The Evolution of Paperless Government: The Legal Framework

1. The Evolution of Paperless Government: The Legal Framework Massachusetts Digital Government Summit September 24, 2004

2. The Law Pertaining to Electronic Records Management in MA • How Long Must State Agencies’ Electronic Records Be Kept? • What are the Rules Governing State Agencies’ Creation and Management of Electronic Records? • E-SIGN • MUETA • Pending Legislation

3. How Long Must State Agencies’ Electronic Records be Kept?

4. Records Conservation Board, Mass. Gen. L. ch. 30, s. 42. RCB sets standards for retention and destruction of records RCB issued “Records in Common” (RIC) Schedule in early 1990s. Prior RIC Email treated as transient record to be disposed of when no longer needed; rule based on media, not content Silent on “new” generation of electronic records Old Records in Common Schedule (prior to April, 2004)

5. April, 2004 • RCB adopts new Records in Common Schedule 04/04 (RIC 04/04) • Replaces all special, general and department wide records schedules (except for Comptrollers Statewide Schedules MMARS 2/99, PMIS 3/99, PCRS 4/99 and municipal disposition schedules)

6. RIC 04/04, cont… • Classifies electronic records based on their content, not media (example: prior email rule deleted) • Addresses new generation of electronic records

7. RIC 04/04: “New” Electronic Records • Section F, for documents related to information technology and records management • History: Records Management Unit; Significant ITD involvement in shortening and simplifying • Includes • Reference manuals (Systems manuals and technical documentation)

8. RIC 04/04 “New” Electronic Records, cont. • System infrastructure (records re: programs, applications and code; maintenance, monitoring and testing; website and systems documentation; technical support, contingency systems development; conversion, enhancement and upgrades)

9. RIC 4/04 “New” Electronic Records”, cont. • (3) agency makes a finding that the reg, standard or guidance (a) is substantially justified; (b) methods used to carry out are (A) substantially equivalent to requirements imposed on non-electronic records and (B) will not impose unreasonable costs on acceptance and use of electronic records and ( c ) methods do not require or accord greater legal status or effect to specific technology

10. RIC 04/04 “New” Electronic Records, cont. • System operations (data deletion, job order runs, intermediate records, audit trails, security, training) • Systems data (database content, website content, legacy system data, data conversion source records, data archival and backup records)

11. What are the Standards for Creating and Managing Electronic Records?

12. Prior to Enactment of E-SIGN or MUETA • Overlap, with respect to executive department agencies, regarding setting of standards for electronic records creation

13. Prior to Enactment, cont. • Information Technology Division enabling legislation, Mass. Gen. L. ch. 7, sec. 4A(d) • The chief information officer shall carry out such functions as the commissioner may from time to time deem necessary for the efficient and economical administration of information technology systems within the executive departments including . . . setting information technology standards . . [and] reviewing and approving the planning, design, acquisition and operation of information technology systems…”

14. Prior to Enactment, cont. • Secretary of the Commonwealth: • Supervisor of Public Records: required to put the records of the commonwealth, counties, cities or towns in the custody and condition required by law and secure their preservation.Adopt and promulgate regulations related to the management and preservation of public records. Mass. Gen. L. ch. 66, s. 1

15. Prior to Enactment, cont. • RCB: set standards for the management and preservation of records, and establish schedules for the destruction, in whole, or in part, and transfer to the archives or another appropriate division within the office of the state secretary. Mass. Gen. L. ch. 30, s. 42 • Archivist: re: non-current records of the commonwealth, in charge of custody, preservation, management, and when authorized, their destruction

16. Legislative and Judicial Records • Not covered by ITD, Supervisor of Public Records or RCB

17. ITD’s Historic Role in Setting Electronic Records Rules • ITD Policies, Procedures, Standards, and Guidelines, available athttp://www.mass.gov/itd/spg/publications/standards/index.htm • Example: Web accessibility standards • Example: Technical reference model specifies when to use rich text format, plain text format, http, portable document format, etc.

