What are the challenges of over- and under-collection in Microsoft eDiscovery?
Microsoft Purview has evolved to become a powerful tool brimming with valuable eDiscovery capabilities. As its functionality has matured and expanded, however, so too has its complexity – a challenge compounded by the regular release of new features and functionality updates.
For specialist operators working with Purview on a daily basis, this is far from an insurmountable problem. The trouble is: most organisations don’t have eDiscovery requests rolling in every day. As a result, their inhouse Purview operators tend to shift focus to more immediate demands between cases, leaving their Purview skills to stagnate, requiring significant “catchup” when urgent eDiscovery requests come in.
This, together with a number of other external influences, can easily result in potentially dangerous over- or under-collection.
Let’s take a look.
What do we mean by “unskilled”?
First of all, let’s clarify what we mean when we say, “unskilled operator”.
It could be that the operator in question is very familiar with the use of Purview eDiscovery, but is less familiar with the domain in which the case takes place. IT professionals – the most common inhouse Purview operators – are seldom well-versed in HR or legal matters, for example. This can make it difficult for them to know the right questions to ask to avoid over- or under-collection.
Ideally, Purview eDiscovery should be a business, rather than IT, application. However, business operators are highly unlikely to have in-depth experience with Microsoft Purview tools. They may understand the case better, and know the right questions to ask, but that’s not the same as knowing which levers to pull and buttons to press to get all the answers. As a result, their eDiscovery efforts are often equally prone to over- and under-collection.
Neither business nor IT operators are likely to have the frequency of use to remain current on Microsoft Purview eDiscovery, either – particularly in light of Microsoft’s regular updates.
Our skills plus your technology could enable faster, more accurate eDiscovery and investigations using Microsoft 365. Find out more >>
Causes and effects of UNDER-collection in Microsoft eDiscovery
Operator skills aren’t the only causes of under-collection. We also see this happening extensively in cases where minimising review costs is a top priority. Operators often intentionally or unintentionally exclude content that may be important to the successful outcome of a case in the name of keeping data volumes low.
Under-collection can also occur accidentally when Purview (Standard) is used instead of Purview (Premium). The abbreviated functionality means larger documents are only partially indexed, encrypted content is not decrypted and image-only PDFs are not indexed at all. Collection of associated SharePoint/OneDrive content is also excluded, among several other “gaps” that can leave serious holes in the collection process.
Regardless of the cause, under-collection not only risks missing case-critical information, it also risks in incomplete disclosure – a serious problem if the counterparty already has (or knows about) content that you’ve overlooked. This casts your entire collection process into question – something that does not go down well with the courts.
Causes and effects of OVER-collection in Microsoft eDiscovery
Fear of under-collection, and its ramifications, can easily swing operators too far in the opposite direction, leading to over-collection “for safety’s sake”. That said, over-collection can also occur when operators aren’t well-enough versed in the solutions they’re using to filter content effectively during collection.
The result of overcollection is an unnecessarily large corpus of data for review. This not only inflates review costs, it can also delay progress long enough to miss important deadlines, resulting in fiscal or case penalties.
Potentially worse is the increased risk that comes with larger data volumes. The chance of accidentally disclosing confidential information or information that compromises your case grows larger with every byte of irrelevant data put under review.
How to find the right balance
So, how does one achieve the right balance during collection? The trick lies in having the right balance of expertise.
It’s only by combining up-to-date technical skills with domain-specific knowledge that one can ensure the right questions are asked, and the right switches are flipped, to collect no more and no less data than absolutely necessary.
That’s a difficult combination to maintain inhouse when eDiscovery is not your primary activity. It’s also the reason we developed our Salient Outsourced Purview eDiscovery service.
Let our multi-disciplinary team harness your Microsoft technology for you (whether that’s Purview Premium or even Purview Standard). We’ll ensure every ounce of potential is unlocked and avoid the critical pitfalls to set your case on the firmest possible footing from the very outset.
The challenges and pitfalls of eDiscovery in Microsoft 365
What does Microsoft Purview offer a legal team? How can the technology be used for eDiscovery activities and what sorts of challenges might you face?
Microsoft Purview eDiscovery is a powerful tool in the right hands. Our experts share the causes and effects of over- and under-collection that are symptomatic of reactive eDiscovery requests.
Encrypted data can create blind spots that, without expert knowledge, could go unnoticed during the search/collection/export of data during an eDiscovery case.
Email inboxes are a treasure trove of information. However, long term retention in email archives and preserving the relationships between emails, links, attachments can pose eDiscovery challenges.
Indexing is the process of producing a searchable catalogue of files, messages and other content in a set of electronic data. Understanding how indexing works in Microsoft 365 is vital for acccurate and complete eDiscovery.
Microsoft Purview’s eDiscovery tools can be directly affected by broader data governance and compliance issues. Our experts explore issues like data sovereignty and data residency in eDiscovery.
