Future Proof – Protecting our digital future

A key way of knowing what information management strategy you should deploy for your social media is by identifying the legal requirements that outline how long your specific social media records need to be kept.

If your information only needs to be kept for short periods of time, your information management requirements will be quite minimal. If however your information needs to be kept for long periods of time, you will need to seriously consider the social media information strategy you will deploy to keep and preserve your information.

State Records is in the process of expanding its advice on social media retention rules, but in the interim, here is some initial advice on how long you need to keep different types of social media records for.

How are decisions about retention and destruction of social media records made in NSW?

In NSW the retention and destruction of all government business information is governed by the State Records Act.

Tools called retention and disposal authorities, issued under the State Records Act are developed based on an assessment of legal, business and community requirements for government information. Bearing legal, business and community requirements in mind, these tools specify the minimum periods that all classes of government business information need to be kept.

These tools apply to social media records across government. State Records will shortly issue further advice and case studies on how retention and disposal rules apply to social media, but in the interim, here is some advice in response to frequently asked retention and destruction questions.

What is the minimum amount of time I should keep an organisational blog for?

If the blog is very minor and the consensus is that its contents are not significant, 2 years is the minimum period of time that you would legally need to keep it for.

Can I keep the blog for longer than what you say?

Certainly. State Records’ retention rules are a minimum requirement only.

If however you believe the content is significant, that is if it contains important statements on corporate operations, policy announcements or significant public statements, you could classify this blog as a State archive and keep it forever.

State Records’ general advice is that organisations should carry out a risk assessment to ascertain if these minimum retention periods are appropriate. You can decide to keep any of your records for longer than our recommended minimum retention periods. For example, you may decide to retain all records of the blog for statute of limitations purposes (7 years) or you may decide to retain them on a permanent basis.

Do I need to make an official record of rude or obscene posts or information received via social media or can I just destroy them?

No you don’t need to capture these formally into your recordkeeping system. These can be deleted from your social media accounts without the need for any formal recordkeeping.

If multiple obscene posts are received from the same person, however, and the situation escalates to become a police matter, you may want to keep samples of some of the posts, or summary information about the posts, such as when they were received and the user name of the account that generated them.

Am I destroying records without authorisation if I remove particularly negative comments from Facebook or our corporate blog?

No. Laurel Papworth, CEO of the Community Crew says:

‘It’s actually your duty to remove really bad comments and commenters. Freedom of speech belongs on their own page, not yours! We are also judged by the company we keep – “social” media does not have to mean “friends to all”. Feel free to filter out – block or ban – those who do not share the value systems of the community.’

Your social media sites should be supported by a policy statement, often called Rules of Engagement in social media settings, that informs users that their posts or comments could be removed if they are seen as offensive or damaging, and that people can be banned  from your blog or Facebook page for repeated offensive behaviour.

Can I remove negative comments about our organisation from our Facebook page or blog?

One of the key business benefits of engaging in social media is receiving full and frank feedback on your programs and services. Legitimate comments of this type can help to improve services and remedy problems. Open discussion on your social media sites can also inspire as many compliments as criticisms.

Negative feedback should therefore not be removed. Where it is valid and useful, you should capture it as a record and feed this information into business or services improvement strategies or processes. To capture these specific instances as a record, you could take a screenshot, run a report from whatever form of monitoring tool you use, or simply summarise the feedback in an email, citing where the feedback came from.

Can I remove inaccurate statements from our Facebook page or blog?

If you consider these statements damaging then yes, you are able to remove them. It may be more appropriate, however, to engage with users and issue statements that provide users with the correct information. 

Some organisations choose to make a formal record of all posts or comments that they remove from their social media sites and these posts or comments, along with a justification for their removal are captured as official records into corporate recordkeeping systems.

Each organisation should make a risk-based assessment to determine whether inappropriate posts can just be deleted in accordance with stated policy or whether the nature of the post or the nature of the business area affected justifies the creation and capture of a formal business record.

Can I block certain users from our social media channels?

Craig Thomler, Managing Director of DeLib Australia posted this advice about managing inappropriate social media uses and content on his eGov AU site:

I have banned people from access where they were abusive, defamatory, threatening, encouraged violence or law breaking, were highly inappropriate, or where they repeatedly veered off-topic or became political in discussions where the terms of use and community guidelines made it clear that such conduct was unacceptable.

I’d always keep a copy of the term-breaking content as a record and, wherever possible with the social media tool, make it publicly clear why the deletion or ban occurred. When others I worked with managed social media channels, I advised similar scrutiny and approach.

Source: Should government agencies and councils be entitled to ban people from their social media channels, 6 February 2013

Social media is however a community forum and all types of positive and negative feedback should be expected through social media engagement.

Users should only be blocked for obvious infringements of your stated acceptable use policies and, as Craig Thomler mentions above, the justifications for this should be documented.

What happens when I decommission a social media handle or account?

You should consider whether you need to export information out of the social media application and into corporate systems.

• Was this account significant?
• Is business information of ongoing business value maintained here?
• Will members of the public who provided information here expect that the information they provided will continue to be available in coming years?
• Is the business information in the application going to be needed for reporting, assessment or business improvement purposes?

You should inform your users that you are closing down your site. Because social media involves sharing of information, there may be others affected by your business decision. Laurel Papworth, CEO of the Community Crew recommends asking questions like:

• Have you told your community that you are decommissioning your site?
• Have you provided them with the opportunity to export any content, including photos or videos, that they may have shared with you?
• Have you informed your community about new social spaces you are moving to?