Legacy Data Cleanup A 5-Step Plan

All companies have it. Backup tapes out of rotation, information retained from a resolved lawsuit, data left on servers after a migration, orphaned computers and media left behind when employees leave or move. Such electronic "legacy" information can be easy to ignore (or not know about), but its very existence represents an avoidable cost and unnecessary legal, regulatory and privacy risk. As mergers combine company information and layoffs separate electronic information from prior owners, legacy information is growing. And often there is no good reason for this information to persist.

Managing legacy information now will stop the accumulation of unnecessary material and reduce the volume that might be subject to unanticipated regulatory or litigation demands (and expense) in the future. In the legal arena, companies increasingly face court sanctions for their inability to find and produce pertinent electronic information. In business, more and more companies are paying dearly for breaches of privacy and security. But the good news is that such consequences can be avoided with some thoughtful planning and execution.

Here are five steps to begin implementing today to get the risk under control.

1. Assemble a cross-functional team. Managing legacy information—a responsibility that no one really owns or has budgeted—requires an initiative backed by C-suite sponsorship. IT should be at the forefront of the effort, but content assessment and ultimate disposition require buy-in and resources from IT, legal, records management, compliance and other business stakeholders.

2. Identify and inventory legacy information. Assess the information that exists in your organization, mapping enterprise data to applications and users. The mapping exercise identifies information required for business or legal reasons, and thus exposes unnecessary or outdated material. A phased plan should include interviews with IT and business employees to learn what data sources they know about and what they actually use. It also requires a physical inspection. Actions to take:

• IT staff should review server directories for duplicative or unnecessary data stashes, such as migration backups;
• Experienced personnel should walk the floors of data storage facilities—including the warehouse and outsource locations—on the lookout for media stockpiles;
• Check conference rooms, shared spaces and closets for orphaned media such as old tape sets, CDs or DVDs; and
• Remember third-party service providers such as law firms or consultants; the data you provided may end up at the curb,especially if ties are severed.

3. Assess content and value of legacy information. Once legacy information has been located, a team effort may be needed to understand enough about content to make a disposition decision. Some questions to consider:

• Who created or accessed the content? When was it used? How, and why?
• Does the media type or location provide useful context?
• With what business system or application was the data or media connected?

If the answers don’t provide enough information to identify content, try interviewing long-time or retired employees. Or, if the information is readily accessible, consider taking a sample. As a last resort, more sophisticated options for accessing old media might be assessed, but this can be expensive, complicated and time-consuming.

4. Understand your organization’s retention requirements. Your organization should have an information management policy in place that takes into account any business, regulatory and litigation imperatives that might apply. If you don’t yet have such a policy, develop one. A well-crafted and enforced retention and disposition policy with a principled set of processes (read: defensible) is essential in managing costs and mitigating risk. Some considerations:

• Do department record schedules reflect information the company really needs to meet its business and regulatory requirements?
• Have legal holds been issued for all anticipated litigation? Have obsolete ones been released?
• Are policies up-to-date? Has the company implemented any new technologies not clearly addressed, such as wikis and digital voicemail?

5. Take action: implement and document. Finally, apply the retention rules (step 4 above) to the contents (step 3 above) and act. If information does not need to be retained or preserved, arrange for its permanent and secure deletion or destruction. Document both the process and the results. This is prudent from both a procedural and defensibility standpoint. If the information is of mixed content warranting granular review, certain sophisticated information retrieval processes can identify relevant information and apply retention rules with a high degree of accuracy. If you decide to go this route, organizations such as TREC (the TextREtrieval Conference) and The Sedona Conference offer guidelines and benchmarks to help in understanding this approach.

As you carry out these steps, ask how you can apply what you are learning. Was there a process to keep information management policies current? Are IT procedures aligned with policy (e.g. are disaster recovery backups kept no longer than necessary)? Can new IT procedures (e.g., for departing employees) reduce the future legacy stockpile? Would better tools help? Did lack of education or enforcement contribute to the problem? A disconnect between policy and practice increases corporate cost and risk without justification.

Make no mistake: this is an exercise that is likely to reveal problems that no one wants to own. But it’s also one that will deliver real and immediate value by reducing the burden of lugging legacy information into the future and by helping your organization understand how to stop today’s information from becoming tomorrow’s problem.

---

H5 provides a full range of advisory and implementation services to help law firms and corporations meet the practical challenges of finding, assessing and managing information. Visit http://www.www.h5.com to learn more.