Records Management 2010State of Florida
ELECTRONIC RECORDS
AND
RECORDS MANAGEMENT PRACTICES
November 2010
Florida Department of State
Division of Library and Information Services
850.245.6750
http://dlis.dos.state.fl.us/RecordsManagers
State of Florida Electronic Records and Records Management Practices
Table of Contents
What are Public Records? .............................................................................................................................. 4
Public Records Management, Responsibilities, and Requirements ................................................................ 5
Policies and Procedures .............................................................................................................................. .... 7
Managing Electronic Records ........................................................................................................................ 8
Records Inventory .............................................................................................................................. ........ 8
Maintenance of Electronic Records and Media .......................................................................................... 8
Environmental Controls .............................................................................................................................. 9
Media Conversion .............................................................................................................................. ........ 9
Managing Exempt and Confidential Public Records ................................................................................ 10
Retention Requirements for Electronic Records ...................................................................................... 10
Destruction of El ectronic Records ............................................................................................................ 14
Electronic Communications as Public Records ............................................................................................ 15
Retention Requirements for Electronic Communications ........................................................................ 15
E-mail Archiving .............................................................................................................................. ........ 16
E-Discovery .............................................................................................................................. .................... 19
Cloud Computing .............................................................................................................................. ........... 22
Creating Electronic Records / Implementing Automated Systems ............................................................... 24
Conduct a Cost Benefit Analysis .............................................................................................................. 24
Incorporate Recordkeeping Requi rements into System Design ............................................................... 24
Document Electronic R ecordkeeping Systems ......................................................................................... 25
Provide Training for Users of Electronic Records .................................................................................... 26
Essential Characteristics of Electronic Records and Legal Admissibility ................................................ 27
Sustainable Formats .............................................................................................................................. .... 28
Selecting Storage Media ........................................................................................................................... 30
Using CDs and DVDs for Storage ............................................................................................................ 31
File Naming .............................................................................................................................. ................ 34
Automated Systems to Manage Electronic Records ................................................................................. 35
Frequently Asked Questions (FAQ) ............................................................................................................. 38
1. What are the requirements for scanning public records? ................................................................. 38
If I scan my records, can I get rid of the original hard copy? .......................................................... 38
2.
3. How long do we have to keep our e-mail? ...................................................................................... 38
4. If we print out our e-mail messages, do we al so have to keep them in electronic form? ................ 39
5. How long do we have to keep our back-ups? Should we keep e-mail back-ups permanently in case
they are ever needed? .............................................................................................................................. . 39
6. Are postings or messages on our website, Facebook page, or Twitter site public records? If so,
how long do we have to keep them? ......................................................................................................... 40
7. What are Florida’s requirements for electronic signatures? ............................................................ 41
APPENDIX A - Department of State E-Mail Policy .................................................................................... 43
APPENDIX B - Records Inventory Worksheet ............................................................................................ 47
APPENDIX C - Rule 1B-26.003 Florida Administrative Code ................................................................... 49
2
State of Florida Electronic Records and Records Management Practices
Preface
The goal of Florida’s Records Management Pr ogram is to provide professional assistance
to state and local government agencies in managing the records and information required
to take care of the business of government in an effective and cost-efficient manner. This
st
is a particularly cha llenging goal in the 21 century. Florida public agencies generate and
process information on an unprecedented scal e, hastened by the rapid advance of
technology. This results in vast quantities of information a nd evolving principles of law
governing the legality and admissibility of records created or maintained by this
technology. As records and information managers , we must make every effort to keep
ourselves educated and informed so that the decisions we make are consistent with law
and best practices.
Florida public agencies are faced with yet another challenge. Not only must we control
costs through the application of sound records and informa tion management principles,
but we must also apply these principles in light of the public’s right to know. Chapter
119, Florida Statutes, Florida’s Public Reco rds Law, is one of the most open public
records laws in the country and a model for ot her states. Florida has had some form of a
public records law since 1909 and is recognized nationally for its l eadership regarding
public records and accessibility to public in formation. As we go about our business, we
must remember the dual responsibility we have as public records and information
managers: to reduce government agencies’ co sts of doing business and to guarantee the
public’s right to know what their government is doing.
