Future Proof – Protecting our digital future

In keeping with our social media theme for the month of February, we’ve collated some of the enquiries and our responses relating to social media.

Q1: Our organisation is currently rolling out Workplace by Facebook for staff. We will be using this site to collaborate on work matters and as a means to reduce emails. Could you provide any information/advice/support as the State Archives and Records Authority regarding this?

Workplace by Facebook was launched in October 2016. It is a collaboration platform which hopes to replace intranet, email and other internal communication tools used by businesses. Like the original Facebook, staff can share information, upload videos, etc. internally.

We advised the organisation to consider doing the following:

• Perform a risk assessment on Workplace as records and information will be hosted by third party and outside of NSW as required by the General authority for transferring records out of NSW for storage with or maintenance by service providers based outside of the State (GA35).
• Assign a business owner to ensure that responsibility for records and information management issues in Workplace are identified and addressed.
• Create, capture and manage Workplace project documentations, including contractual arrangements. Pay special attention to how to capture and/or archive Workplace records, security controls, systems audits.
• Analyse your records and information requirements and plan your Workplace records management strategy accordingly. In addition, assess whether records and information shared in Workplace are already managed in your recordkeeping system or elsewhere. It is possible that you only need to capture posts that document collaboration activity or that you manage them in Workplace.

Click here for more information on strategies on managing social media records.

• Develop guidelines or business rules on how to use Workplace, including when to capture records and information posted/shared in Workplace into a recordkeeping system.

One of the risks associated with the use of social media platforms is the possibility of unauthorised (or even accidental) disclosure of, and or access to private and/or confidential information shared in Workplace. To mitigate this risk, one of the business rules could be to only share or post records and information with “unclassified” security classification.

Q2: Your guidance lists some cloud-based companies for capturing social media records, is it okay to use them? Won’t we breaking any legislation under the State Records Act?

In our guidance on managing social media records we listed some tools for capturing and keeping social media records. The list is comprised of companies we became aware of through our research when developing the guidance and companies that have subsequently contacted us, asking for their product to be listed. As the page notes, the list does not constitute an endorsement or provide an exhaustive list of vendors or products offering tools or services for social media information management – we do not recommend any particular tool or service.

In terms of taking or sending records outside of NSW, State Archives and Records NSW has approved the general authority for transferring records out of NSW for storage with or maintenance by service providers based outside of the State (GA35). This general authority gives approval for the transfer of records to cloud service providers based outside of NSW subject to certain conditions being met. In addition, all other legislative requirements for the management of information should also be met before entering any arrangements.

Further information about using cloud services is provided in our guidance on the implications for records and information management of using cloud computing services.

Q3: Is there a requirement to keep information that is shared via twitter feeds? Would the same rules apply depending on what the information is about notwithstanding the format that they were created in?

Yes, messages or information posted in social media sites are State records, including information shared via twitter feeds. The same rules apply regardless of the format. If it is an official Twitter account then it would be regarded as an official record.

In addition, if staff posts messages or information on behalf of the organisation using a personal social media account, the posts or tweets would be regarded as an official record.

Our “Strategies for managing social media records” guideline offers information on a range of approaches to recordkeeping including low level information management, needs-based information management and a more highly involved information management for accountability strategy, among others approaches.  It also identifies benefits and risks inherent in each approach.

Q4: Should social media content be retained as State archives?

State archives are NSW government records that have been identified as requiring permanent retention in an authorised retention and disposal authority. Typically only a small proportion of government records are required as State archives. It will be necessary to assess social media content to determine whether they are required as State archives and will be kept permanently.

We encourage public offices to contact the Government Recordkeeping team here at State Archives and Records NSW to help with the assessment of social media records for archiving purposes.

Image credit: John Atkinson, https://wronghands1.com (CC BY-NC-ND 3.0)