Using E-Discovery to Investigate Employee Policy Breaches

Organisations frequently encounter situations requiring investigations into suspected employee policy breaches. These can range from misuse of company resources to more serious allegations of fraud, harassment, or breaches of regulatory compliance. In the modern workplace, a significant proportion of evidence relating to such breaches exists in electronic format. This includes emails, instant messages, documents, cloud storage, and activity logs from various systems.

Leveraging e-discovery methodologies for these internal investigations ensures that evidence is identified, preserved, collected, processed, reviewed, and analysed in a forensically sound and legally compliant manner. This approach mitigates risks associated with spoliation of evidence, privacy infringements, and inadequate investigation, providing a robust foundation for disciplinary action, regulatory reporting, or litigation.

The Importance of a Structured Approach

An unstructured or ad hoc approach to gathering electronic evidence for an internal investigation carries significant risks. Improper handling can lead to the accidental alteration or destruction of evidence, rendering it inadmissible or unreliable. Furthermore, failing to adhere to data protection principles, such as those set out in UK GDPR, can result in regulatory penalties and reputational damage. A structured e-discovery approach ensures proportionality, defensibility, and compliance.

This systematic method is particularly critical when dealing with sensitive personal data, company confidential information, or when the investigation may lead to external scrutiny from regulators like the CMA, FCA, or SFO, or to civil litigation. Adopting a forensic approach from the outset safeguards the integrity of the investigation process and its findings.

Integrating Investigations with the E-Discovery Workflow

The standard e-discovery workflow provides a robust framework for managing internal investigations into employee policy breaches. Each stage must be adapted to the specific context of an internal inquiry:

• Identification: This initial stage involves understanding the scope of the alleged breach and identifying potential sources of electronically stored information (ESI). This includes identifying custodians, relevant systems (e.g., email servers, collaboration platforms, personal devices used for work), and specific data types. Interviews with relevant parties and IT personnel are crucial here.
• Preservation: Once ESI sources are identified, a legal hold or preservation notice must be issued to relevant custodians. This prevents alteration or deletion of data. For electronic systems, this involves placing IT systems and data under a technical hold, often by taking forensic images of hard drives or preserving mailboxes and cloud accounts in place. Adherence to ACPO principles (now superseded by the National Police Chiefs' Council (NPCC) Digital Evidence Guidance) or equivalent forensic best practices is paramount to maintain the integrity of evidence.
• Collection: ESI must be collected forensically, meaning in a way that ensures authenticity and integrity. This often involves imaging entire hard drives, collecting specific files, or exporting data from enterprise systems (e.g., HR, CRM, ERP, messaging platforms) using forensically sound tools. Chain of custody documentation is essential.
• Processing: Collected ESI is then processed to make it reviewable. This involves extracting text, applying de-duplication, filtering by date or keyword, and normalising data formats. For internal investigations, particular attention may be paid to metadata to establish timelines and user activity.
• Review: The processed data is reviewed for relevance to the policy breach. This can involve keyword searching, concept searching, and technology assisted review (TAR) for larger datasets. The review team must be alert to privileged information or data outside the scope of the investigation. Redaction for privacy or privilege is a key part of this stage.
• Analysis: Beyond simple review, analysis involves connecting disparate pieces of evidence to build a narrative of events. This might include timeline creation, communications analysis, and identifying patterns of behaviour. Expert forensic analysis may be required for complex technical issues.
• Reporting and Action: The findings are compiled into an investigation report, which may inform disciplinary action, regulatory notification, or other remedial measures. If disclosure to external parties (e.g., regulators, opposing counsel) becomes necessary, the data prepared through this workflow can be produced in accordance with CPR Part 31 or PD 57AD.

