William E. O'Neil, Jr., Esq., eDiscovery expert

by William E. O’Neil, Jr, Esq.

It has been an interesting first half of the year for e-Discovery cases. The “Pension Committee” case “revisited” the Zubalake decisions and re-affirmed the duties for legal counsel when managing the Discovery & legal hold processes.  But, it still seems some are willing to take the risks of possible spoliation of evidence…I speak with clients across the country and have been asked the question more than once…”why should I care about Pension Committee…I am not in the 2^nd Circuit…”

Because…the standards established in in Zubalake, codified in the Federal Rule changes and “revisited” in “Pension Committee” are the standard for legal counsel. They are just explained in detail in “Pension Committee”.  Counsel needs to understand who the “key players” are, what ESI exists, where it resides and ensure the risk of spoliation is reasonably mitigated.  The lack of an e-Discovery strategy and a defensible process for legal hold management and preservation & collection is not a viable defense anymore…whether spoliation is negligent or intentional.

There was an interesting spoliation case decided in the 10^th Circuit.  In “ Medcorp”, the plaintiff allegedly destroyed ESI on 43 hard drives .  The fact that it was done was not in dispute, whether it was intentional, willful or negligent and what should be the consequences of the destruction was at issue.   The defendants requested the action be dismissed and the Plaintiffs argued minimal impact by having provided “some” of the ESI from another source.

The court applied the standards for determining sanctions for spoliation outlined in the “Pension Committee” decision…“[a]ppropriate sanctions should ‘(1) deter the parties from engaging in spoliation; (2) place the risk of an erroneous judgment on the party who wrongfully created the risk; and (3) restore “the prejudiced party to the same position [it] would have been in absent the wrongful destruction of evidence by the opposing party.”

Here, the Court found the Plaintiff’s conduct was negligent rather than intentional. As such, the Court awarded the defendant’s attorney fees, expert witness fees and expenses related to litigating the spoliation issue…AND ordered a “negative inference” jury instruction…allowing the jury to infer the ESI on the 43 hard drives would be detrimental to the Plaintiff’s case.

This is a steep price for counsel to pay for not exercising proper oversight over discovery!

SEE: Medcorp., Inc. v. Pinpoint Technologies, Inc., et al 2010 WL 2500301 (D. Colo.).

Discover More

Randolph A. Kahn, Esq., Kahn Consulting	James D. Shook, Esq., EMC eDiscovery expert and Attorney

Date: Wednesday, July 14, 2010
Time: 10:00 AM Pacific

EMC is proud to bring you this special webinar focused on how you should think about handling eDiscovery in 2011. Our esteemed guest speaker, Randolph A. Kahn, Esq., is well known in the legal/compliance circles and brings a wealth of knowledge on eDiscovery.

He will be discussing current trends in eDiscovery that will dictate how you perform eDiscovery in 2011, risks associated with current practices/tools/processes and best practices to consider adopting in order to get ahead of your eDiscovery woes. Joining him in this discussion will be our in-house attorney, James D. Shook, Esq., who too brings tremendous eDiscovery knowledge to the event.

Register Today, as seating is limited for this premium webinar.

All attendees will be entered into our drawing for a new iPad.

Discover More

Gain autonomy and receive improved eDiscovery guidance

James D. Shook, Esq., CIPP EMC eDiscovery Expert

In today’s economic environment, companies deploying new technology have to show not just that they will be better and faster, but also just how much faster and better so that they can justify the expense.  Part of the buying process frequently involves gathering data on how much it costs to handle a business process in the current environment, how much can be saved with improvements, and establishing that the savings will justify the cost of the improvement (and frequently, how long it will take to do so).  Most companies refer to this process with the shorthand acronym of “ROI” or “return on investment”.  (In financial circles, ROI is actually a more complex analysis, but it’s still a good acronym for our purposes).

For companies that are looking to bring more of their eDiscovery process in-house, the ROI process can be difficult.  While we intuitively know that we can save money and cut risk with a leading eDiscovery solution, it can be tough to show that quantitatively because financial information is usually not readily available.  Even within the legal department, the cost of eDiscovery is frequently not well-known.  Often, time and money spent on eDiscovery issues is buried with other tasks in time entries from outside counsel; internal costs are generally not tracked at all; and payments to third-party processes are passed through (or marked up) by outside counsel and difficult to locate.

