What Happens When Data is Altered After a Preservation Notice?

Data Collection

The legal issues surrounding data preservation are important to know. Changing or destroying data after a legal hold constitutes spoliation of evidence, which would likely lead to severe legal penalties ranging from court-imposed sanctions to, in worst cases, criminal charges.

What Are the Potential Consequences of Altering Data Post-Notice?

You could experience very real consequences for altering data after a preservation notice. A judge may instruct the jury to assume that the destroyed or altered evidence was damaging to you. Monetary penalties are also a possibility. Beyond issuing evidentiary sanctions, the court may choose to dismiss the case or enter a default judgment against you. However, in cases involving federal investigations, altering documents can result in criminal charges, with potential prison sentences of up to 20 years. In addition, you may face severe damage to your reputation and credibility in the lawsuit.

What Actions Constitute Data Spoliation?

A preservation notice creates a legal obligation to preserve all relevant information, including electronically stored data. Companies that reasonably anticipate litigation should refrain from deleting emails or files or altering electronic records in any way. Failing to stop automated deletion systems, such as email retention policies or physical document destruction, would constitute data spoliation.

What To Do if You Discover Altered Data After a Preservation Notice

While the risks of altered data after a preservation notice are quite real, you could take several defensive steps, including immediately disabling automatic deletion or backup overwrites to stop the loss, before determining what was changed, when, and by whom. You could then re-establish a chain of custody for the remaining evidence.

Documenting all efforts to preserve evidence is crucial. Consider engaging digital forensics experts to show the nature of the alterations and your attempts to recover metadata or earlier versions. Always stay transparent and promptly notify the other party, even if it brings trouble, to show good faith. If these defense efforts fail, the consequences of spoliation could include court sanctions, adverse jury instructions, or dismissal of claims.

A Real World Case Study: Epic Games v. Google

In Epic Games v. Google, the court’s handling of Google’s auto-deleting chat program clearly demonstrates that altering or failing to suspend data destruction after a legal preservation notice is a really bad idea. Google’s policy was to automatically delete internal employee chats after 24 hours. When litigation began, the tech giant allowed employees to voluntarily turn off the auto-delete feature, rather than implementing a centralized, company-wide legal hold.

U.S. District Judge James Donato sanctioned Google in 2023 for falling “strikingly short” of its legal preservation duties. The judge ultimately issued orders granting jurors permission to assume the destroyed chat logs contained information unfavorable to Google, while ordering it to pay the Fortnite-creator’s attorneys’ fees. But that’s not all. Google’s top executives were heavily scrutinized by the court for defending the chat deletions. These arguments certainly damaged the company’s defense against underlying monopoly and antitrust claims.

How To Prevent Data Spoliation in the Future

Hanzo offers a wide range of services to prevent or remediate situations involving illegal data alteration following a litigation hold. Chronicle and Illuminate tools monitor data sources for changes, allowing legal teams to detect alterations or deletions in digital information after a hold has been placed.

Through our Illuminate platform, we can preserve data in place. It captures every message, file, edit, and deletion, allowing legal teams to see the original content and the subsequent changes instead of relying on potentially outdated snapshots. Because we keep data in its native environment and lock it down, the system is able to ignore routine retention policies to prevent further spoliation.

These solutions also maintain a clear, defensible chain of custody for all preserved content. This includes documentation of when someone altered or deleted data, which is essential for proving the integrity of the evidence in court. Our anomaly detection program leverages AI to scan vast datasets and highlight potential high-risk content or deviations, which would be flagged as unauthorized or suspicious changes to data.

Be Aware of the Consequences of Data Spoliation After a Preservation Notice

Understanding what happens when data is altered after a preservation notice is crucial in avoiding potential consequences. Your defense must prove good faith, technical incapacity, or that the alteration was not intentional due to a vague notice or routine loss of data despite your reasonable efforts to preserve it.

At Hanzo, we provide tools to identify, capture, and save both the original and modified data, maintaining a defensible chain of custody for legal proceedings. Our advanced, AI-based solutions focus on capturing in-place altered data for legal teams to review the conversation as it actually happened. Reach out to our nationwide office today to help your company avoid the risk of data spoliation.