Future Proof – Protecting our digital future

Each week the Government Recordkeeping team at State Records answers dozens of enquiries about all aspects of government information management.

Some of the digital information management questions we have answered lately include:

• We want to use Office 365 – is it a problem under the State Records Act that corporate information will be stored out of NSW if we do this?
• What issues do we need to consider when assessing software to manage our digital photos?
• I am always being asked to justify the benefit of information management. What should I say?
• What kind of information should I manage out of my social media monitoring tool?
• Are voice recordings records? If so, how long am I supposed to keep them for?
• What is the legal status of our corporate Yammer account – is it subject to GIPA, for instance?

We want to use Office 365 – is it a problem under the State Records Act that corporate information will be stored out of NSW if we do this?

No, it is not.

A specific authority, Transferring records out of the State for Storage, gives authorisation for public offices to store records out of the state. Therefore there is no legal impediment under the State Records Act preventing use of cloud-based systems.

However there are definitely information management issues that you need to consider when adopting cloud based systems.

These relate to developing risk appropriate management frameworks for the types of business information that is moving to the cloud, and developing these now, before your cloud tools are rolled out for use.

To develop these types of frameworks, you need to ask:

• what high risk/high value/long term value business information is transitioning to the cloud?
• are management strategies in place to protect this information and to ensure it can be trusted and maintained for as long as your organisation needs it?
• have you planned for the portability and longevity of long term value business information?
• have you implemented exit strategies for your high risk/high value/long term value business information, even before you move into your chosen service environment?
• how can you use the move to the cloud as a driver to improve information management practices in the new environment?
• how can you deploy good disposal practices in the new environment so that your organisation does not incur large storage costs for redundant or time expired data?
• have you develop risk-based approaches for the management of the legacy information that will not be migrated to the cloud environment?

Corporate adoption of Office 365 implementation will likely also involve email transition. The Future Proof blog post, Thinking more about moving email to the cloud, looks at the growing trend of moving email to the cloud and some of the decisions that need to be made here.

With all cloud transitions, it is important to remember that there are genuine business drivers for the use of these services.

The use of as-a-service offerings is going to become more and more common, and so it is really important to work with those deploying cloud-based tools to ensure that short and long term business information needs can be met and relevant business information risks can be mitigated in these environments.

What issues do we need to consider when assessing software to manage our corporate digital photos?

Some organisations have major business requirements to manage very large numbers of digital photos and many are choosing to implement purpose-built software to improve their digital image management.

When assessing this form of software, core considerations involve examining how the tools you are looking at will work with your organisation’s business needs.

To make these assessments, it would be useful to talk to key business areas in your organisation that use digital photos regularly, run them through the prospective systems and get their feedback on how the systems meet their diverse business needs.

In terms of general information management issues, issues that are often reported to us as causing problems with the management of digital photos include:

Metadata

Poor image metadata and titling causes significant issues. You want to know what an image actually is and when it was taken, rather than just default or automatic titles and dates such as ‘JPEGOO1, 01/01/2001’.

Date and time metadata can be critical information if images are needed for infringement processing or for other evidential purposes, so making sure this metadata can be taken accurately from the image capturing device, or manually added to the system by an authorised user, is an important consideration.

Volume management

A big problem with a lot of these systems is that staff dump large numbers of photos into them. Given the size of photographic images, this tendency can quickly lead to significant volume management issues.

You don’t want absolutely every photo of everything captured in your records system, you just want the core images that will help people to do their jobs. An issue to manage then is how to get only the images that are actually needed to support business into your system.

Copyright and attribution management

Where it is important to give attribution, you need attribution to be recorded.

This might be important for copyright, or it might be important for maintaining community goodwill, for ensuring that photos submitted by members of the public will always have correct attribution.

Identification of format and file size

Identification of image formats and file sizes is necessary as these are important for ongoing image management.

Image use

You might want the system to be able to record where an image was used – ie ‘used in annual report 2013-14’, ‘used in library bulletin August 2013’, ‘submitted as evidence of infringement’, as this can be important business intelligence and useful for supporting other processes, such as business workflows, business reporting, GIPA applications or copyright management.

Routine, appropriate disposal

Because of their size and volume, you don’t want to be keeping all images forever. You want to be able to purge time expired images when appropriate to do so and when their business utility has ceased.

Storing lots of images can impact on the responsiveness of the system, so you do want to make sure you don’t impact on its usability by storing lots and lots of large photos.

However, when photos are used as an important component of a business transaction, you do want to make sure that these images are kept for as long as they do need to be kept. Having routine, appropriate disposal arrangements in place can help to ensure this.

Useful for business

Images fundamentally need to be useful for business. What can the system provide to drive this? For instance, can date and GPS details be recorded for images of sites, or for pot holes and can this information be trusted and used within other relevant corporate applications? Is there adequate information that tells you what the image is, any copyright issues that apply to it, how it should be used etc? What else do your business areas require?

Continuing context

For core images, it is important to continue to understand what these images are through time. So many corporate photos are meaningless within 5-10 years because people can’t remember who the individuals are, what the event was, what the site was, where the incident occurred, who photographed or owns the image, how it was used in business processes etc.

Context is very important for ongoing usability and developing mechanisms to capture a lot of descriptive metadata at the start can be really important for core, high value images. Using the system to document image use is also an important aspect of documenting context.

Interoperability

Systems need to be interoperable with a range of personal and corporate devices, and may need to be interoperable with a lot of social media tools. You might also want to push images out of your system with decent metadata and have these imported easily into your web content management system.