The benefits can also be difficult to calculate.  For example, many companies have poor eDiscovery processes (what we term “Faux eDiscovery“), where they wrongly or negligently ignore data sources and/or sound eDiscovery processes.  Faux eDiscovery can actually be very inexpensive — the real “cost” is in the risk with being caught and sanctioned.  But risk is difficult to quantify.  The result is that some companies trying to improve their eDiscovery processes may actually find a negative ROI (i.e. we only spend $10,000 per litigation now but it will cost us $50,000 to do it right) because they fail to identify or quantify the real ROI — their reduction in risk by handling eDiscovery properly.

If you are putting together an ROI analysis for bringing eDiscovery in-house, here are a few things to consider:

The general statistics available about eDiscovery costs are startling.  It’s well-established that having legal professionals review data – one of the later steps in the eDiscovery process — is expensive, with $18,750 per gigabyte a well-accepted number.  (Gartner, Reducing the Cost and Risk of EDiscovery in 2009, 1/9/2009 at 6).  Over the last several years, the average cost of discovery per case ranged from $621,880 to $2,993,567 (Litigation Cost Survey at 3).  And as noted earlier, Gartner advised an IT eDiscovery budget of $500,000 for a modestly sized case.    (Gartner, Reducing the Cost and Risk of EDiscovery, at 5).

Cutting through the noise, Gartner notes that many companies report a full return on their investment in an eDiscovery solution within 3 to 6 months — or within a single large case.  (Gartner, Marketscope for E-Discovery Software Product Vendors, 12/21/2009 at 2).  While these high-level facts alone may not be enough to convince anyone who requires a detailed ROI, they can help to set the stage for acceptance and also tend to strike a nerve with many C-level executives.

Undertake basic investigation on costs.  Talk to the legal department about how many “cases” they handle in each month (or year), being sure to include internal investigations and employment claims, regulatory inquiries and other matters where data is being preserved, collected and/or processed — not just “lawsuits”.  Ask them if they have information about amounts paid to outside service providers (perhaps through their law firm) for eDiscovery services.  Also check with the people who handle backups and email within the IT department — since different groups within legal may be asking them for help, they may actually have the best view of this work, and could even have hired an outside vendor to handle some eDiscovery-related work.  IT wil generally know whether the company has had to purchase tape processing equipment, additional storage or other non-standard equipment to help the lawyers with eDiscovery.

Check on soft-costs, too.  Most IT departments are only too ready and able to tell someone (anyone!) how much time they have devoted to eDiscovery tasks.  Frequently groups of 2-3 staffers can be assigned full-time or better for weeks or months on a medium or large case.  Without a chargeback model, legal might not even be aware of the massive undertaking to help them.

You may only be able to gather information on a few cases.  In that scenario, try to figure out whether it’s legitimate to extend the information out across the full volume of cases:  were these cases representative of what’s happening?  Do our cases tend to be similar or repeatable?  Do I have a good sampel?  When detailed information is not available — and usually it’s not — your goal is to get an understanding of the magnitude of the spend, and not necessarily the exact dollar amount.

There are a variety of ways in which you can begin to assess the savings that an eDiscovery solution will bring to the company.  In many cases, after purchasing a solution the incremental costs fo reach case will be almost nothing.  The better systems will enable custodian notification, search, preservation, collection and processing within the platform, so that investigators can efficiently handle these tasks.  This is really the purpose of the ROI analysis — case-by-case handling costs should be very small, because the expense is up-front in the purchase and deployment of the solution.

One area where the savings can be significant, but still substantial, is with “eyes-on” legal review.  An efficiently deployed system will help to minimize the amount of data collected, processed and eventually reviewed; but the review volumes can still be large.  And the hourly costs of review will be the same (although you can get some savings from de-duplication, clustering, email threading, etc.).  Still, we routinely see 50%+ savings in review based on the reduction in volume for efficient collection and culling.

You may decide that risk is too difficult or political to calculate as part of the ROI.  Or you may decide that it’s a necessary component that you must include.  Both approaches can be effective.

If you decide not to calculate a specific value for risk, you should still consider some risk analysis as part of your process, even as merely a “plus” factor to your overall analysis.  In doing this, take note of recent cases where companies have paid sanctions, had their case compromised and/or faced a backlash in the press (and potentially from shareholders).  You may not have a value for that risk, but the message will resonate with management.

