Document Preservation and Litigation Holds in SEC Matters.

Federal preservation duties arise not upon the filing of a lawsuit, but when litigation is reasonably anticipated, which frequently occurs well in advance of any case being filed in court. In Zubulake v. UBS Warburg LLC (Zubulake V), 229 F.R.D. 422 (S.D.N.Y. 2004) highlighted the role of counsel in litigation-hold compliance:

The responsibility to initiate and to monitor the litigation hold rests with counsel, who “must oversee compliance with the litigation hold, monitoring the party’s efforts to retain and produce the relevant documents,” and who must “take affirmative steps to monitor compliance so that all sources of discoverable information are identified and searched.”

In all appropriate cases, management should document the litigation hold’s trigger, scope, custodians, and relevant exceptions, in addition to the decisions to release records or stop the hold.

SEC Matters: From Inquiries to Enforcement

As a matter of practical experience in SEC defense, we distinguish among informal inquiries, formal investigations, and enforcement proceedings. While this distinction is not essential for determining when (or whether) a litigation hold is needed, the nature of the SEC’s inquiry can significantly affect the nature and scope of the relevant information and the custodians’ duties of preservation.

The SEC Examination Process

Examinations of broker-dealers and other entities covered by the Securities Exchange Act of 1934 . .. will have varied outcomes. They can conclude without referral, though they can also result in referrals to the SEC’s Division of Enforcement.

Formal SEC investigations will proceed under the authority of a “formal order of investigation.” With that order, the SEC can subpoena witnesses to produce documents, submit written answers, and testify in investigational testimony, the same procedures that are available to a grand jury in a criminal matter.

What events trigger preservation before SEC enforcement begins?

What Events Trigger a Duty to Preserve Information?

In SEC matters, the trigger for information preservation is an objective determination of when litigation becomes reasonably foreseeable. By far, the largest portion of the information-preservation-trigger analysis will depend on the facts at hand, with internal evidence of potential liability (or violation of the Securities Exchange Act, etc.) capable of triggering a preservation obligation prior to any contact from the SEC.

Does an SEC Examination Signal Litigation Scrutiny?

An SEC examination will not, in and of itself, automatically establish that litigation is reasonably foreseeable; However, an organization will want to consider all relevant circumstances when determining whether preservation of its records is necessary.

How Can an SEC Subpoena Make Enforcement Proceedings Foreseeable?

Under the SEC’s examination processes described above, an examination can lead to a formal investigation with the issuance of a subpoena. At this point, enforcement proceedings will generally be reasonably foreseeable, and the organization’s duty to preserve will almost certainly have been triggered.

Is a Wells Notice a Trigger for Information Preservation?

Yes. When the SEC issues a Wells notice, the organization’s counsel has an opportunity to respond to the SEC before the Division of Enforcement makes recommendations for further action. By this point, at the latest, the SEC will have made it clear that it is considering further action, and it will be unreasonable for an organization to claim that enforcement proceedings are not reasonably foreseeable.

Do Known Whistleblower Allegations Trigger Preservation Duties?

In many cases, yes. When whistleblower allegations are known to an organization, and litigation is reasonably foreseeable, they can trigger information preservation obligations.

As Zubulake IV clarifies, the obligation to preserve information is triggered when litigation is reasonably foreseeable. While the definition of litigation is somewhat broad, this will typically include any potential case in which one or more parties have a reason to reasonably anticipate a legal dispute.

Are Committees (Audit, Special, etc.) Commissioning Internal Investigations Also Relevant?

Yes. Audit committees, special committees, and other types of committees may commission internal investigations when an organization is under SEC scrutiny (and when litigation or enforcement action is reasonably foreseeable).

These committees also have preservation obligations, and a failure to preserve can lead to significant risks. This applies, in turn, to preservation triggers arising outside the SEC context, and the trigger analysis is the same.

How Broad Should a Litigation Hold be in SEC Matters?

Event-driven preservation triggers may be broad enough that, at the very least, relevant records will exceed the organization’s ordinary regulatory retention periods. In this case, however, the legal hold must prevent scheduled destruction of information relevant to the trigger, regardless of any shorter routine retention periods.

If a legal hold is needed, then the scope of the legal hold will depend on the event (or events) that triggered the duty to preserve. As a general rule, the legal hold should:

• Identify the custodians, issues, date ranges, and systems that must be preserved;
• Identify the responsible individuals;
• Set out the manner in which custodians must preserve relevant information;
• Explain the need for prompt cooperation by all relevant employees;
• State the risk of penalties for failing to preserve (and for destroying) relevant information;
• Clearly identify the need for timely preservation in order to avoid unintended data loss; and
• Indicate the date the hold expires.

What Steps Are Necessary to Properly Implement a Legal Hold?

