Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-6604" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2021/04/DSIR-2021-social-media-graphics_p02.jpg" alt="" width="438" height="230" />For those attorneys and information governance practitioners unfamiliar with recent pedagogic advancements, “real-world problem solving” moves teaching approaches away from the classical model that assumes individuals will operate logically and in self-interested ways to a more realistic view. The more realistic view then acknowledges the powers of wishful thinking, uneven knowledge across populations, and the politics and dynamics inherent in groups (including, for our purposes, companies and other organizations). This is a challenge for individuals trying to sell outdated textbooks online; this is an improvement for people interested in actually making a difference.

Real-world problem solving is <a href="https://www.computerworld.com/article/2861014/getting-real-about-information-governance.html">slowly</a> but <a href="https://rwe-navigator.eu/use-real-world-evidence/governance-of-rwd/">surely</a> being accepted as the reality of information governance practice as well. This is also an improvement when there are no simple or apparent solutions. Note too that there is no time to lose; while the information people and organizations are collectively governing does not necessarily double year-over-year, it <a href="https://www.statista.com/statistics/871513/worldwide-data-created/">likely will between 2020 and 2024</a>. The situation is intensely and <a href="https://www.investopedia.com/articles/investing/041114/simple-overview-quantitative-analysis.asp">quantitatively complex</a> and involves many moving parts, but the solutions are not complex. That is, commonsense solutions can be the best approach for defensible practices – and can resonate best within the group dynamics that are the reality for most organizations struggling with governance projects.

As we noted in BakerHostetler’s <a href="https://e.bakerlaw.com/s/0ebfc81d7ae9e708cf711428746c99f85b164e4a">2021 Data Security Incident Response Report</a>, and as specifically applied to responsible organizational management of information, there are some high-level issues that can utilize the <a href="https://journals.sagepub.com/doi/full/10.1177/0952076717709338">power of heuristics in defining policy</a> and achieving better uptake and, by extension, better practices. The education on these points as well as the reality of information governance improvements then starts with simple rules that provide a realistic philosophy that can encompass actual challenges stakeholders will encounter.

Offer discrete steps that set responsibility and can lead to outsize effects:
<ul>
 	<li>Execute a brief, focused, flexible information governance policy.</li>
</ul>
Personnel without “information governance,” or “IG,” in their job descriptions are unlikely to be interested in reading verbose policies and procedures on the subject. Accordingly, with IG policy, less really is more. Instead of pages upon pages of esoteric definitions and special terms, consider using a policy approach that is <a href="https://www.discoveryadvocate.com/2014/02/05/information-governance-the-importance-of-putting-your-data-house-in-order/">short and clear</a>. Explaining the objectives of the policy in terms of the risks it seeks to manage (e.g., information security and data privacy, government sanctions), emphasizing key issues for compliance focus (e.g., confidentiality, legal obligations), and remaining <a href="https://www.discoveryadvocate.com/2020/05/21/key-covid-19-considerations-for-u-s-discovery-and-information-governance/">flexible in the face of dramatic changes</a> (e.g., COVID-19) will drive behavior in the right direction for the vast majority of personnel. Do not attempt step-by-step instructions for achieving perfection, which truly is the enemy of good when it comes to information governance.
<ul>
 	<li>Confirm a records-retention schedule with defensible practices.</li>
</ul>
When it comes to special types of information with business value that persist over time or are subject to specific legal or regulatory retention requirements, your organization may need a schedule identifying the retention periods associated with types of records. A highly regulated business with a complex or decentralized information technology environment may need additional guidance for relevant personnel on identifying and handling certain records (e.g., providing examples and explaining how to securely dispose of them in their various forms). This additional guidance may take the form of procedural documentation where that would be helpful and effective, but it should also be the subject of practical training to an extent commensurate with the risks of noncompliance.
<ul>
 	<li>Don’t lie about what you do (or don’t do).</li>
</ul>
The importance of these issues is highlighted by compliance audits, whether internal or third party, not to mention other less predictable events that can put the reality of an organization’s information governance (in contrast to documented policy) under a microscope (e.g., lawsuits, government investigations). Frameworks that imagine workers scanning through policy documentation and applying retention or disposition mechanisms to each email they send or receive might be fictional in application. Instead, a policy might take actual workflow into account and avoid any unnecessary burdens.

While some burden is inevitable, it should be minimized, as it reduces the likelihood of compliant behavior. Accordingly, instead of putting information technology users on the horns of a dilemma (do the job or be compliant), look for opportunities to centralize, automate and streamline. Ultimately, this is the path to governing information effectively in a world where all human beings are suffering from information overload.
<ul>
 	<li>Don’t keep information you don’t need.</li>
</ul>
We cannot overemphasize just how many organizations store too much information, for too long, in too many different places. Many widely reported security incidents involve old and useless information that no one needed to retain. In information security parlance, <a href="https://www.discoveryadvocate.com/2017/05/03/it-lurks-in-the-last-place-you-look-preventing-or-at-least-mitigating-employee-data-leakage/">over-retention increases attack surface</a>.

Unfortunately, the tsunami of spoliation sanctions cases leading up to the 2006 amendments to the Federal Rules of Civil Procedure created an enduring imbalance in focusing concern on the risk of failed compliance with preservation obligations. In recent years, the global proliferation of data privacy concerns and laws has swung the pendulum over to regulatory focus on data minimization or limitation. To increase the challenge, information technology use has evolved so that it is even harder to avoid storing sensitive information longer than necessary and in locations not protected or managed by IT security (including external devices, file shares and cloud services).

While promising tools for effective information governance are in development, the end user maintains a critical role at the center of our <a href="https://www.discoveryadvocate.com/2015/03/30/bring-your-own-device-everywhere-legal-and-practical-considerations-for-international-byod-programs/">bring-your-own-device</a> world, and information governance policy can’t lose sight of this human element. An artful information governance policy must articulate the risks associated with over-retention without diminishing the <em>in terrorem</em> effect of the litigation hold as a bulwark against spoliation. Raising awareness of the risks of data sprawl and providing tips on minimizing it, using examples tied to the organization’s particular information technology environment, should be considered for training associated with the policy.
<ul>
 	<li>Actually (and responsibly) delete; move to storage; delete; concatenate and remediate; and delete again.</li>
</ul>
Finally, policies, procedures, discussions, internal meetings and contemplation are wonderful. But without execution, a well-considered problem still remains a problem. While it is difficult to delete information, it’s not impossible. It does, however, take strategy to do it defensibly through operative policies, documentation and mechanisms for disposition. Successful deletion also may take a “push” – using opt-out mechanisms to encourage employees (and organizations) to let go of outdated, potentially risky information – to truly press delete and leave some of this information behind.

core/freeform

New York

Pairing Real-World™ Problems with Realistic Solutions – a Push for Practical Information Governance