The Impact of e-Discovery on the CIO : Recordkeeping Litigation Readiness Jean-Stéphen Piché Director General Government Records Branch Library and Archives Canada

Context E-Discovery Retrieving relevant information Litigation Readiness Ensuring that your key business activities are documented and linked to effective decision making, and accountability Business Risks Reducing risks to organizations and citizens in disposing of unnecessary records and keeping/preserving key evidentiary records

E-Discovery

Retrieving relevant information

Litigation Readiness

Ensuring that your key business activities are documented and linked to effective decision making, and accountability

Business Risks

Reducing risks to organizations and citizens in disposing of unnecessary records and keeping/preserving key evidentiary records

CIO Concerns for e-discovery Long term preservation of Information Resources of Business Value Security And Privacy Search and Retrieval Digital Preservation Email Management E-Records Management Business intelligence and analytical tools Web 2.0 Institutional Capacity and Readiness Departmental Recordkeeping Requirements

Information Resources and ESI textual records films sound recordings photographs documentary art graphics maps portable devices filing cabinets electronically stored information

Problematique Information not or poorly managed / disposed Risk of destroying key records by accident Risk of keeping too much information by fear of not destroying unnecessary records Risk of not being able to FIND the most relevant information

Information not or poorly managed / disposed

Risk of destroying key records by accident

Risk of keeping too much information by fear of not destroying unnecessary records

Risk of not being able to FIND the most relevant information

Recordkeeping Supports Litigation Readiness Establishes core-essential administrative and business coherence within government for: effective decision-making development of policy delivery of programs and services to Canadians legal evidence of action Effective Recordkeeping Provides ready access to the right records and evidence. Provides a rational disposal of unnecessary records. Improves productivity and increased efficiencies Satisfies accountability and stewardship requirements Mitigates business risks – protection under audit, investigation and litigation Leverages IT investments and rationalize costs

Establishes core-essential administrative and business coherence within government for:

effective decision-making

development of policy

delivery of programs and services to Canadians

legal evidence of action

Effective Recordkeeping

Provides ready access to the right records and evidence.

Provides a rational disposal of unnecessary records.

Improves productivity and increased efficiencies

Satisfies accountability and stewardship requirements

Mitigates business risks – protection under audit, investigation and litigation

Leverages IT investments and rationalize costs

RK Regime Context GC Policy Framework for Information Management and Information Technology Information Management Policy (2007) Recordkeeping Directive (in effect in March 2009) Output: Departmental Recordkeeping Requirement And other instruments

GC Policy Framework for Information Management and Information Technology

Information Management Policy (2007)

Recordkeeping Directive (in effect in March 2009)

Output: Departmental Recordkeeping Requirement

And other instruments

Benefits of an RK Regime Differentiates between the vast amounts of information created and focuses investments on information resources of business value to the institution Combines business process and business needs analysis with recordkeeping practice

Differentiates between the vast amounts of information created and focuses investments on information resources of business value to the institution

Combines business process and business needs analysis with recordkeeping practice

RK Directive Objective The objective of this directive is to establish departmental recordkeeping requirements that will help organizations create, acquire, develop, manage, and use information resources as a key business asset in line with performance, reporting and accountability requirements. The directive requires the establishment of a management structure for assessing the business value of records, addressing the information life cycle, and establishing recordkeeping as a core resource management function that helps organizations manage information. Expected Results Departments have confidence that their employees create, acquire, capture, develop, manage, and use information resources in accordance with departmental and Government-wide recordkeeping direction and policies. Departments create, acquire, capture, develop, manage, and use information resources as a business asset for decision-making and accountability purposes. Program and service activities are supported by readily accessible information resources which comprehensively documents the business activities.

Objective

The objective of this directive is to establish departmental recordkeeping requirements that will help organizations create, acquire, develop, manage, and use information resources as a key business asset in line with performance, reporting and accountability requirements.

The directive requires the establishment of a management structure for assessing the business value of records, addressing the information life cycle, and establishing recordkeeping as a core resource management function that helps organizations manage information.

Expected Results

Departments have confidence that their employees create, acquire, capture, develop, manage, and use information resources in accordance with departmental and Government-wide recordkeeping direction and policies.

Departments create, acquire, capture, develop, manage, and use information resources as a business asset for decision-making and accountability purposes. Program and service activities are supported by readily accessible information resources which comprehensively documents the business activities.

RK Directive (suite) The following requirements are to …assess the level of integration between recordkeeping and Information Management in terms of expected results over time, planning, implementation, and roles and responsibilities based on their unique circumstances: Establish department-wide conditions and infrastructure to support the recordkeeping needs of business units within the department. Establish and implement key mechanisms and tools to support the department’s recordkeeping requirements throughout the information life-cycle Delegating the authority to dispose of unnecessary records as per the delegation instrument issued under the Library and Archives Canada Act. Communicating and engaging departmental stakeholders on the progress, challenges, responsibilities, and risks associated with the development of recordkeeping in the department and within the GC.

The following requirements are to …assess the level of integration between recordkeeping and Information Management in terms of expected results over time, planning, implementation, and roles and responsibilities based on their unique circumstances:

Establish department-wide conditions and infrastructure to support the recordkeeping needs of business units within the department.

Establish and implement key mechanisms and tools to support the department’s recordkeeping requirements throughout the information life-cycle

Delegating the authority to dispose of unnecessary records as per the delegation instrument issued under the Library and Archives Canada Act.

Communicating and engaging departmental stakeholders on the progress, challenges, responsibilities, and risks associated with the development of recordkeeping in the department and within the GC.