Once a legal hold is issued, the responsible individuals must ensure the legal hold is properly and promptly implemented. When implementing a legal hold, it is important to:

• Interview the affected custodians to identify all relevant sources of information. This includes but is not limited to computers, laptops, mobile devices, applications, aliases, and repositories.
• Conduct reasonable steps to preserve and safeguard information relevant to the litigation hold. However, it is important to remember that “reasonable steps” does not necessarily mean automatically collecting all information from all devices, applications, and other sources relevant to the litigation hold. In fact, if all that information is still being stored in situ, the information could simply be left in place, and its preservation can still be reasonably assured, unless there is a risk that such data could be lost before it is properly collected.

If the target entity is a public company, then all officers and directors will be subject to potential liability from enforcement proceedings, and the risk of an SEC investigation or SEC enforcement action is increased. Private companies, too, can become the subject of SEC investigations and enforcement actions. In this case, they must have sufficient measures in place to preserve relevant information.

Officers, directors, employees, auditors, third parties, and other witnesses may need individual legal representation. This applies to matters that have been filed by the SEC or DOJ (or another federal agency), as well as to matters that have not been filed but are reasonably foreseeable.

How do we preserve texts and collaboration platform data?

How do we preserve texts and other mobile-device content?

Relevant texts and encrypted messages must be preserved regardless of the platform they are on (e.g., iMessage, Signal, WhatsApp).

How do we preserve Slack data, MS Teams data, and other collaboration-platform data?

Relevant collaboration-platform threads, including all relevant edits, reactions, attachments, and metadata, will generally need to be preserved.

How do we preserve-relevant content from ephemeral-messaging platforms?

If a person is using an ephemeral-messaging platform with a default-expiration setting, and if this setting threatens relevant content that must be preserved, the setting will need to be suspended.

What about data stored on employees’ personal devices?

Relevant data stored on employees’ personal devices (which includes devices employees may use at work) will need to be preserved if the data is under the organization’s control, meaning the organization has the means to obtain and preserve the data. This includes, in turn, all relevant data that could have been stored on the employee’s personal computer, mobile device, tablet, and other device.

What about content stored on employees’ personal accounts?

Relevant content stored on employees’ personal email and storage accounts will generally need to be preserved as well, provided that the organization has legal control over this content (including content created or stored by the employee during the course of their work).

What about data stored on cloud storage services and other repositories that rely on automatic deletion?

When automatic deletion settings will potentially lead to the deletion of relevant information, such settings will need to be suspended. This applies to repositories like Dropbox, Google Drive, iCloud, and others.

Do we have to preserve social-media content?

Yes. Social-media content, such as on LinkedIn, will also need to be preserved when it is relevant to anticipated litigation.

What about texts and other mobile-device content stored on devices that employees own and use for work? (The “Off-Channel Communications” Question)

When employees own the devices they use for business, there is no doubt that recordkeeping duties apply. This is true in all the applicable cases under Rule 17a-4 and other rules. The question is whether any special steps are required in these circumstances for the purposes of preserving relevant content.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

What Makes a Litigation Hold Process Defensible?

A defensible litigation hold process is one which, (i) (a) occurs as promptly as possible after the trigger; (b) is broad enough to encompass relevant information that is at risk of loss or destruction; and, (ii) is well-documented in all appropriate respects.

For broker-dealers and other entities in the financial industry, specific additional steps are necessary for a defensible litigation hold. This includes, in turn:

Preservation of Third-Party Records

When preservation requires securing records held by a third party, (i) the terms of the contract with that third party must be reviewed to determine if the third party is permitted to provide the records; (ii) notice of a litigation hold should be sent to the third party; and, (iii) the organization must then seek confirmation that the third party has complied with the litigation hold.

Preservation of Relevant Records and the Issue of Redundancy

When preservation is required, it is essential to identify all relevant records, rather than exclusively relying on the most accessible records. In many cases, this will necessitate collecting redundant copies. Preserving multiple copies of the same record is not only permitted, but can be necessary to preserve a complete record and avoid data loss.

Drafting of the Litigation Hold

A well-drafted litigation hold should: (i) describe the subject matter of the litigation, investigation, or regulatory scrutiny at issue (to the extent practicable, and in all relevant respects); (ii) identify the relevant sources of information; (iii) clearly define the relevant timeframe; (iv) prohibit the deletion of, or alteration to, relevant records; (v) explicitly prohibit all forms of document destruction and disposal; (vi) forbid individuals from discussing the litigation hold with anyone else (except for members of the organization’s response team); (vii) express the need for prompt cooperation; and, (viii) explicitly forbid individuals from circumventing the litigation hold in any manner whatsoever.

Recipients of the Litigation Hold

The litigation hold should be sent to all affected individuals, custodians, and system owners, as well as any personnel responsible for controlling, storing, managing, or administering relevant records, in addition to any personnel who have access to relevant repositories.

Documentation of Hold Compliance

The system administrator responsible for the issuance of a litigation hold should:

• Retain copies of all acknowledgments from the recipients of the hold.
• Keep a log of those who have not yet responded.
• Set aside time for follow-up notices.
• Issue follow-up reminders to all affected custodians at appropriate intervals.
• When possible, conduct periodic “compliance interviews” to document each custodian’s adherence to the litigation hold.

