Legal Updates

E-Discovery Strategies For Handling Personal Identifying Information

Russell Beets May 16th, 2022
Privacy

We’re all familiar with the importance of avoiding the inadvertent disclosure of attorney-client communications, work product or sensitive, proprietary or confidential business information. However, our obligations don’t end there. In addition to protecting this information, we also need to consider how to handle personal identifying information (“PII”). With extremely large amounts of data being at play in most litigation matters, it is becoming more and more important to have a solid game plan with safeguards and protections in place. Accidentally disclosing PII can lead to a chaotic discovery process and could lead to expensive monetary sanctions.

What Is PII?

PII is any personal information that may be used to identify a single individual. Generally, this is a person’s name along with some of the following pieces of information:

  • Social security numbers
  • Driver’s licenses
  • Financial account information, such as bank account numbers or credit card numbers
  • Birthdays
  • Tax identification numbers
  • Employee identification numbers
  • Account names/passwords
  • Personal Health Information (PHI)

Although PII is defined in 2 CFR § 200.79, it is far from being a cut and dried issue. “The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified.” 2 CFR § 200.79. Furthermore, “Non-PII can become PII whenever additional information is made publicly available, in any medium and from any source, that, when combined with other available information, could be used to identify an individual.” Id.

Why Should You Be Worried About Protecting PII?

Attorneys and their clients need to be concerned about protecting PII due a multitude of varying data privacy laws that vary from state to state and, depending on how your clients use data, could include a variety of international laws. These laws protect consumers by providing specific rules on how information can be collected, accessed, and distributed. Violations of these laws can result in heavy fines and sanctions.

United States Federal Law:

Although the United States has no comprehensive data privacy law (yet!), there are several laws/regulations that address these issues, along with regulatory agencies to oversee. These include:

  • The Federal Trade Commission and Trade Commission Act, which regulate consumer protections.
  • The Health Insurance Portability and Accounting Act (HIPAA), which governs health information.
  • The Fair Credit Reporting Act (FCRA), which regulates the use and collection of consumer credit information.
State Laws:

Because there is no comprehensive federal law, states have taken it upon themselves to enact their own privacy laws to protect consumers. Some of the most notable ones are the following:

  • The California Consumer Privacy Act (CCPA), which provides broad individual consumer rights and significant duties on companies or persons that collect personal information about or from a California resident.
  • The California Privacy Rights Act (CPRA), which expanded on the rights in the CCPA.
  • New York: The Stop Hacks and Improve Electronic Data Security (SHIELD) Act amended the existing New York law, adding stronger data breach protections for New York residents.

Here’s a helpful map of states that have already or are contemplating implementing privacy legislation, which can be found on the IAPP website here:[1]

 

International Laws:
  • The General Data Protection Regulation (“GDPR”), which applies to all European Union (“EU”) residents, and reaches any entity that accesses the information regardless of whether the entity is located in the EU. Failure to comply with the GDPR can result in potentially hefty fines — namely, up to 4% of a company's annual global revenues or 20 million euros ($22.8 million), whichever is the bigger amount.
  • Brazil's General Law for the Protection of Personal Data (“GPD”) is similar to the GDPR, with violations that can result in a fine such as 2% of their sales revenue, or up to $50 million Brazilian Real (approximately $12 million USD).

What Are The Best Litigation Strategies To Prevent Accidental Disclosures?

Although there is no singular approach that fits every litigation matter, employing these strategies with help limit accidental PII disclosure and violations of privacy laws:

  • Build a Data Privacy Map: this will help identify the scope of data at issue, its location, and types of data.
  • Targeted Collections: collecting too much data can cause a host of issues during discovery such as sweeping in unwanted PII. Targeting collections will limit the information and will lower the likelihood of this happening.
  • Protective Orders: common practice in litigation is for the parties to seek a protective order from the court when a case involves the handling of sensitive information. This will provide a framework and guidelines for counsel to follow. Be sure to include stipulations such as what constitutes a breach, and the scope of how that information is distributed outside of counsel.
  • E-Discovery Platform: it almost goes without saying these days that you are going to need a robust e-discovery platform in order to assist with the collection, processing, review, and production of the documents. During the review, having PII key search terms and formats (such as SSNs) highlighted will go a long way in ensuring document reviewers do not overlook PII. Some platforms can even proactively identify potential PII for you based on industry standards or human input.
  • Detailed Review Protocols: document reviewers should be given detailed review protocols with information on responsiveness, privilege, and confidentiality. It would be extremely helpful to have a section on PII which describes in detail how to identify it and whether the information should be withheld or redacted.
  • QC Protocols: secondary QC searches should be set up to provide another layer of protection from inadvertent PII disclosure.

While this was not an exhaustive list, it gives you planning and preparation strategies that will keep you ahead of the game. With the constant changes in data privacy laws and regulations, it can be tricky to be able to keep up the best approach to dealing with PII. Oftentimes, the responsibility falls on us to keep up with these laws and educate ourselves as to best approaches.