Departmental Recordkeeping Requirements Develop and maintain a Departmental Recordkeeping Requirements document that aligns departmental information resource management with business activities to better address accountability, stewardship, performance measurement, reporting and legal requirements. This document includes: a business process analysis of the business functions and activities carried out by a department. documentation on the business functions and activities identified by the business process analysis.

Develop and maintain a Departmental Recordkeeping Requirements document that aligns departmental information resource management with business activities to better address accountability, stewardship, performance measurement, reporting and legal requirements. This document includes:

a business process analysis of the business functions and activities carried out by a department.

documentation on the business functions and activities identified by the business process analysis.

RK Regime triggers for enabling litigation readiness Can you identify these possible risks relating to legal or regulatory ramifications for conducting business, any risks related to information resource capture, and any legal advice received, concerning the parameters of information resources? Do you have Legal Risk Management or other Integrated Risk Management Function to identify and mitigate legal risks related to actual or reasonably anticipated litigation, investigation or audit? Have you implemented a Departmental Recordkeeping Requirement for program and service areas? Do you have signed Records Disposition Authorities, a current and enforced Retention and Disposition Schedules?

Can you identify these possible risks relating to legal or regulatory ramifications for conducting business, any risks related to information resource capture, and any legal advice received, concerning the parameters of information resources?

Do you have Legal Risk Management or other Integrated Risk Management Function to identify and mitigate legal risks related to actual or reasonably anticipated litigation, investigation or audit?

Have you implemented a Departmental Recordkeeping Requirement for program and service areas?

Do you have signed Records Disposition Authorities, a current and enforced Retention and Disposition Schedules?

RK Regime triggers for enabling litigation readiness (suite) Can you immediately and confidently implement a preservation order? Do you have accountable and auditable records destruction procedures? Can you identify, manage and dispose of information resources of business value to the degree of sufficient levels of materiality or granularity required to conduct business activity, complete transactions, achieve results, and measure or assess performance? Do you have a recordkeeping repository for your information resources of business value?

Can you immediately and confidently implement a preservation order?

Do you have accountable and auditable records destruction procedures?

Can you identify, manage and dispose of information resources of business value to the degree of sufficient levels of materiality or granularity required to conduct business activity, complete transactions, achieve results, and measure or assess performance?

Do you have a recordkeeping repository for your information resources of business value?

What is LAC specifically doing about it? Recordkeeping Directive Application Guide RK assessment tool Business and functional requirements for systems Legacy Strategy TDR

Recordkeeping Directive Application Guide

RK assessment tool

Business and functional requirements for systems

Legacy Strategy

TDR

Problematique Addressed The establishment of an institutional regulatory regime helps mitigate litigation risks for organization by: Limiting your information requirements to support to your key business activities Facilitate the disposition of unnecessary records Help define recordkeeping requirements for systems

The establishment of an institutional regulatory regime helps mitigate litigation risks for organization by:

Limiting your information requirements to support to your key business activities

Facilitate the disposition of unnecessary records

Help define recordkeeping requirements for systems

Appendix

What is a Document? LAC Act Any documentary material, other than a publication, regardless of medium or form. (Source: Library and Archives of Canada Act, 2004 c. 11, s. 2.) Documentary evidence “ Electronic document” means data that is recorded or stored on any medium in or by a computer system or other similar device and that can be read or perceived by a person or a computer system or other similar device. It includes a display, printout or other output of that data. (Source: Canada Evidence Act, R.S.C. 1985, c. C-5,s. 31.8) A record may comprise one or more documents (An act to establish a legal framework for information technology, R.S.Q. c. C-1.1). Professional definitions A record should correctly reflect what was communicated or decided or what action was taken. It should be able to support the needs of the business to which it relates and be used for accountability purposes. (Source: ISO 15489-1:2001) A record is recorded information produced or received in the initiation, conduct or completion of an institutional or individual activity and that comprises content, context and structure sufficient to provide evidence of the activity. (Source: International Council of Archives (ICA), “Guide for Managing Electronic Records”, p. 7) Record: A document made or received and set aside in the course of a practical activity as an instrument of a by-product of such activity and set aside for action or reference. (Source: L. Duranti, “Accountability in e-government: observations from InterPares2 case studies”, ICA, Kuala Lumpur, 2008)

LAC Act

Any documentary material, other than a publication, regardless of medium or form. (Source: Library and Archives of Canada Act, 2004 c. 11, s. 2.)

Documentary evidence

“ Electronic document” means data that is recorded or stored on any medium in or by a computer system or other similar device and that can be read or perceived by a person or a computer system or other similar device. It includes a display, printout or other output of that data. (Source: Canada Evidence Act, R.S.C. 1985, c. C-5,s. 31.8)

A record may comprise one or more documents (An act to establish a legal framework for information technology, R.S.Q. c. C-1.1).

Professional definitions

A record should correctly reflect what was communicated or decided or what action was taken. It should be able to support the needs of the business to which it relates and be used for accountability purposes. (Source: ISO 15489-1:2001)

A record is recorded information produced or received in the initiation, conduct or completion of an institutional or individual activity and that comprises content, context and structure sufficient to provide evidence of the activity. (Source: International Council of Archives (ICA), “Guide for Managing Electronic Records”, p. 7)

Record: A document made or received and set aside in the course of a practical activity as an instrument of a by-product of such activity and set aside for action or reference. (Source: L. Duranti, “Accountability in e-government: observations from InterPares2 case studies”, ICA, Kuala Lumpur, 2008)