Departure of Custodians

The termination of employees who are subject to a litigation hold may complicate preservation efforts. In these cases, review of their files, device wiping, and account closures should all be held until the company’s counsel determines that no relevant information remains.

Device Replacements

Similar to employee departures, the replacement of personal devices, and the re-imaging of laptops and computers, require caution. Before a device is wiped or discarded, any held data must be preserved.

Privilege and Litigation Holds

When addressing a litigation hold, the attorney-client privilege may protect the communications sent by counsel to individuals within the organization. However, while privilege can protect the communication of legal advice, it cannot protect the underlying facts or figures that serve as the subject of the communications.

How Do Cross-Border and Parallel Proceedings Affect Preservation Efforts?

When relevant information resides abroad, including data in a jurisdiction where an employee resides or works, then cross-border preservation and collection will need to be addressed.

In particular, when relevant information includes personal data of data subjects in the European Economic Area (EEA), then relevant GDPR considerations apply, including:

• Article 5: The GDPR imposes principles of “data minimization” and “storage limitation” that must be balanced against the need for preservation under the litigation hold.
• Chapter V: The GDPR governs all transfers of personal data, including preserved data, outside the EEA.

What Other Cross-Border Considerations Apply to Preservation?

Beyond GDPR, any foreign blocking, labor, localization, or other privacy laws and regulations that would restrict the collection and transfer of information will also need to be addressed.

When parallel proceedings, inquiries, or investigations present themselves, the scope of any litigation hold must be sufficiently broad to encompass all evidence relevant to each proceeding. Generally, this means that each parallel matter will add (rather than restrict) to the scope of preservation.

How Long Do Litigation Holds Last in Parallel Proceedings?

As a general rule, parallel proceedings will necessitate continuing preservation so long as it remains reasonably foreseeable that related proceedings will follow. Again, while it may be possible to issue a limited release for some evidence, and perhaps some records, individuals should not release any litigation holds unilaterally. The release of a litigation hold should only be handled by authorized legal personnel and should be clearly documented in writing.

How Many Regulatory and Civil Matters Can be at Play at Once?

It is not uncommon for the SEC and the U.S. Department of Justice (DOJ) to simultaneously conduct parallel civil and criminal proceedings against the same target (or the same transaction). While the DOJ’s investigation will be sealed for a period of time, this will prevent any apparent intersection with the SEC’s investigation; but, again, this is not uncommon.

In parallel cases, the SEC will often work with the CFTC, FINRA, PCAOB, or State Attorney General’s Office. This also means that individuals and entities must have a strong grasp of how multiple government-led inquiries are proceeding (and how these inquiries intersect).

In fact, with increasing coordination between the SEC and DOJ, many civil investigations will turn into criminal prosecutions, and many criminal proceedings will turn into administrative or civil cases (as a result of a plea deal or other similar circumstances).

What Happens If Relevant ESI is Lost?

As a general rule, federal litigation presumes that the parties will have full access to the relevant information that exists. However, in federal civil litigation, where failure to preserve leads to spoliation of electronically stored information (ESI), the presiding judge will turn to Federal Rule of Civil Procedure 37(e), which states:

If the electronically stored information is lost or destroyed and cannot be restored or replaced through additional discovery, then:

(1) If the court finds prejudice, the court can take all reasonable steps to cure the effect of the spoliation.

(2) If the court finds “intent to deprive” another party of the information, the court may order sanctions, including, but not limited to:

• Adverse-inference instructions
• Dismissal or default judgment

As a general rule, this refers to scenarios in which information was intentionally destroyed, edited, or deleted. The “intent” that triggers Rule 37(e)(2) has been the subject of debate in federal courts, though, in most cases, this has been construed to prohibit spoliation with the intent to impede discovery or hide evidence.

Regardless of the specific issue (civil vs. criminal, internal vs. external), and regardless of the specific federal rule involved, spoliation of relevant information is a serious matter that should be handled promptly.

Does U.S.C. § 1519 Apply in SEC Matters?

U.S.C. § 1519 prohibits the destruction or fabrication of any records in order to impede, obstruct, or influence any actual or anticipated federal investigation, including those within the SEC. This includes all types of records, not just electronically stored ones.

From a practical standpoint, this means that when facing SEC scrutiny, there is little room for error. Any deviation from the litigation hold requirements must be assessed quickly, and if a material breach occurs, it should be addressed immediately, preferably as a matter of urgency.

What Measures Are Necessary to Recover Lost ESI?

When necessary, reasonable efforts to recover lost ESI should include searching for the relevant records with other custodians, recipients, and on servers, backup tapes, and other archived repositories. This includes requests sent to vendors and other third parties that may have similar records.

Do Organizations Have to Document All Failures to Preserve?

Yes. Any failure to preserve relevant information should be documented, with clear explanation of the causes involved, all affected sources, and all steps taken toward remediation.

What is the Role of Audit and Special Committees in this Context?

If a material failure to preserve results in the inability to produce records in a pending SEC inquiry, then the organization must assess the risks involved. If a substantial risk exists, the failure should be escalated, in writing, to the company’s audit or special committee.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm's attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.