This handbook is intended to assist the creators and users of electronic records,
information technology (IT) staff, records mana gement (RM) staff, and agency managers
in managing electronic records in an eff ective, cost-efficient manner that also
accommodates their public records responsib ilities. The handbook emphasizes the
crucial role of records maintenance and dispos ition in managing electronic records and is
designed to be used in conjunction with the Department of State’s Basics of Records
Management handbook. Available at
http://dlis.dos.state.fl .us/barm/handbooks/basics.pdf , Basics provides an introduction and
guide to public records management in Florid a for state and local government agencies.
The principals in the Basics handbook apply equally to pub lic records in electronic
format.
While the recommendations in this handbook reflect best practices, they are not meant to
define mandatory standards. Rule 1B-26.003, Florida Administrative Code , provides
standards for record (master) copies of public records which reside in electronic
recordkeeping systems, esta blishes minimum requirements for the creation, utilization,
maintenance, retention, preservation, storag e, and disposition of electronic record
(master) copies, regardless of the media, and must be followed by all agencies as defined
by Section 119.011(2), Florida Statutes.
3
State of Florida Electronic Records and Records Management Practices
What are Public Records?
Electronic records that meet the definition of a public record must be managed and made
available according to applicable laws and rules. The Florida Public Records Law,
public records
Chapter 119, Florida Statutes, defines as:
“all documents, papers, letters, maps, books, tapes, photographs, films, sound
recordings, data processing so ftware, or other material, regardless of the physical
form, characteristics, or means of transm ission, made or received pursuant to law
or ordinance or in connection with the transaction of official business by any
agency.”
The Florida Supreme Court further interpre ted the statutory defi nition to mean “any
material prepared in connection with offi cial agency business which is intended to
1
perpetuate, communicate, or form alize knowledge of some type,” and the courts have
determined that information stored in a pub lic agency’s computer “is as much a public
2
record as a written page in a book or a tabulation in a file stored in a filing cabinet. . .”
Florida Statutes that “Automation of public records must
Section 119.01(2)(a), , provides
not erode the right of access to those records. As each agency increases its use of and
dependence on electronic recordkeeping, each agency must provide reasonable public
access to records electronically maintained and must ensure that exempt or confidential
records are not disclosed except as otherw ise permitted by law.” Therefore agencies
must take steps to ensure that their elect ronic records are properly maintained and
available when requested.
3
electronic record
An is any information that is reco rded in machine readable form.
Electronic records include numeric, graphic, audio, video, and textual information which
is recorded or transmitted in analog or digita l form such as electronic spreadsheets, word
processing files, databases, electronic mail, instant messages, scanned images, digital
photographs, and multimedia files.
electronic recordkeeping system
An is an automated information system for the
organized collection, processing, transmissi on, and dissemination of information in
4
accordance with defined procedures.
1
Shevin v. Byron, Harless, Scha ffer, Reid and Associates, Inc. , 379 So. 2d 633 (Fla. 1980)
2 th
Seigle v. Barry , 422 So. 2d 63, 65 (Fla.4 DCA 1982), review denied , 431 So. 2d 988 (Fla. 1983).
3
Rule 1B.26.003(5)(e), Florida Administrative Code ; Rule 1B.24.001(3)(e), Florida Administrative Code
4
Rule 1B-26.003(5)(f), Florida Administrative Code
4
State of Florida Electronic Records and Records Management Practices
Public Records Management, Responsibilities, and
Requirements
Chapter 119, Florida Statutes, defines "custodi an of public records" as “the elected or
appointed state, county, or municipal officer charged with the responsibility of
maintaining the office having public records, or his or her designee. ” Responsibility for
properly maintaining public reco rds, including electronic record s, begins with the head of
the agency. Elected or appoint ed officials may designate othe rs with this responsibility
but, if records are not available when they s hould be, it is the agency head who ultimately
will have to answer for it. It is, therefore, in the agency’s best interest to support the
proper management of its public records.
Agencies have a variety of public records responsibilities under Florida statute and
administrative rule. Specifically:
Chapter 119, Florida Statutes, requires r ecords custodians to allow inspection and
copying of public records except for those specifically confid ential or exempt
from inspection by statute.
Chapter 257, Florida Statutes, requires ag encies to establish and maintain an
active and continuing program for the ec onomical and efficient management of
records.
