Managing a records retention and disposition program is one of the chronic challenges for any organization in the information age. Businesses and government agencies of all sizes are seeking to implement or improve these programs due to increased risk of cybercrime and data breaches, the complexities of complying with a variety of data privacy laws and regulations worldwide that dictate how long personally identifiable data can be retained, and the desire to reduce their data footprint in order to cut back on their storage expenses however possible.

The fact is, though, that records retention is a particular challenge for law firms because of the very nature of what they do and how they operate. I had the pleasure of presenting on this important topic at ILTACON 2019. My co-presenter was Charlene Wacenske, senior manager of records and information governance at Morrison & Foerster LLP.

Law firms have two main categories of records, both of which have disposition challenges: client representation records and firm administrative records.

Client Representation Records

First, there are client representation records — these are the files and data received or generated by the firm that constitute legal work product. Key considerations that govern how these records must be treated include applicable legal ethics rules, statutes of limitations that may need to be considered before deciding whether to preserve or dispose of files, and client service requirements that likely vary across practice areas.

A fundamental question in developing a retention program is how to classify client-matter related materials for retention purposes. These classifications may be specific based on the type of document or may be more broadly applied to the entire matter file based on matter type. We suggest that matter type is a more manageable option, in part because it requires less granular analysis on an ongoing basis and is easier to operationalize. Firms that elect to use matter type as the basis for their retention schedule determine retention periods based on the type of legal work being provided (e.g., litigation, regulatory advice, transactional) and apply a consistent retention period across all document types for the matters related to a given type of work.

This raises the crucial consideration of matter “closing hygiene” — when and whether firms close matters timely — which is a precursor to any disposition since the matter closing date is often the designated trigger that starts the retention period. A firm’s approach to matter closing can be quite varied. One session participant volunteered that her firm closes a matter if there are no client billings for one year, unless the responsible partner opts out of closing the matter. Many firms take a similar approach, although the length of time for inactivity varies.
Finally, do not forget the important step of client notification. As your program is developed, you can begin including notification in early correspondence with a client such as in retainer agreements on a go-forward basis, although you will also need a plan to provide notification to existing clients before disposing of legacy files.

Firm Administrative Records

The second category of records is law firm administrative records — these are the files and data associated with the business of the law firm itself. While client representation records have a distinct and well-adopted client / matter hierarchy, firm administrative records do not neatly fall into this schema. A method we have seen work well to manage administrative records is to create a “client” for each administrative department and then a “matter” for each core business activity performed by the department. This provides a mechanism to organize and apply retention rules in a consistent fashion across both client representation and firm administrative records. And having a common data schema can mitigate the tendency for administrative personnel to file and manage administrative records outside of firm-approved repositories, reducing the data footprint that must be governed by the program.

Issues to consider in developing a retention schedule for administrative records include any state and federal laws and regulations that govern handling or retention, as well as any privacy regulations, such as GDPR or state-based regulations, that are on the horizon or will go into effect soon.

Legacy Records

Begin with developing a retention and disposition program for current records. Once that is in place, you can focus on disposition of older, legacy records. Here is a five-step approach to implementing a records disposition program for those older records:

• Step one: data gathering. Conduct stakeholder interviews to define the data points for records characterization and assess the organization’s risk tolerance. Identify the level of metadata that is available, as well as the scope and content of the firm’s data repositories. Then collect information and metadata about the records, as is available.
• Step two: analysis. Review the collected data against classification opportunities (e.g., bulk classification against a retention schedule, risk tolerance thresholds approach, etc.). Then develop your business case for the program. This should include data storage savings, e-discovery cost avoidance, risk and exposure reductions, and other potential ROI.
• Step three: define disposition strategy. Document the process you plan to follow and secure the necessary approvals. Identify and allocate the resources to support the effort, socialize the disposition program components with the key stakeholders, and conduct a targeted exercise to illustrate an actual disposition in accordance with the newly defined program. The key is to start with something!
• Step four: records characterization. Divide the legacy backfile materials into groups for further evaluation and due diligence. Develop records characterization criteria based on the organization’s defined risk tolerance (e.g., date created, last accessed date, departed authors, etc.). Prioritize some “quick win” opportunities for the program so you can get off to a good start.
• Step five: execute. Identify records eligible for disposition, secure approvals per the newly defined process, determine the appropriate destruction method, prepare documentation for the disposed materials and then execute destruction of the identified records. Update your records management systems to notate the disposition activity, as appropriate, and complete the workflow by attaching a destruction certificate with the internal documentation.

Disposition vs. Knowledge Management

For those of us who work in or with law firms, there is an important tension that must be acknowledged. Law firms, with an objective to dispose legacy records must overcome the tension by some lawyers and practice groups who want to keep them “just in case,” because they often use legacy documents as a rich knowledge repository to create new work product. In some ways, these two goals are at cross purposes: records disposition seeks to identify, assess and eliminate data from the firm’s systems; knowledge management seeks to identify, assess and retain data from the same systems.

The lack of a mature knowledge management process can result in “over-retention” of client representation records, which exacerbates the records disposition challenge. The answer is to determine specific criteria for what constitutes value-added knowledge, so you can identify content worthy of being retained. These documents should be scrubbed of client/matter specifics to avoid conflict with the retention and disposition policy and filed into practice-specific designated workspaces that are not subject to routine disposition policies.

Conclusion

In the end, a records disposition program will only be successful if you are able to secure buy-in at the highest level of the firm. Sell the program internally by pointing your colleagues to the risk of data breaches and remind them that none of us want to be the next firm on the front page of the Wall Street Journal because dated client records were accessed when they should have otherwise been disposed. Define the real costs to maintain the constant growth of electronic storage if there is no end in sight to records retention.

Perhaps most of all, start with small steps, but get started somewhere and show some progress. Once lawyers realize they do not actually need access to all of those records from every matter, they will be more willing to let them go — and let you get on with the job of managing the firm’s records by applying a smarter approach to what you keep and what you delete.