If you do calculate risk, consider a conservative approach and factor in the probability of a sanction.  For example, you might decide that a severe sanction would compromise your ability to effectively defend (or prosecute) a case, and a larger case can be worth $5,000,000.  If you estimate a 10% chance of being sanctioned, you could take the resulting product ($5,000,000 x 10% = $500,000) as a basis for your risk value.  Remember that this risk amount would apply to each such case; so while the risk amount for a sanction on a smaller case might seem low (let’s say $20,000), it would be applied over a far larger number of cases.  It adds up!

Also remember that sanctions costs can exceed the entire estimated value of a case.  There have been many cases where shoddy eDiscovery processes have resulted in expensive remediation efforts — legal fees in determining what went wrong and how to fix it (and fending off motions for sanctions), repeating earlier work or being forced to use extraordinary efforts such as tape restoration.  So even a $500,000 case with eDiscovery problems could easily require more than the case value to try to “fix”.  (And don’t let anyone argue that you could always just write a check to settle the case.  Opposing counsel may have valued the case at a higher value than you, and once they realize that you are in trouble, it could be tough to negotiate a fair settlement).

Sometimes a simple model is better.  We have used extremely complex ROI models that were spot-on, but difficult to explain, and ultimately were ignored. We have also seen very simple models — “an eDiscovery solution will save us 50% in review costs, and last year review costs were $5M” — that have carried the day.  Hopefully, as you work on your ROI project, you’ll uncover the method that will best establish your case.  Until then, consider using a scenario-based approach (small case, medium case, large case), develop your facts for each one, and extrapolate the costs across the volumes that you expect to see each year.

DISCOVER MORE

Matthew Nelson, Esq., EMC eDiscovery Expert

Does the Pension Committee Amended Opinion and Order Go Far Enough?

The Pension Committee Blog Series

On January 1, 2010, Judge Scheindlin re-established her ability to captivate legal audiences by authoring an opinion that struck fear into the hearts of many litigators and the parties they represent.

Dubbed “Zubulake Revisited: Six Years Later”, the Pension Committee decision serves as the “snooze button” for those practitioners who may have slept through the original eDiscovery “wake up call” sounded by Judge Scheindlin in her oft quoted Zubulake line of decisions.

Not surprisingly, opinions designed to offer clarity regarding a controversial subject such as electronic discovery, are destined to have both supporters and critics.  What is surprising, is that Judge Scheindlin responded to many critics quickly by issuing an amended Pension Committee Order and Opinion on January 15, 2010, to clear up language that could be characterized as confusing at best and inconsistent with previous case law at worst.

The Amended Order primarily clarifies language that could lead one to believe that a duty to preserve and possibly search backup tapes that relate to “key players” always exists.  The Amended Order clarifies the issue in a number of areas, but cautionary footnote number 99 arguably frames the issue best:

“I am not requiring that all backup tapes must be preserved.  Rather, if such tapes are the sole source of relevant information (e.g., the active files of key players are no longer available), then such backup tapes should be segregated and preserved.  When accessible data satisfies the requirement to search for and produce relevant information, there is no need to save or search backup tapes.” Pension Committee of the Univ. of Montreal Pension Plan, et al., v. Banc of America Securities, LLC, et al. at 42.

Footnote 99 is a potential trap for the unwary because its apparent simplicity could lead some practitioners to take backup tape preservation less seriously.  Does Footnote 99 and the rest of the Amended Pension Committee Opinion and Order go far enough in clarifying the tricky backup tape issue that gives so many organizations headaches?

Join our discussion and make your opinion(s) known, as we probe the case’s lingering questions and foreboding implications in The Pension Committee Blog Series.

EVENT Venue: Four Seasons Palo Alto 2050 University Avenue East Palo Alto, California 94303 650.566.1200

Date: Thursday, June 17th, 2010 11:30 am PDT.

Agenda: 11:30 – 12:00 Registration & Lunch – 12:00 – 1:30 Panel Discussion

Panelists: Browning Marean, Esq., Senior Counsel, Angela Padilla, Esq., VP litigation VMWare, Emily V. Pastorius, Esq., DISH Network, L.L.C., Matthew Nelson, Esq., eDiscovery and Compliance Expert, EMC SourceOne eDiscovery – Kazeon.

Register to DISCOVER Reserve your seat for Lunch today, as attendance is limited.

Outside counsel recommends preserving everything, the IT department thinks the attorneys are out of their minds and in house counsel knows there must be a better approach to eDiscovery. How should the company litigation hold strategy relate to the company record retention policy? Can technology help solve any of these problems?

