Legal Hold Versus Deletion Requests
Calder Health, a health insurer with 14 million members, has a seven-year retention schedule for claims records. A class-action lawsuit triggered a legal hold covering 2.3 million records. Separately, the privacy office receives about 120 deletion requests per month under state privacy laws. Customer service stewards have authority to approve deletions in the workflow tool; they approved 340 deletions last quarter on records subject to the hold because the tool did not flag the hold. Legal discovered the deletions during discovery and escalated to the chief data officer. The privacy officer argues that deletion requests must be honored within 45 days by law; legal argues that destroying held records is sanctionable. No documented decision rights exist between privacy, legal, and data stewardship. The CDO must issue interim guidance this week.
1. Recommend interim guidance for the 120 pending deletion requests. Explain how you would classify them and who should decide.
Read the worked answer
Interim guidance: pause all 120 pending deletions until each is screened against the legal hold. Classify into three buckets: (a) records within the 2.3 million held population-deny or defer deletion and document the legal basis; (b) records outside the hold but within retention-process under privacy law and retention schedule; (c) records eligible for deletion-approve. Decision rights: privacy owns the legal request and timeline; legal owns hold scope and release; a designated stewardship lead performs the hold screen. Do not let customer service stewards make the hold determination-they lack legal context and the tool did not flag it. Notify requesters of a short extension where law permits, with legal-approved language. Log every decision. The CDO should issue this as a temporary control, not a policy, and set a 30-day review.
2. Redesign decision rights among privacy, legal, and stewardship so this conflict is resolved before deletion, not after. Include the role of the workflow tool.
Read the worked answer
Redesign: privacy owns request intake, statutory timelines, and requester communication; legal owns hold issuance, scope, and release; data stewardship owns record identification and execution; IT owns tool enforcement. The workflow tool must check a hold flag before allowing deletion and must block approval when the flag is set, with an override requiring legal approval. Create a joint case-review forum for conflicts, chaired by the CDO, with a five-day SLA. Document a decision matrix: if a deletion request conflicts with a hold, legal's hold prevails until released; privacy records the exception and communicates delay as required. The steward's role is to execute and flag, not to adjudicate. Add hold-awareness training for customer service and remove deletion approval authority from staff who cannot see hold status.
3. Legal asks whether the 340 prior deletions must be reported. What governance factors drive that decision, and what should the CDO do now?
Read the worked answer
Governance factors: whether the 340 deletions were legally required to be reported, whether the records were actually within the hold's scope, whether the tool failure was a control deficiency, and whether the deletions were intentional or negligent. The CDO should immediately preserve logs, notify legal and privacy, and commission a scope analysis-not decide alone. If held records were destroyed, counsel decides disclosure obligations; the CDO provides facts. Separately, treat it as a control incident: root-cause the missing hold flag, assess whether other workflows have the same gap, and report to the audit committee. Do not discipline stewards before the control failure is understood; the setup says the tool did not flag the hold. Fix the control, document the remediation, and let legal determine reporting.