Image restriction where needed

If necessary, can the accessibility of some images be restricted by the system? For example, a council running a childcare service may want images of childcare activities to only be available to childcare staff.

Policies and procedures

Finally, it is important to note that a lot of the issues outlined above don’t specifically relate to the image software, they relate more to its implementation.

Whichever system you choose as best meeting your business needs will need to be supported with a good policy, procedure and advice that explains to people how they need to use the system.

Advice might also be needed to outline how settings on corporate cameras or mobile devices need to be configured in order to capture accurate date and time stamps, accurate GPS coordinates, or to export images from capturing devices in your chosen formats.

In addition to the above, Queensland State Archives has issued a very comprehensive guideline, Managing digital photographic images, that provides a wealth of advice on managing digital photos.

I am always being asked to justify the benefit of information management. What should I say?

In new content on its website, State Records has tried to discuss this very issue.

In this content we make the point that information is at the core of government business and is a core business asset.

To ensure that information can provide ongoing value to NSW government business and to the community, this advice says that government information needs to be:

• trustworthy and accountable
• accessible, understandable and useable
• maintained for business, community and legislative purposes.

In order to be all these things, information needs to be well managed.

The advice Establishing effective information management talks about the specific role of information management. It defines information management as a strategic, whole-of-organisation discipline with very broad corporate objectives.

It says that information management needs to be:

• proactively and well designed
• focussed on strategic business objectives
• part of all system and service environments where the business needs to rely on accountable information
• focussed on both short and long term business needs.

In terms of specific benefits, an information management focus in your digitial business environment provides:

• a focus on business needs and requirements
• information with integrity, accountability and useability
• the ability to focus on information that is strategic, high risk, and/or long term
• awareness of information risk and appropriate mitigation strategies
• a connection to context and understanding
• the ability to provide business with the information it needs to support its operations in the short and long term
• the ability to see technology as an enabler, not as core to business requirements.

Already we are seeing too many problems across government where technology is dictating information management requirements and the useability, accuracy and continuity of information is threatened or lost as a consequence. An information management focus allows information to be connected to business and business requirements and not to technology and technology requirements.

So these are some of the benefits we have defined. We would love to hear about other persuasive arguments you have developed to make the case for information management in your organisation.

What kind of information should I manage out of my social media monitoring tool?

Many organisations are using social media monitoring tools to improve service delivery and to respond to customer complaints and problems. These tools can also track activity in corporate social media accounts and identify issues and trends.

The information in these tools is generally only available to a small number of staff with access to these systems.

If you need to make better corporate use of the business intelligence in these systems, it can be useful to develop a management strategy for the social media information in monitoring tools.

Depending on the needs of your organisation, an approach in this type of strategy could be to:

• export a regular activity report for designated Twitter accounts for broader information circulation
• export regular social media trend reports for strategic assessment
• export reports as required for relevant staff associated with complaints management and/or issues management
• export regular reports to feed into corporate reporting processes, to measure the outcomes of corporate social media strategies.

Are voice recordings records? If so, how long am I supposed to keep them for?

Yes, voice recordings are records but decisions about how long to keep them for ultimately depend on how these recordings are used by your business.

For example, if voice recordings are used to support short term customer service objectives and the ongoing monitoring of service standards, then under disposal rules authorised under the State Records Act, they only need to be kept for as long as this business need exists – probably a few months. (The specific reference for this is GA28, 2.6.5)

For other more significant recordings, however, much longer term retention rules that are again directly related to the business needs would apply.

For instance, often when you make a contract over the phone with telecommunications organisation, you have to make a verbal recording stating that the contract terms and conditions have been explained to you and that you agree to them. The telecommunications organisation would then retain this recording for at least the life of your contract as it is serving as an official record, effectively as your digital signature on this contract agreement.

If you need to make decisions about how long to keep voice recordings in your organisation for, you do need to assess how your organisation is using these verbal records.

Is your organisation just keeping a short term reference copy of the conversation for service improvement purposes? If so, the GA28 reference above tells you how long to keep these records for.

Is all necessary business information given verbally by the customer over the phone captured by staff members into your business system during the conversation? In this case the record in your system is the official record of the conversation and any recording would not be needed after an appropriate quality control or service standard period.

Alternatively are people agreeing to contracts, or to service arrangements or to actions by your organisation on their behalf over the phone and therefore does the phone record constitute an official record of their verbal consent or agreement? In this case,  the recording itself is an official record and should be kept in accordance with the retention and disposal requirements for this area of business that are outlined in your authorised disposal authorities.

What is the legal status of our corporate Yammer account – is it subject to GIPA, for instance?

Social systems, even if they are third party hosted systems like Twitter and Facebook are government business systems when used by a government entity for business purposes.

They are therefore subject to all standard legislative requirements including defamation, criminal, privacy law, GIPA and the State Records Act. These systems are also subject to discovery provisions, like any other business application.

The fact that Yammer hosts quite a range of informal chat in addition to business specific conversations does not mean it is not being used for official business purposes. Therefore Yammer would be subject to the same legislative framework as any other business application, if it is being used for business purposes.

It is worth noting that very broad notions of business purposes are sometimes being applied to personal technologies. For example, personal mobile devices are frequently subpoenaed or subject to discovery orders if they have in part also been used for official business communications.

And finally, sadly I am leaving State Records in a few weeks time. Therefore you may receive a flurry of blog posts in the coming weeks as I try to finish off the raft of half posts I have partially developed over the years. My apologies in advance for this blast of information if it occurs! Kate