Technology: Corporate governance meets information governance

May 17, 2013

business insights for law department leaders

technology

Technology: Corporate governance meets information governance

Implement integrated practices to support business efficiencies and enhance litigation and investigation response readiness. by John D. Martin and Renee S. Dankner

What practices can your company implement to facilitate efficient business processes and corporate oversight while also maximizing its ability to quickly and defensibly respond to discovery requests that extend to board information? As you assess current practices and perhaps consider ways to improve them, the following are some questions and tips to help navigate the intersection of corporate governance and information governance in the electronic age. How does your board receive information necessary to discharge its oversight duties? • Hard copy board books via postal mail or courier? • Email (sent to dedicated board email address or commingled with other email)? • Board portal e-book (internal or external)? • Tablet application? • Other? Regardless of the mechanism, board member data is potentially discoverable, particularly in cases where board member conduct is at issue or board members are key players. In addition and importantly, board information may be subject to applicable records and information governance requirements. E-books, board portals and mobile devices Business enterprises use technology to work faster, smarter and more cost effectively. The C-suite is no exception: Access, connectivity and rapid response time are all possible with

mobile device technology, laptops, tablets, wireless networks and more. Many directors are also current or retired business executives. They expect timely and ready access to information, and they want it delivered in a manner that helps facilitate executive decision making. • Multiple hats and information sources. Many directors serve multiple boards in addition to their day jobs. They may have fiduciary duties to and receive information from multiple organizations in connection with their oversight roles. Where does it all go? Do they carry multiple smartphones, laptops or tablets? Does board-related email go to their work email address or get commingled with their personal email accounts? If it goes to their work email, do their workplace policies provide for corporate access to company email accounts, and do that company’s records retention policies now apply to your board data? Do board members have segregated email accounts for each of the multiple hats they wear? Is information “pushed” or delivered versus “pulled” from a central source? • E-books and board portals. Increasingly, companies are moving toward electronic board materials. E-books and board portals offer solutions to help centralize the dissemination of and access to board information. Benefits touted by these solutions include: centralized and secure access to the most current information, Reprinted with permission from InsideCounsel

centralized document repository and retention features, ability to search prior board documents, ability to access board information anytime and anywhere, integrated email features, cost savings and information governance features. One size does not fit all, and these tools may not be the solution for every board. • Mobile devices, tablets and laptops. Electronic board materials offer efficiency but introduce complexity. What kinds of devices do board members use to view electronic board materials? Do they have the ability to download and annotate the materials? If materials are delivered via email, is the receiving device companyowned or a personal device, and how might that affect access to other information on that device and privacy with regard to personal information? Connect the dots—Corporate and information governance Hopefully, your company will never encounter a situation in which board member data is the subject of a discovery demand. Advance planning and preparation will help minimize burdens, business disruption and potential privacy concerns in the event board member data is in the crosshairs. Implement steps designed to facilitate good business practices and information governance, and to enhance readiness and the ability to defensibly respond to requests for board information if they arise.

May 17, 2013

Considerations include: • Implement information governance policies. Define types of board-related information subject to corporate information governance policies and review relevant policies to confirm requirements applicable to the board (including records retention, email, bring your own device (BYOD), company-issued mobile devices, preservation and legal hold, social media). Consider streamlining information governance requirements for the board by developing a specific board-level information governance policy. Benefits include aggregating various corporate information governance policies in a manner that is tailored to address applicable expectations and requirements. • Address BYOD concerns specifically. If board members may use personal devices in connection with their board service and a specific board-level information governance policy that addresses BYOD isn’t in place, consider user guidelines and device registration requirements. As part of any BYOD policy, communicate privacy considerations and inform board members that using their personal devices or computers for board service purposes could put their personal information at risk. Describe what may happen to personal information, including remote wipe or auto-lock.

• Discuss commingled information. Board members should understand that if they save or download board information to personal devices or systems or commingle Board email communications with personal or other business email accounts, such information or communications may come under scrutiny and be discoverable. Communicate privacy implications, and potential for exposure or loss of personal information in the event that imaging or remote wiping becomes necessary. • Institute policies for e-books and board portals. If your board uses these, consider encryption and security requirements. Set document retention and storage rules and integrate with litigation hold and document collection requirements. Determine what happens to deleted data and backup media. Identify email functionality, retention and features. In addition, set rules regarding the ability to download and annotate documents, and ensure that litigation holds, preservation and collection processes are designed to address electronically stored information if downloading or annotating documents is permitted. • Avoid storing unique information on personal devices or systems. Implement practices to centralize board information, and to design e-board books and board portals (if used) so that there is nothing Reprinted with permission from InsideCounsel

technology on an e-board book or device that is not on a centralized server. • Communicate, train, acknowledge and improve. Train board members on information governance expectations, risks and requirements; include a written acknowledgement as part of the overall strategy. Conduct periodic assessments to help ensure that information governance practices are keeping pace with governance and business processes, and adjust as necessary.

John D. Martin is a litigation partner at Nelson Mullins Riley & Scarborough LLP, and the practice leader for the Firm’s Encompass division, which provides information governance, litigation readiness and discovery services. John is a member of DRI (Defense Research Institute), and the Sedona Conference’s Working Group on Electronic Document Retention and Production. He can be reached at john. [email protected]. Renee S. Dankner is of counsel to Nelson Mullins Riley & Scarborough LLP, and head of client relations for Nelson Mullins Encompass. Her areas of focus include electronic information governance, ediscovery and business intelligence. She can be reached at [email protected].