18. Supervisor of Public Records Role • SPR 1-99 Electronic Mail • Email created or received by employee of gov’t unit is public record • Contextual data (mailing address, routing info) is PR and must be retained. Systems must retain metadata • Differs from RIC (manage email according to content)

19. Supervisor of Public Records Role, cont. • To meet records retention requirements, PRINT OUT THE EMAIL AND FILE WITH PAPER RECORDS. If too large to print, store electronically in agency’s ELECTRONIC RECORDS STORAGE SYSTEM

20. Supervisor of Public Records, cont. • SPR 1-92 Facsimile transmissions • Public record • Thermal paper: preservation issues if not put on plain paper

21. Supervisor of Public Records, cont. • SPR 2-92: Requirement to maintain minutes of meetings in written format • Minutes must be created in writing using specified paper and ink; if recorded on audio tape must transcribe onto paper

22. Supervisor, cont. • SPR 2-93 Requirement to Use Permanent Paper • References Exec Order 293 (1990) requiring use of permanent paper to preserve “textual information of enduring value” • Requires use of specified paper and ink for “public records of enduring value” • SPR 1-93 Use of Optical Media • Currently being revised

23. Supervisor, cont. • SPR 1-96: Backing up and Archiving of Electronic Records • Backups should not be used for long term offline data storage • Archive long term data to dedicated disk or tape libraries

24. Supervisor, cont. • SPR 3-96 Application of Public Records Law to Electronic Records Access • Electronic records are subject to the PRL’s disclosure requirements • Contract between a third party data host and public agency does not affect disclosure requirement. Agency must request records from third party data host.

25. Supervisor, cont. • SPR 3-96, cont. • Don’t have to write a program to create records not in existence • Once the agency has such a program, it must provide records that it generates • Data segregation may require custodian to write program to perform the segregation electronically • Prospective requests (online subscription or monthly update) not within scope of PRL

26. Supervisor, cont. • SPR 3-96 • Custodian need not produce electronic record in format or medium requested • Software not a public record (!) • “A custodian is not obligated to provide copies of a computer program. A computer program in and of itself is a tool used in the processing of data rather than a "record," and therefore is not subject to mandatory disclosure.”

27. Supervisor, cont. • SPR 4-96 Fees for Access and Copying of Electronic Public Record • Custodian can charge for costs of searching and segregation

28. Electronic Signatures in Global and National Commerce, Inc. “E-SIGN”

29. E-SIGN • Title I of E-SIGN effective in Massachusetts from 2000 through February, 2004 • Validates electronic signatures, contracts and other records • “Validates” means gives ES, EC, ER equal legal footing with paper signatures, contracts and records. • Did not validate these items in connection with government’s non-procurement transactions • Preempted state law to the contrary

30. Harsh provisions regarding state government agency’s interactions with citizens and businesses. • Applies to states’ dealings with business and citizens. • No requirement to use or accept ES, ER except for state governments; except for state government procurement transactions, state government has no choice but to accept electronic signatures and records from citizens and businesses. 15 USCA s. 7001(b)(2) • States can still specify that electronic records filed with them meet certain “standards and formats”. 15 USCA 2004(a)

31. E-SIGN: Harsh Provisions for States, cont. • States cannot adopt regulations, standards or guidance regarding electronic records unless • (1) consistent with E-SIGN’s validating rules; • (2) do not add to requirements of E-SIGN for ES, EC and ER; and

32. E-SIGN’s Harsh Provisions, cont. • (3) agency makes a finding that the reg, standard or guidance • (a) substantially justified; • (b) methods used to carry out are (A) substantially equivalent to requirements imposed on non-electronic records and (B) will not impose unreasonable costs on acceptance and use of electronic records and • ( c ) methods do not require or accord greater legal status or effect to specific technology

33. E-SIGN’s Harsh Provisions, cont. • State can adopt performance standards to assure accuracy, integrity, accessibility • No reimposition of requirement that paper documents be used absent: • Compelling got interest related to law enforcement or national security • Imposing requirement is essential to attaining such interest.

