Your company is embroiled in a lawsuit, and your general counsel has come to IT for help in conducting e-discovery on a batch of data. You easily gather some of the information from storage in your data center, but the rest of it is sitting in the cloud. Easy enough, you think, to get that data as well.
You may be in for a rude awakening.
Many lawyers and IT staffers "just assume if they put data in the cloud it's going to be at their fingertips, that it's inherently discoverable," says Barry Murphy, co-founder and principal analyst at eDJ Group, a consulting firm specializing in e-discovery. "That's not necessarily the case."
Under the Federal Rules of Civil Procedure, a party to litigation is expected to preserve and be able to produce electronically stored information that is in its "possession, custody or control." But in the cloud, the situation isn't so clear. Information that's electronically stored in the cloud is presumably under your control, but it may not technically be in your possession, says James M. Kunick, principal and chair of the intellectual property and technology practice at law firm Much Shelist.
Because this area is so new, the legal ramifications of storing data in the cloud are still murky. Among the few instances of relevant case law is Gordon Partners v. Blumenthal, which found that if a company has "access to documents to conduct business, [then] it has possession, custody and control of the documents for purpose of discovery," according to Murphy.
That finding could pose a significant problem. Depending upon the relationship it has with its cloud vendor, a company might not know exactly where its data is stored. And even if it does, it might not be able to access information in the cloud in the right format and in a timely manner.
And there is a danger that companies can lose control over access to that data -- opposing attorneys, for example, might subpoena not only your company, but also your cloud provider. "You need to make sure your contract with the provider allows you to control what happens if they get a subpoena," Kunick warns.
Know the Potential Problems
And yet most companies are blissfully unaware of the potential problems with e-discovery, says Murphy. In a recent survey of legal and IT professionals who use cloud services, Murphy found that less than 16% of 172 respondents had put an e-discovery plan in place before moving data to the cloud. Even more alarming, he says, nearly 60% of the respondents said that they didn't know whether they had an e-discovery plan or not.