Document Retention - FOIA – FERPA September 13, 2006

1. Document Retention - FOIA – FERPASeptember 13, 2006 Carrick D. Craig Assoc. General Counsel carrick.craig@wmich.edu 387-1900

2. Document Retention, FOIA, and FERPA • Document Retention • Think of it as “data/information retention’ • Format of the ‘document’ is not important – electronic content is all the rage . . . and it is fair game • There is an excellent Record Retention Guide located on-line at: • http://www.obf.wmich.edu/business-services/docs/record_retention.pdf • Review the Guide as it applies to your area • It’s a guide – not every document is described • Ask us • Set an annual or semi annual compliance date • Document your compliance in some fashion (and retain it!) • Most common question, “Is it okay to scan the original into electronic form and then destroy the original?”

3. Document Retention Continued • There is no official university policy on this, so do not do it without supervisory approval • The law does not usually require original documents – so long as the copy can be authenticated as an exact duplicate • So, when you scan you must document the process used or else the subject document could be challenged • Check with a supervisor before scanning and shredding documents • NEVER destroy a document that should be retained according to the Record Retention Guide! • Much of what we have is electronic • We should strive to be able to preserve ‘snapshots’ of our regularly maintained electronic content • Electronic Catalog, for example • Before permanently altering an electronic page – preserve the page that is being modified • Electronic content may not be easy to truly destroy

4. FOIA • Michigan Freedom of Information Act • Statute that allows access to certain “public records” created by a “public body” • A “public record” is any writing (any means of retaining meaningful content, i.e. email, photos, electronic records) that is prepared, owned, used, in the possession of or retained by the public body – that is not otherwise exempt from disclosure • It does not necessarily have to be a document a University employee created • Numerous exemptions from disclosure: i.e. responses to RFP’s while the RFP is open, tests, software source code, clearly unwarranted invasion of privacy, social security numbers, documents generated that are preliminary to a final determination, trade secrets and proprietary information • Note: We cannot contractually limit our ability to comply with FOIA – we can promise confidentiality of IP, but not of material not exempt by FOIA – especially important in confidential disclosure agreements • Requests must be in writing – email is a “written request” – no magic words are needed • FOIA coordinator is Lowell P. Rinker, Assoc. V.P. for Business – If you receive a FOIA request immediately forward it to Lowell along with available records (emails, electronic files, etc.)

5. FOIA Continued • Response time: 5 Business days with 10 day extensions available in limited circumstances. • Lowell will coordinate with the OGC and the affected unit to decide a course of action in responding to the FOIA request • How does this impact Business Managers? • Remember that any record you create, whether by way of email, note taking, or other written document may be subject to disclosure under FOIA • Follow our record retention policy foundat: http://www.wmich.edu/vpbusfin/docs/record_retention.pdf

6. FOIA Continued • Is there a legal or business reason to retain a record? • Once a document is requested by way of FOIA we may not destroy it • FOIA brochure is available on-line at: http://www.wmich.edu/vpbusfin/docs/foi.pdf • Penalties: If records are improperly withheld, liability for attorney fees and damages may result • Miscellaneous: Charges for copying, Sufficient description; Confidential Research Information Act

7. FERPA • Family Educational Rights and Privacy Act • Federal statute that governs access to student educational records • Includes all student records except: employment, medical, personal notes that are not shared except with a substitute, and law enforcement records • Need consent of student to share, except in limited circumstances • Handled by Registrar’s office • Don’ts (without student consent): • Post grades by SS# or any part thereof • Discuss grades with others (parents, roommates, etc.) • Share assignment grades with class • Directory info may be released if the student has not opted out – Registrar will know this • Forbids redisclosure • Penalty – Denial of Federal Funds • 45 day time requirement • Link to the FERPA Brochure: http://www.wmich.edu/registrar/FERPA.html