If these are the kind of issues keeping you awake at night, then join our panel of attorneys as they debate modern eDiscovery and Compliance best practices from their unique points of view as corporate counsel, outside counsel and technolawyer.

Topics Include:

	Is my litigation/eDiscovery strategy legally defensible?
	How do we update our records retention policy?
	Can today’s legal technology solutions minimize corporate risk and expense?

For additional information, contact April Lombardo at lombardo_april@emc.com or 925.600.5852.

“This is an excellent opportunity to gain firsthand eDiscovery knowledge and learn best practices from Corporate Counsel who have been in the eDiscovery trenches,” J. David Morris, EMC SourceOne eDiscovery – Kazeon.

CLE Details ——

California: This activity has been approved for Minimum Continuing Legal Education credit by the State Bar of California in the amount of 1.5 hours in the General category. DLA Piper certifies that this activity conforms to the standards for approved education activities prescribed in the rules and regulations of the State Bar of California governing minimum continuing legal education.

New Jersey: This program has been approved by the Board on Continuing Legal Education of the Supreme Court of New Jersey for 1.8 hours of total CLE credit. Of these, 1.8 qualify as hours of credit toward the General category.

New York: This transitional and nontransitional continuing legal education program has been approved in accordance with the requirements of the Continuing Legal Education Board for a maximum of 1.5 credit hours which can be applied toward the General requirement.

CLE credit will be applied for in other states where DLA Piper has an office with the exception of Minnesota, North Carolina and Pennsylvania.

Register to DISCOVER

J. David Morris, EMC SourceOne eDiscovery - Kazeon

The SourceOne eDiscovery – Kazeon and SourceOne File Management pods were high profile attractions this year. eDiscovery demonstrations ran nonstop, as IT and Legal professionals crowded the booth to see the new features and functionality of the Kazeon suite and its integration with EMC’s Documentum, Celerra, and Data Domain products. The Kazeon File Management pod was a consistent hit throughout the show with attendees staying up to an hour after the show floor closed to see demonstrations and ask questions. The power which the Kazeon eDiscovery and File Management tool suite delivers, astounded IT and Legal professionals alike.

The file visibility, classification, migration, remediation, reconciliation, extraction, policy creation and enforcement, file retraction and deduplication capabilities comprise the first complete tool suite of its kind which allows IT managers the ability to optimize their storage assets, as well as deliver auditable governance and compliance capabilities. Legal professionals also realized the importance of Kazeon’s File Management impact on eDiscovery, as it delivers the tools corporate IT professionals need to deploy and enforce Information Management policies to provide an auditable chain of custody and defensible compliance and governance processes. Attorneys and paralegals found the new streamlined eDiscovery case management and workflow user interface enhancements delivered significant time savings.

“The capabilities of Kazeon File Management and Kazeon eDiscovery dovetails with George Socha, Esq., and the Electronic Discovery Reference Model (EDRM) group’s new project on information management. The Information Management Reference Model (IMRM) expands the information management segment of the EDRM to include multiple stakeholders, information value and processes,” says Karthik Kannan, Sr. Director of EMC eDiscovery. “The IMRM delivers the conceptual framework for IT, Legal and Business stakeholders to discuss information management and eDiscovery to optimize and balance regulatory obligations against business needs. The knowledge gained by participating in both the EDRM and IMRM working groups has proven instrumental in EMC SourceOne eDiscovery – Kazeon product development and improvements. “

Discover More!

Presentation One

Title: eDiscovery: Why the IT and Legal Departments Are Strategic Partners In Managing eDiscovery

When: 2:00 PM, Wednesday, May 12th

Abstract: Gaps exist between IT and Legal in most corporations today. This hinders the efficiency and accuracy with which legal processes such as eDiscovery may be performed. Learn how EMC can bridge this gap and ensure a successful eDiscovery strategy across your enterprise using the SourceOne eDiscovery – Kazeon product.

Presentation Two

Title: File Management: Managing your Enterprise-wide Files Content in an Efficient and Systematic Manner

When: 8:30 AM, Thursday, May 13th

Abstract: This session will discuss how to better manage your enterprise data, especially files (unstructured data), for the purposes of better IT management, adherence to compliance or other internal policies/procedures and ultimately reducing costs in your environment. All of this and more can be achieved with EMC SourceOne Kazeon file management and reporting solution.

