Legal Holds in Slack: Should You Collect Data to Preserve It or Preserve in Place?

| November 3 2021

A head-to-head match—and the winner is … 


Ediscovery can feel like a fight sometimes, with every choice feeling like a struggle: when do you initiate a legal hold? Which custodians are subject to that hold? What data do you need to preserve? Then there’s the question of how best to preserve relevant data. Should you preserve data in place or preserve it by collecting it and transferring it to an external storage repository? 


While the answer depends on your specific circumstances, here’s how the comparison might play out in a head-to-head match between collect to preserve (CTP) and preserve in place (PIP). 


Round 1: Availability


When it comes to Slack data, the question of how to preserve data had been a moot point as the only way to reliably and defensibly preserve data from Slack was to collect that data into an external repository. Recently, however, Slack enabled legal holds for Enterprise Grid customers that permit in-place preservation. When implemented, Slack Legal Hold suspends the retention policy for relevant Slack content, such that held data is exempted from that destruction schedule including subsequent edits and deletes.


But there’s a catch: Slack Legal Hold is only available to customers who pay for the top tier of Slack plans, Slack Enterprise Grid. For everyone else using Slack—from the free plan through the Business+ plan—the only way to defensibly preserve Slack data is to collect it. Depending on the license level, the organization can export message content in JSON format to collect-to-preserve.  


CTP:   10 , PIP:   9 .


Because PIP isn’t available to all Slack users, CTP wins this round. 


Round 2: Cost


As they say, more money, more problems—and in ediscovery, the more data you collect, the more money it’s going to cost you (which is a problem in itself). For every gigabyte of data entering the top of your ediscovery funnel due to overcollection, there is a cost associated with transferring that data to an external repository and safely storing it there over the life of the matter. You also have to incur the cost for each gigabyte of data you need to be processed, reviewed, analyzed, and ultimately produced. It adds up fast. 


With in-place preservation of Slack data, you don’t have to pay to transfer that data or store it anywhere—it’s securely locked down within the Slack infrastructure where it was created. If the matter resolves early, preserving data in place costs you zero dollars… once you’ve paid for an Enterprise Grid license, that is. 


CTP:   9 , PIP:   10 .


For reducing costs, this round goes to PIP, tying the match at 19–19. 

 

Listen to experts talk about Slack Legal Hold in this on-demand webinar. 

2021-10-webinar-Three-things-you-need-to-know-about-Slack’s-New-legal-hold-social (on-demand-1)

 

Watch the Webinar

 

 

Round 3: Risk of Data Spoliation


The very point of preservation is to ensure that data is safely held for later use including ediscovery. Data that isn’t adequately preserved is vulnerable to spoliation, the loss or damage of data so that it is no longer available to the parties. While in-place preservation is, for the most part, highly secure and reliable, there are a few asterisks on that statement. 


First, Slack’s in-place preservation doesn’t control data in shared channels. In a shared channel, Slack grants control over each message to the organization that created that message. Suppose that Organization A and Organization B share a channel where they discuss a project that is the subject of pending litigation. Organization B has set its Slack retention schedule for 30 days, while Organization A has—in recognition of its obligation to preserve data for litigation—implemented Slack Legal Hold to preserve its messages in that shared channel. After 30 days, Organization B’s messages disappear, leaving Organization A’s messages as a one-sided conversation. 


Nor does in-place preservation protect channels from outright deletion. If a Slack user who’s subject to a hold actively participates in a particular channel, that channel is exempt from the organization’s retention period so long as the hold is in effect. But should the channel itself be deleted by an administrator while the hold is pending, its message and file data will not be saved. 


By contrast, when you’ve collected data to preserve it, you know that data is locked down. It’s in a separate repository where no one can delete or modify it. 


CTP:   10 , PIP:   9 .


This round goes to CTP, which pulls ahead to 29–28. 


