The Blind Elephants and the Man:
One day, six blind elephants were in a heated argument about what Man was like. To resolve their dispute, they sought out and found a man. The first elephant “felt” the man and then proclaimed “Man is flat.” Each of the other elephants, in turn, felt the man, and they all agreed.
The moral? Limited perspective not only yields limited perception – it can also lead to very bad results.
“Information Governance” has become an overused buzz-phrase, often trotted out as marketing mumbo-jumbo for selling technology tools. In all the hype one can easily lose track of what it really means. At its heart, Information Governance is no more – and no less – than making sure the organization sees the big picture of information compliance, cost, risk, and opportunity when making strategic decisions.
Continue Reading Why govern your information? Reason #2: Your information risks and opportunities arise from a single source – your data. Your response strategies should be synchronized too.
Why govern your information? Reason #3: “Your” information may belong to others … and you’re responsible to take care of it.
It’s a common nightmare. As you toss and turn in bed, you picture yourself on a strange playing field with other athletes swirling around you. You have absolutely no idea what sport you are playing, nor a clue what the rules are. it’s not only embarrassing – it’s downright dangerous.
This is not just a bad dream – it’s reality for companies possessing third-party data without clarity on what rules and responsibilities apply.
Continue Reading Why govern your information? Reason #3: “Your” information may belong to others … and you’re responsible to take care of it.
Breaking news from Captain Obvious – it’s still OK to manually preserve and collect ESI
Late last month in Mirmina v. Genpact, the Honorable Sarah Merriam of the United States District Court for the District of Connecticut properly confirmed that it remains permissible to manually preserve and collect discoverable email. Her opinion was concise and spot-on, swatting away the plaintiff-movant’s speculative “concern” that defendant must have “withheld communications” that were responsive to the case’s discovery protocols. Citing Zubulake V, Magistrate Judge Merriam accepted defendant’s detailed affirmation that in-house counsel appropriately coordinated and supervised the manual search for reponsive email by defendant’s ESI custodians, and she therefore denied plaintiff’s motion to compel.
The ediscovery blogosphere lit up once the Mirmina ruling was handed down – see here, here, here, here, here, and on and on.
What’s remarkable about this ruling is that a singularly unremarkable point has somehow become remarkable.
Continue Reading Breaking news from Captain Obvious – it’s still OK to manually preserve and collect ESI
Why govern your information? Reason #4: Your information is in others’ custody … but you’re still responsible for it.
If you’re old enough, you’ll remember a time when businesses actually kept their own information (cue my adult children to roll their eyes). How quaint. We no longer keep most of our information – providers do that for us. We store our data in the cloud, through cloud providers. We outsource business applications to SaaS providers, and even entire systems as PaaS. And we increasingly use service providers to handle key aspects of our business that we used operate internally, resulting in a robust flow of data out of our businesses to such providers, and also the providers generating, receiving, and retaining huge data troves on our behalf.
But we’re still accountable for our information in others’ hands:
- Litigation – the scope of permissible discovery, and of the preservation duty, extends not only to data in our possession or custody, but also to data within our control.
- Data security – we’re generally responsible for data breaches suffered by our service providers. Under most breach notification laws, including HIPAA and state breach notification statutes, our service providers must notify us of data breaches, but we are still responsible for providing notice to affected individuals and regulators. Regardless, in the wake of a service provider data breach, we’re in the hot seat.
- Business Continuity – if we need to promply restore data due to ransomware or other causes of business interruption, it doesn’t matter who’s the custodian – all that matters at that moment is timely and effective restoration.
- Retention – third parties retaining information longer (or shorter) than our retention schedule cause us to be at best inconsistent and out of compliance with our information management policies. At worst? See Litigation, Data Security, and Business Continuity above.
Our litigation preservation duties do not vanish for information hosted elsewhere but still in our control; our data security obligations do not evaporate when we house protected data with a service provider; our imperatives of data integrity and accessibility have no exceptions based merely on data storage location; and our records retention and destruction rules do not disappear if our data is hosted remotely. In other words, we still need to govern information compliance and risk for our data in other’s custody.
And this is a perfect example of the value of Information Governance. A key benefit of the IG perspective is that it enables organizations to take useful strategies from one established discipline and apply them more broadly. The importance of service provider controls is well-established in the data security discipline. For example:
Continue Reading Why govern your information? Reason #4: Your information is in others’ custody … but you’re still responsible for it.
The 20% solution for information management and security
OK, IT mavens, listen up…how much better would your life be if you only had to manage and protect 20% of your company’s data? By eliminating 80% of your data you could free up oodles of storage, reduce licensing costs, shorten backup cycles, and drastically cut e-discovery preservation costs, not to mention go home on time for a change. For most this is an unrealistic pipe dream, but it doesn’t need to be. The trick is knowing which 20% to manage.
Continue Reading The 20% solution for information management and security