Practical Steps for Investigating a Policy Breach

A methodical approach to employee policy breach investigations using e-discovery principles involves several critical steps:

1. Initial Assessment and Planning: Clearly define the scope of the investigation, identify the policy breached, and list potential custodians and data sources. Develop an investigation plan outlining timelines, resources, and communication protocols.
2. Legal and HR Consultation: Engage with legal counsel (internal or external) and HR representatives early. Discuss legal obligations, data protection concerns (e.g., UK GDPR Article 5 principles, lawful basis for processing), and internal HR policies regarding investigations and disciplinary actions.
3. Implement Legal Hold: Immediately issue a preservation notice to all relevant custodians. Ensure IT systems are configured to prevent data destruction.
4. Forensic Data Collection: Work with forensic experts to collect data from identified sources. Prioritise non-intrusive collection methods where possible, but be prepared for full forensic imaging if required. Document the chain of custody meticulously.
5. Early Case Assessment (ECA): Utilise ECA tools and techniques to quickly filter and prioritise data. This helps to identify key evidence early and refine the investigation strategy, saving time and cost.
6. Review and Analysis Platform Setup: Deploy an e-discovery review platform capable of handling the volume and complexity of the collected data. Ensure robust keyword searching, filtering, and annotation capabilities.
7. Targeted Review: Conduct a focused review of the relevant data. Implement review protocols that address privilege, relevance, and any privacy concerns. Document all decisions made during the review process.
8. Interview Preparation and Execution: Use the evidence gathered to prepare for interviews with custodians or witnesses. Conduct interviews in a structured manner, documenting responses thoroughly.
9. Reporting and Recommendations: Synthesise findings into a comprehensive report. Provide clear conclusions and recommendations for next steps, which may include disciplinary action, training, policy amendments, or regulatory reporting.
10. Data Retention and Destruction: Once the investigation is concluded and any related proceedings are finalised, ensure that data is retained only for as long as necessary, in compliance with UK GDPR and internal retention policies, before secure deletion.

Data Protection and Employee Privacy Considerations

Investigating employee policy breaches involves processing personal data, which brings with it significant obligations under the UK GDPR. Organisations must ensure they have a lawful basis for processing this data, typically legitimate interests, and that processing is necessary and proportionate.

Key considerations include:

• Transparency: Employees should generally be aware of monitoring policies and how their data might be used in investigations. This is often covered in employment contracts and staff handbooks.
• Proportionality: The scope of data collection and review must be proportionate to the alleged breach. Overly broad collection, especially of personal communications, can be unlawful.
• Necessity: Data processing must be strictly necessary for the purpose of the investigation. Organisations should collect no more data than is required.
• Data Minimisation: Processed data should be minimised to what is directly relevant to the investigation.
• Security: All collected and reviewed data must be held securely, with access restricted to authorised personnel.
• Individual Rights: Employees retain rights under UK GDPR, including the right to be informed and, in some cases, the right of access. These rights must be balanced against the need to conduct a thorough investigation.

Careful consideration of these privacy aspects, often in consultation with data protection officers or legal counsel, is vital to avoid challenges to the investigation's legitimacy and potential regulatory enforcement actions.

The Role of Digital Forensics

For more serious or complex policy breaches, particularly those involving allegations of fraud, data exfiltration, or intellectual property theft, digital forensics expertise becomes indispensable. Digital forensics specialists can recover deleted data, analyse system logs for evidence of tampering, reconstruct timelines of activity, and attribute actions to specific users, even when attempts have been made to conceal them.

Their expertise extends to mobile device forensics, cloud data forensics, and network forensics, enabling the collection and analysis of evidence from a wider range of sources than typical document review. The forensically sound methodologies employed by these experts provide a higher degree of assurance regarding the integrity and authenticity of electronic evidence, which is crucial if the investigation results in litigation or regulatory engagement.

Conclusion

The application of e-discovery principles to employee policy breach investigations provides a structured, defensible, and legally compliant framework. By integrating the core e-discovery workflow with an understanding of UK legal and regulatory requirements, organisations can conduct thorough investigations that withstand scrutiny. This systematic approach not only facilitates effective fact-finding but also protects the organisation from risks associated with improper data handling and privacy breaches.