Round 4: Early Case Assessment Tools


When you preserve Slack data in place, it’s still in Slack. That’s the point, of course, but the result is that it's not easy to analyze, search or assess that data while it remains in Slack. Until you export—or collect—the data, you can’t begin early case assessment (ECA) to gain a deeper understanding of your potential litigation matter. 


On the other hand, once you collect data into a discovery repository, you create the opportunity for advanced searches and data analysis. In-depth ECA might give you the jump on pending litigation, providing valuable insight into whether you should settle or stick to your guns. 


CTP:   10 , PIP:   9 .


CTP wins another round, bringing the score to 39–37. So, is CTP going to win the day? Not so fast—the last round is a big one.


Round 5: Security Risks


When you preserve data directly in the program or app where it was created, as with Slack Legal Hold, you minimize the security risks inherent when transferring data to an external location. You also have fewer storage locations to secure and fewer opportunities for data breaches or security lapses. 


If you collect data to preserve it, there will always be a higher potential security risk. Every copy in every storage location can become a target for hackers meaning there is always an amplified risk of secure data being a target.  It goes without saying that every storage location needs to be secure, but with each, the risk of exposure can increase.


CTP:   8 , PIP:   10 .


This round goes to PIP by a 2-point margin, which means we end on a 47–47 tie.


Conclusion


There’s no clear winner when it comes to how you should preserve Slack data for ediscovery. Depending on your Slack license, you may not have the option of using Slack Legal Hold, in which case collecting to preserve wins by default as your only avenue to preserve data. You may be primarily interested in shared channels where you need to collect data to preserve both sides of the conversation. On the other hand, you may be concerned about limiting the cost of collection and data storage or avoiding the additional security risks associated with collecting data into a separate repository. The key is to understand and appreciate the pros and cons of both approaches so that you can make the right decision for your organization in each litigation matter.


Fortunately, our purpose-built Slack ediscovery tool, Hanzo Hold for Slack, makes Slack data preservation easy whichever way you decide to go. Hanzo Hold for Slack works seamlessly with Slack’s in-place preservation for Enterprise Grid customers, but it also allows companies with lower levels of Slack to collect data to preserve it. Hanzo Hold facilitates intelligent collection as well, allowing users to preserve broadly while narrowly focusing on the data necessary for collection. Hanzo Hold for Slack follows a “collect once, use many” protocol that only collects data once instead of creating multiple copies. And Hanzo ensures the highest standards for integrity and security of customer data, as demonstrated by its SOC 2 Type 2 certification, so you can rest easy that your data is secure. 


With Hanzo Hold for Slack, you can choose the best solution for data preservation, shielding information from loss, and minimizing potential security risks—not to mention the costs—associated with unnecessary collection. Hanzo Hold for Slack also enables sophisticated ECA techniques such as searches using keywords, custodians, channels, date ranges, or any combination of factors and gives users the option to view results in a list or individually in their surrounding context. Finally, Hanzo Hold for Slack creates targeted review-platform-ready exports that are clear and simple to read and review.


Ready To Learn More?

Contact Hanzo,  to learn more or see a demonstration.

Book a Demo

 

Related posts

Meet Team Hanzo: Julia Vitti, A Dynamo With A Thirst For Knowledge & A Helping Spirit

Meet Team Hanzo: Julia Vitti,...

This month I have the pleasure of introducing you to Julia Vitti, Hanzo’s newest account executive.  She's a veritable ...

Read More >
Webinar Recap: Three Things You Need to Know About Slack’s New Legal Hold

Webinar Recap: Three Things...

If your organization uses Slack for business communications, how are you preserving Slack data for potential ...

Read More >
Maintaining Data Security Through Slack Legal Hold: Minimizing Risks and Costs

Maintaining Data Security...

Managing data preservation for ediscovery requires walking on a knife’s edge. As soon as you can reasonably anticipate ...

Read More >

Get in Touch to Learn More

Hanzo’s purpose-built, best-in-class solutions can help your readiness to respond to the next discovery request, investigation, or audit. Contact us to learn more.

Contact Us