Electronic Retention of Records and Best Practices

Electronic Retention of Records and Best Practices Jim Henderson, State Archivist Maine State Archives

Issue Areas • All Records • Media types • Functions • Functions: Paper v. Digital • Paper to Digital • Born Digital • Other Digital Issues

All Records - Media • Information Fixed Sequentially • Paper: unbound, bound; text, graphic (maps, plans) • Film: • microfilm/fiche, x-ray • motion picture, photographic • Analog tape: audio and video • Information Available Non-sequentially • Electronic • digital tape: audio, video, computer • digital disk: “floppy,” “hard” • Optical • CD: CD-R, CD+R, CD+RW, etc. • DVD: DVD-R, DVD+R, DVD+RW, etc.

All Records - Functions • Creation, updating, amending • Retrieval • Access • Confidentiality • Security • Theft, unauthorized access, unauthorized change • Preservation: fire, water, pests, deterioration • Retention for business • Disposition • Destroy • Permanent retention

Paper (Sequential) Linear process requires staff and public to follow certain sequences (fill out form, pay fee, go to next office, etc.) Multiple copies need be created Updates may require a new document Amendment may require complete rewriting of original document, or attachments Digital (Non-sequential) More flexibility, multiple reviews may be done on-line Fewer physical copies needed Updates may be made to existing document Amendments may be tracked on existing document Creating, Updating, Amending

Paper (Sequential) Linear process requires staff to file records in a specific, fixed order for retrieval Retrieval usually limited by the specific, fixed order Staff time must be diverted to retrieving records Staff must redact confidential information Access requires visit to office or copying and mailing Digital (Non-sequential) Filing may be in a logical, but changeable order Retrieval may be by multiple criteria - plan ahead Retrieval of digital copies does not need staff time Confidential information may be automatically redacted Access may be by Internet Retrieval, Access, Confidentiality

Retrieval Techniques • Automatically place the file location, name and date on the printed document, usually in the footer in small font • Search the file structure for the expected location • Run Windows “Find” and search by text in the file • File paper records and e-mail in a file structure that parallels the filing of computer records • Search using keywords entered in the file “properties” area

Paper (Sequential) Theft Single copies critical if lost Easier to protect contents of a single copy Integrity of Contents Easier to notice unauthorized changes Easier to protect access by locks Physical Damage Media relatively stable Susceptible to fire, water, environmental problems Digital (Non-sequential) Theft Duplicate copies easy for backup Duplicate copies easy for unauthorized access Integrity of Contents Unauthorized changes may not be obvious Access may be “hacked”; passwords may be used Physical Damage Media not as stable Danger of file damage Security

“Don’t automate -obliterate!” Consider not just automating the old paper process Rethink the whole process in light of new technology Permanent records Still must be kept forever Can you convert back to paper or simultaneously, microfilm - archival media? Several Registries of Deeds now do so. OR, are you able/willing to continuously migrate the digital version forever, keeping the records accessible to the public? Section 8 of Local Government Records Rules: “The local government agency must have a specific plan for an ongoing process of migrating long-term and permanent records stored on the system to newer hardware and software.” Paper to Digital - Issues 1

Retrieval In what sequence was the paper scanned? Why? Will indexes to the documents be made to allow non-sequential retrieval? What key works will you use? Public Access How will the public access the records now in digital form? Print, copy to disk or CD, have public terminal available? Same right-to-know provisions apply, including a right to a digital copy of the digital versions Local records rules require the ability to export in non-proprietary formats so people can use the digital copies Confidentiality - plan ahead Will you mask confidential information during the conversion? Will you create a confidential and non-confidential version? Paper to Digital - Issues 2

Same issues as converted text - just more complicated and expensive! Don’t automate a paper process - reengineer Permanent record must be kept forever, but the data cannot easily be converted to paper or microfilm and still be intelligible Special reports from the system should be designed at the beginning to insure archival needs are met. Convenient retrieval is usually designed into the system, but remember public access needs. As a public record, the public has a right to non-confidential data and records in a format the public can use in their computers. Born Digital - Issues