34. Massachusetts Uniform Electronic Transactions Act “MUETA”

35. MUETA • Massachusetts Uniform Electronic Transactions Act, Mass. Gen. L. ch. 110G, s. 2 etseq. • Effective February, 2004 • Replaces Title I of Federal E-SIGN and its harsh provisions regarding state government’s interaction with private parties

36. MUETA • Like E-SIGN, validates electronic signatures, contracts and other records---including those used in state government transactions • Defines term “electronic record” • Electronic = relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities. • Electronic Record = a record created, generated, sent, communicated, received, or stored by electronic means.

37. Replacement for E-SIGN’s Harsh provisions • State government shall decide whether and the extent to which it shall accept electronic records from others, and can specify the manner in format in which such records must be received • State agencies can specify additional requirements for the retention of records subject to the agency’s jurisdiction

38. MUETA • Sweeps away all state law regarding requirements that state records be kept on paper, except for records generated in transactions governed by laws pertaining to: • Creation and execution of wills, codicils and testamentary trusts • UCC, except for sections 1-107, 1-206, 2 and 2A • Adoption, divorce, and other family law matters

39. MUETA, cont. • Court orders or notices, or official court documents, including briefs, pleadings and other writings, required to be executed in connection with court proceedings; • Notice of the cancellation or termination of utility services, including water, heat and power; or of the default, acceleration, repossession, foreclosure, or eviction, or the right to cure, under a credit agreement secured by, or a rental agreement for, a primary residence of an individual;

40. MUETA, cont. • Cancellation or termination of health insurance or benefits or life insurance benefits, excluding annuities; • product, that risks endangering health or safety; or • Document, required by a statute, regulation, or other rule of law governing, to accompany any transportation or handling of hazardous materials, pesticides or other toxic or dangerous materials.

41. MUETA, cont. • Retention of Electronic Records; Originals (MUETA s. 12): • Legal records retention requirements are satisfied by retention of electronic records that: • Accurately reflect the info set forth in record after it was first generated in its final form as an electronic record or otherwise • Remains accessible for later reference

42. MUETA Retention Requirements, cont. • Legal records retention requirements don’t pertain to information the sole purpose of which is to enable the record to be sent, communicate or received • Legal records retention requirements may be satisfied through use of third party records manager • If law requires that record be presented or maintained in its original form, or provides consequences if the record is not, law satisfied by an accurate, accessible electronic record.

43. MUETA, cont. • A law requiring retention of check is satisfied by electronic record of info on front and back of the check that is accurate and accessible • Law requiring record retention for evidentiary, audit or like purposes is satisfied by accurate and accessible electronic record. • Government agency may specify additional requirements for the retention of a record subject to the agency’s jurisdiction

44. Special note re: contracts • Comptroller has not yet authorized use of electronic signatures for state contracts

45. MUETA, cont. • Preserves overlap in authority between ITD on the one hand and Secretary, RCB and Supervisor on the other • ITD, Supervisor, and RCB “determine whether, the extent to which and the manner by which each executive department agency shall create, maintain and preserve electronic records, signatures and contracts and the method of converting paper government records to electronic format.” Mass. Gen. L. ch. 110G, s. 17

46. MUETA, cont. • Secretary, Supervisor and ITD shall” • Encourage and promote consistency and interoperability with other governmental agencies and nongovernmental persons. If appropriate, they may specify differing levels of standards from which governmental agencies of the commonwealth may choose in implementing the most appropriate standard for a particular application.

47. Defeated and Pending Legislation

48. Model Notary Act • Introduced last year by Secretary • Electronic notarization provision • Vetoed by Governor on other grounds • Electronic notarization still needed; MUETA authorizes it, but no legislation aligning Secretary’s enabling legislation with MUETA

49. Pending Legislation • S2420: • Introduced by Secretary • ITD participated in drafting • Electronic records shall be created or maintained to ensure the integrity, authenticity, reliability and usability of the electronic records.  

50. Pending Legislation, cont. • The supervisor of records, in consultation with the chief information officer, shall promulgate regulations to carry out this act.  • Will not apply to electronic records created, generated, sent, communicated, received or stored before the effective date of act.  Agencies within the executive department and municipalities must use their best efforts to comply with the act by January 1, 2008.