The Missing Litigation Hold
You are the litigation support specialist for Delta Retail Group, the defendant in an employment class action filed on March 3. The complaint alleges that Delta's store managers routinely altered time records to avoid overtime pay from January 2020 through the present. Delta's IT policy automatically deletes employee emails after 90 days and overwrites backup tapes every 14 days. On February 10, Delta's HR director received an anonymous letter alleging the same time-record manipulation; she forwarded it to the general counsel, who opened an internal review but did not issue a litigation hold. On March 5, the general counsel asks you to "collect all relevant emails and time records" and to preserve what can still be saved. The company uses Microsoft 365, a legacy timekeeping system with no audit trail before 2022, and manager text messages on personal phones. Opposing counsel has demanded a preservation certification within seven days.
1. When did Delta's duty to preserve evidence arise, and what are the likely consequences of the delay? Identify the specific sources at risk.
Read the worked answer
The duty to preserve arises when litigation is reasonably anticipated, not when the complaint is served. The anonymous letter on February 10 alleging the same time-record manipulation, forwarded to the general counsel and followed by an internal review, made litigation reasonably foreseeable. The duty therefore attached on February 10, not March 3.
Between February 10 and March 5, the 90-day email auto-deletion continued and the 14-day backup overwrite continued. Those are the highest-risk sources: emails from custodians such as store managers, HR, payroll, and the general counsel; backup tapes that may have been overwritten on roughly February 24 and March 10; and the legacy timekeeping system, which has no audit trail before 2022. Under Federal Rule of Civil Procedure 37(e), if ESI is lost because of a failure to take reasonable steps to preserve, the court may order curative measures or, on a finding of intent to deprive, give an adverse-inference instruction or dismiss. Even negligent loss can support sanctions if prejudice is shown. I would immediately suspend auto-deletion, issue a written litigation hold, identify custodians, and preserve backups before the next overwrite.
2. Draft a collection plan for the relevant ESI, including the legacy timekeeping system and manager text messages on personal phones. Address proportionality, metadata, and chain of custody.
Read the worked answer
The plan should identify custodians (store managers, HR, payroll, IT, and the general counsel), a date range from January 2020 to the present, and search terms tied to time records, overtime, edits, and the anonymous letter. For Microsoft 365, I would place custodial and non-custodial holds, preserve the original mailbox format, and collect with metadata (sender, recipients, dates, hash values). For the legacy timekeeping system, I would obtain a forensic image or a system-generated export, plus database dictionaries and audit logs, because there is no pre-2022 audit trail. For personal phones, I would check the BYOD policy, send a preservation notice, and collect only relevant texts with consent or through available device management tools; if consent is refused, seek a court order. Proportionality under Rule 26(b)(1) matters: the class size, the cost of phone collection, and the likelihood that texts contain unique evidence should guide the scope. Every transfer should be logged with collector, date, method, and hash to establish chain of custody.
3. Opposing counsel demands a preservation certification within seven days. What should you advise the general counsel about signing or providing that certification?
Read the worked answer
I would advise that the company should not certify something it cannot support. Rule 26(g) requires a reasonable inquiry before signing a discovery response, and a false or incomplete certification can lead to sanctions. Seven days is tight but not impossible if preservation steps are begun immediately. The company can provide a declaration describing what has been done: issuance of the hold, suspension of auto-deletion, identification of custodians and sources, preservation of backups, and collection to date. It should also disclose known limitations, such as emails already deleted before the hold and the lack of a pre-2022 audit trail. It should not state that all evidence has been preserved if that is untrue. I would also recommend meeting and conferring with opposing counsel, requesting a short extension if needed, and preserving privilege. The certification should be accurate, signed by someone with knowledge, and supported by a documented process.