What happens when a staff member leaves “Where’s the PASSWORD!” Who “cleans out” the digital desk? Supervisor should insure records are retained Storage of data Just shelving a CD or DVD or floppy disks does not work All media degrades, especially in environments that are not temperature/humidity and air quality controlled. Electronic media is subject to magnetic and electrical disturbances Optical media delaminates and is susceptible to impurities in the air Periodic copying, transferring to other media needed. Migration from obsolete software to new, compatible software Other Digital Issues

Protecting Files • Restrict Access • Prevent Accidental Loss • Prevent Unauthorized Deletion

Restrict Access • Passwords You may wish to password protect certain critical records, especially confidential human resource (personnel) files. Be sure to record the password with a supervisor or other person authorized to access the records in case you are not available when they are needed! • Read only permission • Read and edit permission • Restricted Directories • Local space • Agency and public spaces

Prevent Accidental Loss • Versions After working on a long document, then substantially editing it, then finding out you made a great mistake, blood pressure rises! Consider saving large files with version numbers: myrept1.doc, myrpt2.doc, . . . . Since these are drafts, you can delete early versions when you are confident of your recent changes.

Prevent Accidental Loss (cont) • Backup • On-line Transfer copies of files to another directory on your work space. • Off-line Transfer to floppy disks, tapes or other media providing an added level of protection, critical where the only official copy resides on an active system. • Remote storage Store, and periodically rotate, critical files in a separate, secure building.

Prevent Unauthorized Deletion • While drafts are conveniently filed on the your work space (your local drive or your portion of a network), the final version should be placed in a separate file location that mirrors the file structure in your work space. • This “final version” space should have regular backup support and a degree (depending on the importance of the record) of security to prevent unauthorized or accidental changes.

Deleting for Efficiency • Retention of files beyond their scheduled life will clutter the system and delay the retrieval of desired records. The usual records management motives still apply: protection of privacy, reduction of legal liability, reduced system costs. • Deletion will be easier if the filing system is organized according to official retention periods and special written policies extending retention.

A filing system should allow easy • Filing and retrieval by the creator • Retrieval by authorized staff • Retrieval by or for public access • Protection from change or loss • Planned deletion • Retention or conversion

E-Mail Management & Retention For Local Governments Maine State Archives

What is e-mail? . . . just another form that records come in these days! • It is a document created or received on an electronic mail system including brief notes, more formal or substantive narrative documents, and any attachments, such as word processing and other electronic documents, which may be transmitted with the message.

Public Records • E-mail received or created in the course of business is an official public record. • It may or may not be a confidential record under Maine’s the Freedom of Access Act. • No public records may be destroyed unless authorized. Clear authorization and a practical management system are essential to insure proper disposition of e-mail.

Freedom of Access Act The Freedom of Access Act defines a public record as “any written, printed or graphic matter or any mechanical or electronic data compilation from which information can be obtained…that is in the possession or custody or an agency or public official of this State or any of its political subdivisions” with specific exceptions for confidentiality purposes [1 MRSA 402 (3)].

A Note About Public Records “Public” record does not imply that these records do not have confidentiality. Public record is a record that is government (ie: the people’s) property.

Other Records Some e-mail (personal messages, junk mail, publications, copies of notices unrelated to your duties) are not records and may be deleted at any time.

E-Mail Retention Requirements How long do I keep my e-mail?

Non-Permanent Retention Non-permanent retention is based completely on the record’s time-value to the business functions of the department or office, including audit or other statutory requirements, and reasonable access by interested parties.

Permanent Retention Permanent retention is based on the record’s value after it no longer serves the department or office business.

Senior Administrators Generally, senior administrators (Town/City Managers, department heads) have a greater proportion of permanently valuable e-mail, given its greater degree of policy content.

How long should I keep e-mail? Just as long as you would keep other mail! • The Rules for Disposition of Local Government Records establishes retention periods for correspondence, regardless of media.

Transitory Correspondence Schedule A, Item 25 a. letters of transmittal, requests for information, letters of application, of thanks, etc. Retain 1 year, then destroy. - - - - - E.g., e-mail and related attachments requesting an application for a building permit, which is then sent to the person requesting.

Substantive Correspondence Schedule A, Item 25 b. letters and memoranda documenting actions taken by the local government agency File with related record series - - - - - E.g., e-mail and related attachments (text or spreadsheets) containing expense reports (Schedule A, Item 30): retain for 6 years IF you are the official required to maintain these records. Other copies are for information only, and may be destroyed.