“Join us for the ultimate EMC educational forum and gain unparalleled access to our entire portfolio of software, platforms, solutions, and services.  This year we add eDiscovery to EMC’s product portfolio. Deploying the right technology is critical to help reduce eDiscovery cost and increase productivity,” says Karthik Kannan. “We will discuss why eDiscovery is not only a legal matter since it impacts attorneys, it professionals and business stakeholders and outline eDiscovery best practices. Since eDiscovery is a specific use case of a larger Information Management, Compliance and Governance initiative, we will also discuss how to manage file content across the enterprise with Kazeon’s File Manager to meet eDiscovery and Information Management challenges.”

Discover More

Solving e-Discovery Challenges

Date:  May 25, 2010
Time:  6:00 to 8:30 PM
Place:  Capital Grille
Location: 633 N. St. Clair St.
Chicago, IL 60611

Click here to Register!

E-Discovery introduces risks, drives up costs and causes headaches for inside counsel and IT departments alike.  We invite you to join Laurus Technologies and EMC for an informative presentationwritten specifically with the General or Inside Counsel  in mind–that will simplify the process of selecting and implementing an e-discovery framework.  The audience will learn how e-Discovery:

• Empowers an organization with classification, security, retention, proper disposition and access to information
• Helps discover and manage content, and apply secure legal hold across a variety of repositories
• Provides secure authorized investigator access, defensible collection results, and chain of custody
• Automates the eDiscovery process and quickly deploys in days or weeks instead of months

You will also learn how EMC SourceOne delivers comprehensive information governance solutions and enables you to take a proactive approach to legal requests, ensuring litigation readiness.

James D. Shook, Esq., CIPP EMC eDiscovery Expert

About the Presenter:  James Shook, Esq., CIPP
Jim Shook is a recognized authority on legal e-discovery and information governance. In his role as the Director of EMC’s e-Discovery and Compliance Legal Team, Jim works with EMC’s customers to help them solve their challenges with e-Discovery, compliance, and privacy.  Prior to joining EMC, Mr. Shook spent over ten years practicing law as a litigator in one of Phoenix’s oldest law firms and as the general counsel to two technology companies

Jim is a long-time member of The Sedona Conference, a well-known legal think tank, and is an active contributor on several Sedona committees. He has served as an editor on the Electronic Discovery Reference Model (EDRM), and publishes and speaks regularly at conferences on technology’s impact on legal issues, including the publication of “Don’t Be An e-Discovery Ostrich” in late 2009.

For More information, contact Steve Susina at Laurus Technologies
630.521.8932 or ssusina@laurustech.com

James D. Shook, Esq., CIPP EMC eDiscovery Expert

By James D. Shook, Esq., EMC eDiscovery Expert

Regardless of your definition of Cloud Computing — and there are many — the concept of “The Cloud” is compelling to many enterprises.  In particular, many of our customers have recently asked us whether it’s a good idea to move their email to the cloud with a third party provider.

As with most other strategic decisions, there’s no one-size-fits-all type of answer.  Instead, a sound decision will involve a risk-reward analysis that is based on many factors.  For email in the cloud, the potential reward side includes the possibility of cutting infrastructure and staffing costs, reducing energy consumption, eliminating logistical complexity and enabling rapid rollout and expansion.  On the risk side, there are concerns about security, privacy and the loss of control over a critical service like email.  Most of our customers are diligent in looking into these issues, and expert in weighing their point of balance (or imbalance).

However, many customers completely miss evaluating risks related to compliance, especially in the area of electronic discovery.  In part, this seems to be related to the fact that IT typically drives the Cloud decision-making process, frequently with the CFO, and Legal is seldom involved in the process (until the contracts need to be reviewed).  Even when IT considers eDiscovery, it may just be a cursory examination of issues that do not really get to the heart of potential risks.

If your company is making a decision about moving email to the Cloud, you should factor in Compliance concerns, particularly about eDiscovery.  Here are a few basic issues to consider with your legal department or outside counsel:

- How will you locate and put a legal hold on email — are there self-help tools or will you need to contact the Cloud provider’s staff?  With self-help tools, what type of criteria can be used to search, and how quickly will you have responses?  If the vendor’s team is involved, what is the process, and are there SLAs in place to insure that your needs (which are frequently based upon important legal obligations) will be met?

- Once email has been identified to be placed on hold, how will the hold be put into operation?  Can the messages be collected and returned to you, and if so what formats are available?  For example, will someone need to put the data onto physical media and mail it to you?  Alternatively, if data can be downloaded, are the connections sufficient if you are collecting a terabyte or more of data (and do your cases make this scenario a possibility)?

