An AI-Driven Privacy-Preserving Framework for Automated Legal Hold, Data Preservation, and Enterprise Data Compliance
TL;DR
The proposed methodology enhances the existing methodology with a Privacy-Aware Legal Hold Intelligence algorithm that consists of concepts from transformer-based semantic classification, named-entity recognition, risk-aware policy reasoning, federated learning, and differential privacy.
Abstract
Identifying, preserving and governing electronically stored information (ESI) is a huge challenge for enterprise organizations in terms of legal-hold requirements, privacy regulations and data retention requirements. Compliance mechanisms currently in place are mostly based on manual review and pre-defined rules which delay preservation, lack consistency in legal relevance assessment, cause privacy exposure and raise overhead to the operations. The purpose of this research is to create an AI-based privacy preserving approach to automated legal hold, intelligent data preservation and enterprise compliance management. The proposed methodology enhances the existing methodology with a Privacy-Aware Legal Hold Intelligence (PALHI) algorithm that consists of concepts from transformer-based semantic classification, named-entity recognition, risk-aware policy reasoning, federated learning, and differential privacy. PALHI can be used to identify records that are relevant to litigation, to flag sensitive data, to prioritize records for preservation and to ensure the policy matches the context of the data. Experimental results show that performance, measured by the accuracy, precision, recall, F1-score and legal-hold detection rate, on a benchmark enterprise email and document corpus is 92.40%, 91.86%, 91.32%, 91.59% and 93.18%, respectively, with only 6.42% of false preservation decisions. The accuracy loss due to differential privacy (DP) at the level of ε=1.0 is only 2.16%. The novelty of the framework is that it is able to fuse together the concepts of relevance detection, distributed privacy preservation, and automated compliance reasoning at the same time, and do so in an intelligent manner. It provides an auditable, scalable way that decreases the compliance effort needed to do it manually and increases the reliability of preservation, confidentiality and responsiveness to regulatory requests.