OSB Professional Liability Fund

Data Hoarding: A Potential Risk for Law Firms - Part II

Image of data center
April 20, 2018
by Hong Dao

How to Avoid Hoarding Data

In my previous blog post, I discussed the risks and reasons lawyers over-save data. This post is about how lawyers can avoid hoarding data. Don’t start indiscriminately deleting or shredding files to avoid hoarding data. The process must be thoughtful and deliberate.

Understand your ethical and legal obligation to retain data and for how long

 An important step in reducing data is first to understand the data you must keep and for how long. 

Client Data

Various Oregon Rules of Professional Conduct require lawyers to take reasonable steps to protect the confidentiality of client information and safeguard client property. ORPC 1.15-1(a); 1.6(c). But the ethics rules do not state how long lawyers should keep their client files. Formal Opinion No. 2017-192 explains what a client file is but specifies no retention period. This lack of ethics guidance can be confusing for lawyers, and many end up saving too much data for too long.  
 
From a malpractice viewpoint, the PLF recommends lawyers keep most files (whether paper or electronic) for 10 years. This recommendation is based on the 10-year statute of ultimate repose in ORS 12.115.
 
Depending on your areas of practice, you may have to retain documents for over 10 years. Research the laws in your practice areas for specific retention requirements. The PLF’s File Retention and Destruction Guidelines provide information on this topic and are available here.
 
Also be mindful of legal holds, e-discovery, and other rules of court procedure when deciding what data to preserve and how long. 

Other Data

Besides client files, firms also have business records, tax records, personnel files, and other administrative data. Each category of files may have its own retention and destruction requirements. Again, research the applicable laws and rules on how long you are required to retain these records.

Delete data you don’t have to keep and don’t need

Beyond the legal and ethical considerations, you need to assess the value of the data you are over-saving. If you are not legally or ethically required to retain a document, why keep it? You may be taking a high risk to keep something of low value.

Remove duplicate data

It’s common for lawyers to have multiple copies of the same set of data stored in different formats and locations. For example, a paper document may be scanned, then emailed to other members of the firm and stored on Google Docs or Dropbox as well as on the individual’s computer and the firm’s server. Many lawyers do this to access their documents easily or as a way to back them up. But this practice can be more of a problem than a solution because now you have more data to delete from more locations. Trying to avoid data hoarding is useless if you just remove the data from one location but not from others.

Have a written data retention and destruction policy and implement it

You need a system to dispose of data that complies with your ethical and legal obligations. This system should be written down as a firm policy that sets forth the procedures for retaining and the schedule for destroying client and administrative data in both electronic and paper formats.  
 
For client data, the policy should include a few things. One, it should specify the length of time files will be kept and in what manner. Remember, the PLF recommends a 10-year file retention period. Two, the policy should describe what will happen to the files after the retention period, such as whether the files will be destroyed or returned to the clients. Three, the policy should require lawyers to secure their clients’ consent to retain, destroy, or return their files in the written fee agreement.

Securely destroy data

When destroying data, either as part of your firm’s routine destruction schedule or because it’s not needed, make sure the destruction is done in a secure manner. Always shred paper files. Never throw them in the dumpster or put them in a recycle bin in their raw form.  For electronic data, use software to permanently override the data or physically destroy the hard drive. For more information on properly destroying data in computer and other devices, read Unwanted Data: How to Properly Destroy Data in Hardware, available here.

Additional Resources