- What are the costs associated with these processes?  Will it be a “pay-as-you go” basis or is there a per seat or per GB charge for these tools?

- What type of additional support — such as authenticating the data and the process used to collect data — can be provided if questions arise during the legal process?  What will it cost for this support?

- If things go wrong and data that was supposed to be retained is lost or deleted, whether accidentally or negligently, can you expect to be reimbursed for costs and/or legal fees?  If so, to what extent?

Many cloud email vendors have become more aware of requirements for eDiscovery functionality or services, and are doing a better job of supporting customers’ needs.  In addition, for companies with minimal eDiscovery requirements, even “bad” responses from Cloud vendors on these questions may not sway their decision to move to the Cloud.  Remember, this is a risk-reward analysis, and if the risk is perceived as very low, the perceived reward may carry the day.  But any good analysis should include a solid review of these and related eDiscovery factors.

Discover More with Kazeon

Cloud computing and Software as a Service (SaaS) have received significant press coverage throughout 2010.  However, Forrester Research finds that only 1% of all workloads will be running in the cloud in 2010.  According to Goldman Sachs, 55% of all CIO will not use the cloud in 2010.  However, GS predicts that only 21% of CIO will not be using the cloud by 2012.  Why so much hype? What are the benefits? What are the challenges, which preclude adoption?

Cloud computing is Internet-based computing, where technological capabilities are maintained off premises and delivered on demand as a service via the internet, not unlike a public utility (Wikipedia: http://en.wikipedia.org/wiki/Cloud_computing). Software-as-a-Service (SaaS, typically pronounced ‘sass’) is a model of software deployment over the internet. With SaaS, a provider licenses an application to customers for use as a service on demand, either through a time subscription or a “pay-as-you-go” model (Wikipedia: http://en.wikipedia.org/wiki/SaaS).

The two technologies allows CIO/CTO flexibility when constructing and deploying their corporate IT strategy, i.e. they don’t have to sink budget into more hardware, software and applications, only to watch the investment set idle for a majority of the time. The on-demand nature of the Cloud/SaaS services delivers organizations the ability to get more computing power for the buck and only pay for what they use.  The accounting treatment is also advantageous since Cloud/SaaS is an expensed service versus headcount and assets.  Overall, it allows IT to reduce costs while delivering required services to drive the business forward or that is the promise an hope.

Both technologies are delivered via the Internet, but the difference is that cloud computing refers to basic IT computing infrastructure, e.g. storage and compute I/O, and SaaS typically refers to a specific application, e.g. Salesforce and Gmail.  Cloud/SaaS offers IT professionals significant cost saving and flexibility; however, it also reduces information control and security.  Preplanning in case of eDiscovery prior to signing a contract for Cloud/SaaS services is a good idea.

Where is electronically stored information (ESI) when it is in the ethereal cloud or SaaS application?  Historically, information, applications, data, computing and storage were all enclosed within a physical computer.  With Cloud/SaaS, the services are dynamic, virtualized and disaggraded.  Where is your data? It depends. The ESI likely resides in multiple datacenters across multiple states/provinces and it could even be stored across multiple countries. It is the Cloud/SaaS providers business to deliver seamless access to their clients anytime, anywhere regardless of inclement weather, power outages, system failures, and other challenges.  The Cloud/SaaS model just made eDiscovery matters significantly more complicated with potential multinational legal, compliance and privacy issues.

Another question is  “Who has access to my data?” The answer is more people than CIO or Corporate Counsel would like to admit to.  At a minimum, it is the organization’s employees, which provision the Cloud IT infrastructure or utilize the SaaS application, as well as the Cloud/SaaS provider’s employees, which maintain the infrastructure/applications.  eDiscovery just became a little more complicated.  Data access by a third party also raises security issues, as most ESI thefts have been internal jobs.  We, now, have to worry about our employees, as well as our Cloud/SaaS provider’s employees.

If the Cloud/SaaS provider loses or inadvertently deletes my information, aren’t they responsible?  No, the court wont let you pass the ESI buck. If the records stored in the cloud are inaccessible or lost, the corporation, which entrusted the ESI to the Cloud/SaaS provider, is responsible.  Sanctions anyone?  Of course, the corporation could litigate the Cloud/SaaS provider, but the fine print in contract will likely cover this event.  As mentioned before, negotiate service level agreements, as well as data access and collection in the event of eDiscovery.