Virtually everyone is hoarding data they no longer need, and it?scosting employers significant sums of money and draining scarce resources tomaintain and expand electronic data storage. Yet, when hard drives and fileshares are analyzed, we find that 80 percent of these ostensibly ?active? filesand folders have not been accessed for three to five years. This results inunnecessary IT expenditures for infrastructure, disaster recovery, and datamigration as old servers and systems are retired.
Some organizations also have tens of thousands of backuptapes in storage, all of which are essentially useless, yet they are generatingstorage fees and excess costs if included in discovery for litigation.
Most of the costs associated with unnecessary data hoardingare hidden, out of sight and out of mind. One example of such hidden costs islost productivity when employees have to wade through unused and unwantedinformation to find what they need. Another example occurs when employees forgothe potential informational value of content management systems because thereis too much clutter to wade through.
While specific operational costs are appreciable, the mostvisible costs can be legal expenses. Even if a company had not been obligatedto keep unused data, if it still has that data when a legal matter arises and alegal hold is issued, there is an obligation to preserve and produce relevant or potentially relevant informationduring discovery in that litigation. In essence, the legal hold trumps thecompany?s right to dispose of information not needed for specific operationalor regulatory requirements.
This can be extraordinarily expensive: The discovery processoften involves having rooms full of attorneys examining records to determinetheir responsiveness to discovery requests or subpoenas and whether the recordsare confidential or privileged. Billing rates for all this work range from $60per hour for contract attorneys to between $300 and $400 per hour forassociates. Such legal review bills are often the largest single expense inlitigation and can quickly mount to hundreds of thousands of dollars.
Average costs for collecting, processing and reviewingelectronic data for legal matters can exceed $10,000 to $20,000 per gigabyte,depending on a number of factors. If thedata had been disposed of when eligible for disposition, before the legal matterarose, none of those costs would have been incurred.
In other words, managers can do more than complain about thehemorrhaging of corporate funds during litigation: Theycan proactively and appropriately dispose of unnecessarily hoarded data.
Companies are also increasingly feeling the sting of stateprivacy legislation that requires notification of state officials andimplicated state citizens if private information such as Social Securitynumbers or credit card numbers is breached or disclosed.
Massachusetts is at the forefront of this movement. BelmontBank in Massachusetts, for example, recently discovered that a backup tape hadbeen left on a table and disposed of by the cleaning crew. It appears the tapehad been incinerated and not actually disclosed to third parties, but the banknonetheless had to pay a $7,500 civil penalty.
Damages inindividual incidents involving the actual loss of credit card information haveexceeded $100 million, such as in the TJX credit card breach and the Heartlandpayment systems breach. And the reputational injury to a company can be evenmore damaging than the direct dollar damages, as few customers, employees orsuppliers want to be told their private information has been compromised.
To state theobvious, hackers and thieves can?t take what you don?t have. The bestprotection against a privacy breach is to dispose of data as soon as it is nolonger needed for business purposes or legal matters.