The Requirements The Importance of E-Mail

Why should you care? To make your life easier! • If you can delete unneeded e-mail with a clear conscience, you can more easily find what you’re looking for, especially if you have popped the keepers in convenient folders or mailboxes. • Organizing and managing e-mail (and other files) will save space, provide more efficient access, maintain confidentiality where needed.

Legal Implications • Organizing and managing e-mail will reduce legal exposure in "discovery" proceedings on records that properly should have been destroyed. • It also limits your own liability for deleting records you shouldn't, and gives you authority to delete those files you should delete.

It exists, but isn’t supposed to... IF IT EXISTS AND SOMEONE ASKS TO SEE IT, THE AGENCY HAS TO PRODUCE IT! So, if you have records that are requested in discovery proceedings that were supposed to have been destroyed, but weren’t, you must produce them...regardless of when they were supposed to have been destroyed.

When You or Your Employees Leave a Position When an employee leaves a position, computer files, including e-mail, may NOT be automatically deleted!

A word about “backups” • Not all e-mail systems provide automatic backup of your correspondence. • Those that do are not substitutes for the user's file management, since backups are destroyed periodically and they do not distinguish topics or retention periods.

Where to Begin? Gaining control of your electronic records

Where to begin…?Non-Record Materials Determine what in your e-mail are non-record materials; create special mailboxes for them; then delete them any time you want.

Where to begin…?Record Materials • Separate as much as possible by broad category, by topic and then by year. • Identify how long you should keep non-permanent records. When the retention period expires, simply delete the mailbox or folder containing the outdated records. • Identify how long you should keep permanent records before moving them from your mailbox to archival storage.

Non-Record MaterialsPersonal Correspondence • Personal Correspondence:Any e-mail not received or created in the course of state business, may be deleted immediately, since it is not an official record: the "Let’s do lunch" (not a State-business lunch) or "Can I catch a ride home" type of note.

Non-Record MaterialsNotices Not Maintained Notices with no business value after receipt and review, which are routinely discarded, are non-record material. These include the following: • incoming transmittal messages (like cover letters): "enclosed (attached) find copies of . . ." • internal office announcements: "Ms. Jones is here to see you, boss", "Joe Smith called, please call back", "Is this afternoon’s meeting still on?"

Non-Record MaterialsPublications & Similar Materials Publications, promotional material, and similar item that are "publicly available" to anyone, are not official records unless specifically incorporated into other official records. This includes listserve messages (other than those you post in your official capacity), "spam," files copied from Internet sites, etc. However, if you justify the purchase of a Zippo Filing System by incorporating the reviews you saved (from the File Manager Listserve) in your proposal to your boss, those listserve messages become official records and must be retained in accordance with the retention schedule for purchasing proposals.

Extended Retention • E-mail systems don't allow for retaining messages for extended periods or permanently. • Saving to an "archive" folder on your personal hard drive is not a very reliable, because hard drives crash, computers get moved by administrators, and e-mail upgrades/product changes can make retrieving old messages impossible even if they do still exist. • If an e-mail has an extended retention period or has permanent value, save the message as a text file, or print it.

Managing Your Electronic Records Mailboxes, folders and their contents

Functional Requirements for Recordkeeping Systems A good record keeping systems should: • Allow for grouping of related records, to insure their proper context. • Make records accessible to authorized staff, to insure their usefulness to the agency. • Preserve records for their authorized retention period, to insure availability for agency use, to preserve the rights of the government and citizens, and to allow agencies to be held accountable.

Filing Electronic Records Any electronic record (word processing document, spreadsheet, e-mail message, etc.) should, if it's "record material" that requires retention and filing, be stored in a properly named directory/subdirectory. Document names (this doesn't apply to e-mails, which are "named" by their subject lines, senders, etc.) should follow an agreed-upon convention; i.e., the agency should have a policy about how they are to be named.

Some Suggested Mail boxes... Here are some mailbox suggestions: • Personal e-mail (you can delete at will) • Non-record material (you can delete at will) • Transitory e-mail (delete after 1 year) • Permanent e-mail (delete only when permanent copy is made)

Notes about Series Records should be filed, retained and destroyed by series. Naming your directories or folders by series will enable you to more accurately comply with retention schedules.

Electronic Retention of Records and Best Practices