Regulatory investigations have become a staple feature of news headlines in recent years, ensnaring numerous companies from sectors as varied as financial services, car makers and even football. With the size of the penalties at stake and the volume of business data worldwide doubling every year [1], the prospect of such investigation can be alarming for in-house lawyers facing the challenge.

Increased Scrutiny

The stakes have never been higher and the task never more complex, as regulators worldwide intensify their scrutiny of companies’ internal data. In the EU, for example, the European Commission recently announced that it was widening the scope of data that it will search and seize in antitrust raids to include private devices, cloud services and personal data. The EU regulator will also cast its net wider and search a greater volume of data, examining, for example, whole email chains even if only one attachment is selected.

The consequence of this is that investigations, disclosure/discovery exercises, due diligence and compliance reviews today involve an enormous and ever-growing volume of documents and data. For companies, maintaining the necessary expertise and personnel in house for such periodic exercises makes little sense, while law firms are required, depending on the volume of data, to be able to scale-up their investigation teams quickly and in a cost-efficient way.

The Right Team

Critical factors, such as organizing and managing the review process, final decisions about which documents are relevant or privileged, and issues related to data protection and redaction can still only be appreciated and dealt with successfully by specialists. Moreover, document review exercises in Europe often involve documents in several languages and/or jurisdictions, making the involvement of multilingual document review teams indispensable. As a result, the success of a document review project depends heavily on the combination of the right team of reviewers with the right technology platform. Often, the task of putting these teams together is outsourced to specialist document review support firms.

When it comes to selecting the right team of document review lawyers, the expertise of the document review company is key. In contrast to traditional legal recruitment, selection should be driven by specialists who have hands-on experience in document review. The best companies will have access to a large pool of project lawyers, spread across various locations in Europe, who have experience in document review and who are experts in their subject matter. They will have robust selection processes for the recruitment of additional review lawyers in a timely fashion when the existing pool of lawyers cannot meet the requirements of a specific project. Furthermore, they will ensure that the lawyers selected work well together as a team.

Some document review companies can provide a complete managed review service, where the whole process from team selection to quality control and delivery of the relevant documents is fully managed by them. It is important that workflows are documented and defensible, as well as flexible enough to be customized according to the requirements of the project. Best practice involves the generation of a team brief that includes an overview of the case, the custodians and the legal issues involved, any technical terms and jargon, and most importantly, detailed instructions for the classification of documents. Once a review is up and running, quality control and regular reporting are vital to ensure consistency and accuracy, and to keep track of the review progress. Quality control procedures will vary depending on factors such as subject matter, case complexity and deadlines. The review manager will provide feedback on issues raised at quality control to the review team resulting in a better quality work product. Regular reporting, e.g. daily or weekly, ensures an open channel of communication between the review team and the supervising lawyers or client, which is essential, since close cooperation between all parties is vital for the success of the project.

The Right Tools: Platforms And Predictive Coding

Specialist document review firms offer support in this area by combining technological tools with a large, flexible pool of skilled document review lawyers. Most of them also will support the management of the review project if required, since there are some key considerations to take into account to ensure success.

Technological advances in big data processing and management have followed the dramatic increase in data volumes, enabling in-house lawyers and those in private practice to tackle these challenges. There are many different document review platforms on the market. Depending on the volume of data, the complexity of the case and the language(s) involved, some options may be more attractive than others. For example, some review platforms specialize in Korean, Japanese and Chinese languages, which might be a challenge for some other review platforms. Other review platforms are price competitive only when the review involves a large amount of data but not otherwise. In essence, they are all used to assist the review process in a similar way, by quickly and efficiently organizing and searching a vast volume of documents from a variety of sources. Traditionally, the aim has been to significantly reduce the amount of data that will actually be reviewed by a team of project lawyers.

Predictive coding, the use of advanced computer algorithms to identify whether certain groups of documents are likely to be relevant or not, is increasingly being promoted as a cost-efficient way to reduce the volume of documents that need to be reviewed by lawyers. English courts are warming to the use of predictive coding as a means to satisfy disclosure obligations at a reasonable cost [2].However, technological advances and computing power alone cannot guarantee success as other recent decisions by regulators and courts on both sides of the Atlantic reinforce the point that technology can only be part of the solution and needs always to be deployed thoughtfully [3].

The Right Location: The Challenge Of Data Privacy

A further complication is data privacy regulation. Data cannot be held just anywhere in the world and its transfer is heavily regulated according to where is originates. Hosting the data necessary to perform a review in the right way is therefore also central to the success of an investigation.

The primary considerations are the same, whether the review has been triggered by a regulatory or antitrust investigation, a litigation or arbitration case, or as a result of a compliance or due diligence exercise. Document review projects can take place on company premises, at a law firm’s office, or at specially hired document review rooms, usually managed by the document review provider. Data protection issues and convenience are key considerations when selecting the location of the review. For example, while a remote document review in an overseas review centre might appear as a cost-efficient choice, data protection concerns and the convenience of direct communication between the review team and the client are more important.

Following the revelations of widespread snooping by American intelligence services, European companies, individuals and authorities became more wary of allowing their data to be transferred to the United States and the so-called ‘Safe Harbour’ framework which facilitated such transfers was suspended. Since then, a period of uncertainty has prevailed.

Recently, the European Commission published legal texts underpinning a new EU-US data protection agreement that sets out the conditions according to which personal data on EU citizens can be held in computers on US soil.

The legal texts, which have yet to be adopted, include a reform of EU Data protection rules, which apply to all companies providing services in the EU; an 'Umbrella Agreement' regarding transatlantic data transfers for law enforcement purposes; and a replacement of the old Safe Harbour framework for commercial data transfers, known as the EU-US Privacy Shield. 

For the time being, it appears that keeping data local might be the best way to ensure compliance with data protection issues – at least in Europe. This in turn might have an impact on the availability of document review lawyer teams, especially if specific language or matter specialist combinations are required.

In summary, dealing with large amounts of data is a modern-day challenge that is expected to remain. While technological advances have lowered the threshold for tackling document review requests, choosing the right partners for data review and analysis is vital.