Managing Litigation Holds in Office 365
In the modern workplace, where much of what we do and say takes place on screens, managing electronic evidence has become increasingly complex and time consuming.
When a lawsuit, internal investigation, or other legal proceeding appears on the horizon, it’s an organization’s legal obligation to preserve electronically stored information, or ESI.
Managing data in the expansive and dynamic Office 365 environment is no small task. To avoid adverse outcomes and penalties, organizations employ litigation holds to safeguard potentially relevant emails, documents, and other communications records.
Legal teams need to understand Office 365 litigation hold basics and best practices for implementation – as well as the modern tools available today to manage holds successfully.
Litigation Hold: A Legal Freeze on Data as Potential Evidence
A litigation hold, often referred to as a legal hold or preservation order, is a legal requirement that organizations must follow when they are involved in, or anticipate, a legal dispute. Its primary purpose is to safeguard and preserve relevant electronic and physical evidence that may be pertinent to a legal case. Legal holds are used in a range of scenarios, from civil lawsuits to regulatory investigations and internal disputes.
When they’re involved in litigation, organizations and individuals may be legally obligated to suspend their routine data and document retention practices. When ESI, such as emails, documents, and chat messages, is on litigation hold, it is actively protected from deletion, alteration, or tampering.
In essence, a litigation hold acts as a legal "freeze" on the destruction or alteration of evidence. It ensures that all relevant materials are retained intact for the duration of the legal proceedings. Failure to implement a litigation hold can result in serious consequences, including sanctions and adverse inference instructions from the court.
Preventing Permanent Data Deletion in Office 365
Microsoft lets organizations manage their data – emails, documents, instant messages and other content – through retention settings. By configuring retention policies and retention labels, organizations can retain or delete data based on their goals. Retention setting features are designed to assist companies with meeting broader compliance goals, rather than needs related to particular ediscovery matters, and focus on longer term data lifecycle management strategy.
That said, retention settings can also reduce a company’s risk profile during a litigation or a security breach because they also ensure that content that’s not required anymore is permanently deleted on a regular basis.
Retention policies, which let users assign retention settings to content, including a retention period, apply to a number of data locations, including but not limited to:
Exchange mailboxes
SharePoint sites
OneDrive accounts
Teams channel messages and chats
Teams private channel messages
Content that has retention settings assigned stays in its original location, but when users make changes (edit or delete), a copy is automatically retained. Thus, deleted items are not permanently lost. The location where the copy is retained depends on the application used:
Copies of SharePoint and OneDrive site content are retained in Microsoft’s preservation hold library.
Copies of Exchange mailbox content are retained in the recoverable items folder.
Copies of Teams content are retained in a hidden folder in the Exchange recoverable items folder.
Retention labels, which can be used for different types of content that call for different retention settings such as tax forms or work visas, allow users to find items using content search.
Advanced ediscovery tools, such as Everlaw, help ensure that all identified data is preserved in a forensically sound manner by enabling users to manage litigation holds – from creation and tracking to release – directly from one unified platform.
The automation of the full legal holds process, and its integration into a single source of truth for subsequent EDRM steps, drives greater accuracy and efficiency.
O365 Retention Policies and Retention Labels Versus Ediscovery Holds
Both retention settings and ediscovery holds can prevent permanent data deletion, but they’re built for different uses. Retention settings are designed for long-term data lifecycle management to help an organization meet compliance goals. Their focus is typically at the location or content level, rather than an individual user.
By contrast, when a specific litigation or investigation matter arises, an organization can preserve data by creating holds with an ediscovery case in Microsoft. Holds for ediscovery are intended for limited time periods to preserve data just for that legal proceeding and focus on content owned by individual users.
A litigation hold preserves all mailbox items, including modified or deleted items. Litigation holds can be applied in Exchange Online by using the Exchange admin center or Exchange Online PowerShell. When a user mailbox is placed on hold, any content in their archive mailbox, if enabled, is also preserved.
Ediscovery holds can be configured either to preserve all user mailbox content or only items covered by a particular search query. Ediscovery holds are applied through the Microsoft Purview compliance center.
To place ediscovery holds on users, create and edit searches, or export content from an ediscovery case, a user needs to be added as a member of the ediscovery manager role group in the compliance portal and have the correct permissions.
Searching for Data in Microsoft Purview Ediscovery Tools
When data has been marked for discovery purposes through holds for ediscovery, users can search for it in Exchange Online, OneDrive for Business, SharePoint Online, Microsoft Teams, Microsoft 365 Groups, and Viva Engage teams.
Microsoft Purview eDiscovery cases let users identify, hold, and export content from mailboxes and sites with more features – such as custodian management, legal hold notifications, and analysis – available at a premium subscription rate.
Keeping Current With Microsoft Ediscovery Updates
Some companies may still be using older ediscovery tools, including in-place holds and litigation holds which are no longer available in M365’s new Exchange admin center.
Microsoft announced the retirement of its legacy ediscovery tools for its cloud-based versions of M365 and O365 which don’t let users search for non-Exchange content in services such as SharePoint Online and Microsoft 365 Groups.
Because Microsoft continually makes updates to its products and processes, be sure to check its online resources to stay up to date.
Risks Associated With Poorly Handled Legal Holds
Failing to execute a litigation hold correctly can have significant consequences from a legal and strategic perspective. The most direct consequences are spoliation sanctions. This is when courts impose sanctions – in the form of fines or adverse inference instructions – on parties for failing to preserve evidence, or for intentionally destroying it.
Inadequately handling a litigation hold may also lead to legal liability for the organization, including fines, penalties, and legal costs associated with defending against spoliation claims.
Just as significant is the potential blow to an organization’s reputation. Failing to preserve evidence through data loss can damage an organization's credibility and reputation in the eyes of the public and the court, and could impact the overall litigation strategy.
The risks associated with poorly handled litigation holds can have far-reaching implications for both the legal case and the organization's overall standing.
Following best practices in issuing and managing litigation holds reduces that risk.
Best Practices: Issuing Effective and Defensible Litigation Holds
To ensure that a litigation hold is carried out effectively, legal teams need to act promptly, communicate clearly with end users and custodians, use modern tools, and document their process. The team should issue a legal hold as soon as litigation is reasonably anticipated. Delays can easily lead to loss or destruction of critical evidence. Failure to properly execute can lead to severe consequences, including sanctions and adverse inference instructions.
Litigation hold notices should be clear and concise, outlining the scope of materials to be preserved and providing detailed instructions to custodians. Maintaining detailed records of the litigation hold process, including the names of custodians, the date of issuance, and the steps taken to ensure compliance is a must. It’s also important to continuously monitor and update the litigation hold to adapt to changing circumstances or new information.
Close collaboration between legal counsel and the IT team is typically helpful, as is the use of modern ediscovery technology to streamline the process and ensure defensibility.
By following these best practices, teams can enhance the effectiveness of their litigation hold process and minimize the risks associated with mishandling evidence.