 

[1] The International Association of Privacy Professionals (IAPP) website is full of all sorts of helpful information, including the US State Privacy Legislation Tracker, which can be found here, and a Global Comprehensive Privacy Law Mapping Chart, which can be found here.

Topics: Data Privacy IAPP LitSmart KTLitSmart Best Practices E-Discovery Best Practices Sanctions PII Personally Identifiable Information GDPR General Data Protection Regulation

Subscribe to the E-Discovery Newsletter

Related Posts

  • Planting the Seeds of Accountability for Spoliation Sanctions

    When seeking sanctions for spoliated evidence, the nature of the evidence and your jurisdiction can play a pivotal role. Are you in state or federal court? Is the missing evidence electronically stored information or not? The same facts and circumstances could yield vastly different outcomes depending on the answers to those questions. It is important to recognize up front, at the start of your case, how your jurisdiction may impact discovery issues that could arise later down the road so that you can plan accordingly. In the case in this post, while the court did not ultimately affirm the imposition of an adverse jury instruction for spoliation of evidence, it did find a duty to preserve existed based not only on the parties’ contract, but on evidence the party in question had promised to preserve such evidence. By contrast, the insurers failed to demonstrate that same party owed them a duty to preserve. 

  • You’re Gonna Need A Bigger Boat: Data Management and E Discovery Strategy

    “You’re gonna need a bigger boat.” 

    This iconic line was uttered by Chief Brody in the 1975 blockbuster film Jaws when he first saw the massive size of the shark they were trying to catch. At that moment, Brody realized they were in completely over their heads, and the boat they had was not big enough to accomplish their task. While Quint’s Orca fishing boat and his traditional methods were capable of handling previous assignments, they were not going to be enough to take on the enormous shark they were chasing. 

    For better or worse, the digital environment we live in has resulted in an explosion in the number of documents and amount of information created and used by companies in their daily operations. A mid-sized company’s internal emails alone can run into the tens of thousands a day, and that is before factoring in reports, meeting minutes, studies, presentations, and other business documents. Adding in external emails and related attachments, you are looking at millions of documents a year. Because of this increased volume of data, companies dealing with potential litigation must adjust accordingly. 

    Like Brody, they need a bigger boat. An effective e-discovery strategy can provide companies with a bigger boat capable of handling even the most massive litigation matters.

Newest Posts

  • Planting the Seeds of Accountability for Spoliation Sanctions

    When seeking sanctions for spoliated evidence, the nature of the evidence and your jurisdiction can play a pivotal role. Are you in state or federal court? Is the missing evidence electronically stored information or not? The same facts and circumstances could yield vastly different outcomes depending on the answers to those questions. It is important to recognize up front, at the start of your case, how your jurisdiction may impact discovery issues that could arise later down the road so that you can plan accordingly. In the case in this post, while the court did not ultimately affirm the imposition of an adverse jury instruction for spoliation of evidence, it did find a duty to preserve existed based not only on the parties’ contract, but on evidence the party in question had promised to preserve such evidence. By contrast, the insurers failed to demonstrate that same party owed them a duty to preserve. 

  • You’re Gonna Need A Bigger Boat: Data Management and E Discovery Strategy

    “You’re gonna need a bigger boat.” 

    This iconic line was uttered by Chief Brody in the 1975 blockbuster film Jaws when he first saw the massive size of the shark they were trying to catch. At that moment, Brody realized they were in completely over their heads, and the boat they had was not big enough to accomplish their task. While Quint’s Orca fishing boat and his traditional methods were capable of handling previous assignments, they were not going to be enough to take on the enormous shark they were chasing. 

    For better or worse, the digital environment we live in has resulted in an explosion in the number of documents and amount of information created and used by companies in their daily operations. A mid-sized company’s internal emails alone can run into the tens of thousands a day, and that is before factoring in reports, meeting minutes, studies, presentations, and other business documents. Adding in external emails and related attachments, you are looking at millions of documents a year. Because of this increased volume of data, companies dealing with potential litigation must adjust accordingly. 

    Like Brody, they need a bigger boat. An effective e-discovery strategy can provide companies with a bigger boat capable of handling even the most massive litigation matters.

  • Now You See Me, Now You Don’t: Ephemeral Messaging Challenges

    The emergence of ephemeral messaging applications to communicate with friends, family, and coworkers quickly, securely, and effortlessly has boomed over the past decade. In that time, users of ephemeral messaging apps have risen significantly, from millions to billions of active users! Ephemeral messaging is an integral and evolving part of both individual and company communications with advantages and challenges impacting companies and the legal industry. Companies must consider the ramifications of their employees' use of ephemeral messaging and adopt policies and procedures to best protect themselves and comply with requirements relating to litigation and regulation. Courts have already begun addressing the failure to preserve relevant ephemeral messages and have been issuing sanctions in a myriad of legal challenges. Ephemeral messaging is here to stay, and companies, courts, and attorneys must understand and adapt to evolve with this emerging technology.