Where Did the Data Go? Controlling Employee Data Amid the Great Resignation

In the age of remote working, employees’ ability to email on their phone, join a Zoom meeting from their laptop, and Slack from their iPad has created a breadcrumb trail of companies’ data scattered throughout employees’ personal and company-owned devices. And while that, in and of itself, has created data governance headaches for employers, it is becoming even more complex to manage amid the Great Resignation, when it comes time to retrieve data from departing employees.

At the “The Great Resignation’s Implications on Preservation, Collection, and Control of Employee Data” Friday session at the 19th annual Advanced eDiscovery Institute conference presented by Georgetown Law in Washington, D.C., speakers discussed some of the data governance challenges that the Great Resignation has created for employers and offered tips on how to keep track of “company” data amid expanding employees’ data privacy rights.

1.  Data Mapping

Although employers can’t predict when one of their employees will give their two-week notice, panelists argued that mapping data is one of the first steps companies should consider. “If you don’t have a data map, I would suggest you start to create one,” said Leeanne Mancari, e-discovery litigator and adviser and co-chair of DLA Piper’s e-discovery and information management platform.

She added that employers should have clear policies in place about “acceptable use” of devices, and should go over what types of information employees can exchange in certain applications, what chat apps are permissible, and whether there are any restrictions on certain apps. Similarly, employers should consider having a strong mobile-devices policy, whether it be guidelines around bring-your-own-device (BYOD) activities or a policy for company-owned devices.

Mancari said that data mapping should start almost instantaneously, as soon as an employee’s on-boarding. Having a checklist to rely on during exit interviews “is really important” and should include asking the employee where company data might be located. Mancari noted that a similar questionnaire should be used early in employees’ tenure, to ask how they work, what devices they usually rely on, and whether they have read and understood the company’s data and devices policies.

“Certainly, on the front end: What devices are there? How are they using them?” she said, adding that later on, legal departments can implement “periodical legal check-ins” to monitor how teams are communicating and working with each other.

Similarly, during on-boarding, employers should have a checklist of what devices employees are given and which devices they are given permission to use, said U.S. Magistrate Judge Karen Wells Roby of the Eastern District of Louisiana.

Panelists emphasized that it’s vital to ask the right questions during on-boarding, during employees’ time at the company, and during exit interviews. In fact, Roby noted that she too often deals with cases where employers failed to ask key questions to their employees, such as ‘Do you interchange the usage of the company laptop with your home devices?’

“What I tend to see is that people always interchange,” she noted, adding that employees often “don’t think anything is wrong about interchanging the uses of their devices.” She said that, in a majority of instances, “not only has the employee cross-populated work to personal, it’s the really good stuff that they cross-populated,” referring to critical company information.

2.  Memorialize, Memorialize

Tracking where the company’s data goes and on which devices it resides is key, Roby said, but memorializing steps taken to retrieve that data is just as important—especially if that data ever becomes relevant in litigation. “I’d like to know what steps [employers] took when they got the notice,” Roby said.

She added, “I really want to see the communications to get the hardware returned and the responses from the employee. I want to see whether there was any pre-employment agreement” that could demonstrate employees’ understanding of who the hardware and data ultimately belong to.

In fact, Mancari noted, memorializing becomes especially significant when clients run into preservation issues, as “that helps you on [Federal Rules of Civil Procedure Rule] 37(e) analysis.”

3.  Workflows and Trainings

That being said, for memorializing and questionnaires to be efficient, they need to be part of companies’ routine workflows, Mancari advised.

For example, legal teams should be involved in an employee’s exit interview or processes as early on as possible. “One of the key points is having a process in place whereby legal is informed that somebody has resigned,” she noted.

Ultimately, Roby suggested that companies should consider instituting periodical training on employees’ appropriate use of professional devices and on the legal obligations that employees may have once they leave.

“I don’t see why something of that sort can’t be designed and instituted corporately,” she said, noting that she rarely sees such training in place. She added, “Until you teach them that it’s wrong, it’s going to continue to happen.”

From: Legaltech News