Introduction
Challenges of using eDiscovery for internal investigations
Advice for companies when using eDiscovery for internal investigations
Comment
Electronic discovery (eDiscovery) plays an important role in compliance investigations in China and is the method by which potentially crucial information is collected, stored, reviewed and disclosed. eDiscovery methods are often used in response to allegations of violations of anti-corruption laws – they enable an organisation to review its internal communications quickly and thoroughly to detect any malpractice.
Traditionally, a review of communications as part of a compliance investigation focuses on corporate emails and instant messaging platforms. Companies usually have ownership of such internal communications, and they are relatively easy to collect, since employees are not required to give consent.
As business communications through WeChat become more prevalent in China, it has become more difficult for companies to track, store and trace information when the occasion arises, and therefore for in house counsel to proceed with eDiscovery. This article sets out the challenges of using eDiscovery as part of internal compliance investigations and how companies can mitigate these challenges.
Challenges of using eDiscovery for internal investigations
Compliance investigations involve accessing and analysing employees' personal information. This information would typically include work emails and instant messages, which may inevitably contain personally identifiable information, such as one's national ID number, bank information and other data. This presents various challenges in light of China's data security laws, including:
- access to data on personal devices (rather than company databases);
- breaches of privacy; and
- consent in data collection.
Advice for companies when using eDiscovery for internal investigations
It is possible to successfully use eDiscovery in internal investigations if firms take the following cautionary steps.
Prior to starting investigations
Prior to starting an investigation, firms should ensure that:
- data is stored locally within China, as Chinese data security laws restrict certain data transfers out of China without prior approval by Chinese authorities;
- they follow the proper eDiscovery process to filter relevant data, enabling a review of WeChat messages; and
- a data security review is conducted by an accredited Chinese law firm.
During investigations
During an investigation, firms should ensure that:
- they engage with experienced forensic technology experts to collect relevant data. There are a few major reasons why independent experts are engaged in certain cases, including:
- defensibility – it is important to have assurances that tried and tested workflows are used during the collection of relevant data systems;
- collections – forensically sound tools and methodologies should be used for collecting WeChat data from devices or software applications to ensure data integrity; and
- cross-border investigations – where data resides on personal computers or devices in a remote office or overseas, local resources may be necessary to help with navigating logistics through cultural or linguistic capabilities;
- proper consent is obtained from data subjects and device owners (as opposed to the process of collecting corporate communications, which are owned by the company); and
- data is not exported without obtaining PRC legal advice and/or clearance by the relevant competent Chinese authorities.
Retaining communications from WeChat can be challenging for many companies, but it is not completely impossible to overcome. Businesses should follow the steps outlined in this article to ensure that their internal compliance investigation procedures are in line Chinese data security requirements.
For further information on this topic please contact Stephen Yu at AlixPartners by telephone (+8621 6171 7555) or email ([email protected]). The AlixPartners website can be accessed at www.alixpartners.com.