Chapters 119 and 257, Florida Stat utes, as well as Rule 1B-24, Florida
Administrative Code , require that agencies adhere to records retention schedules
established by the Division of Librar y and Information Services of the
Department of State and prohibit dest ruction of public records except in
accordance with those retention schedules.
Agencies are further required to appoin t a Records Management Liaison Officer
(RMLO), to submit to the Division of Libr ary and Information Services an annual
records management compliance statement, and to document disposition of their
public records (Chapter 257, Flor ida Statutes, and Rule 1B-24, Florida
Administrative Code ).
These requirements apply to public records in all formats, including records created
and/or maintained in electronic format. The complex characteristics of electronic
records, and the rapid changes in the hardwa re and software used to access them, make
these requirements even more challenging; as a result, electronic reco rds are typically not
as well managed as records in other formats. The massive quantities of electronic records
make it even more difficult to manage them effectively.
Therefore, it is critical for agencies to establish a program for the management of
electronic records that incor porates the program elements necessary to meet public
records requirements. These program elements include:
5
State of Florida Electronic Records and Records Management Practices
Administering an agency-wide program for the management of records created,
received, maintained, used or stored on electronic media.
Ensuring that all electronic records are covered by records retention schedules .
Integrating the management of electronic records with other records and
information resources management programs of the agency.
Incorporating electronic records manage ment objectives, resp onsibilities, and
authorities in agency directives .
Establishing procedures for addressing electronic records management
requirements, including recordkeep ing requirements and disposition.
Ensuring that agency electronic recor dkeeping systems meet state requirements
for public access to records.
Providing an appropriate level of security to ensure the integrity of electronic
records.
Ensuring that training is provided for users of elec tronic records systems in the
operation, care, and handling of the equipm ent, software, and media used in the
system.
Ensuring the development and maintenance of up-to-date documentation about all
electronic records systems that is adequate to specify all technical characteristics
necessary for reading or processing the records and for the timely, authorized
disposition of records.
Specifying the location and media on which electronic records are maintained to
meet retention requirements and maintaining inventories of electronic records
systems to facilitate disposition.
Ensuring the continued accessibility and readability of electronic records
throughout their life cycle.
Successfully implementing these program elemen ts requires a coordinated effort within
the agency. The effort needs support of th e agency head and other management and
requires the expertise of the ag ency RMLO and other RM staff, IT staff, legal staff, and
records custodians. IT plays a vital role in maintaining electronic records as they create
and maintain the infrastructure on which the re cords reside. It is important for key staff
to work together to ensure that electroni c information is available, preserved, and
disposed of according to applicable laws and rules.
6
State of Florida Electronic Records and Records Management Practices
Policies and Procedures
Agencies must establish policies and procedur es to ensure that electronic records and
their documentation are retained and accessible as long as needed. Agencies are required
to include electronic records management object ives, responsibilities, and authorities in
5
pertinent agency directives, or rules, as applicable. Agencies can begin to manage their
electronic records by incorporating electronic records into any general agency records
management policies they may have in plac e. They should specify in their records
management policies that those policies apply to public records in any and all formats,
including electronic format, and they shoul d ensure that employees are educated
regarding these policies.
Similarly, records management requirements shoul d be incorporated into the agency’s IT
policies; for instance, if the agency has an e-mail policy, it should alert users that e-mails
as well as other forms of electronic communicat ion relating to agency business are public
records and are subject to all public reco rds access, duplication, retention, and legal
discovery requirements. An example of how th is can be done is shown in the Department
of State’s internal e-ma il policy in Appendix A.
Rule 1B-26.003(12), Florida Administrative Code , specifies that agency policies and
procedures include provisions for:
Scheduling the retention and disposition of all electronic records, as well as
related access documentation and indexes, in accordance with the provisions of
Rule 1B-24, Florida Administrative Code .
Establishing procedures for regular r ecopying, reformatting, and other necessary
maintenance to ensure the retention a nd usability of the electronic records
throughout their authorized life cycle.
Transferring a copy of the electronic records and any related documentation and
indexes to the State Archiv es of Florida at the time specified in the records
retention schedule, if applicable.
Destruction of electronic records. Elect ronic records may be destroyed only in
accordance with the provisions of Rule 1B-24, Florida Administrative Code . At
a minimum each agency shall ensure that:
•
Electronic records scheduled for destru ction are disposed of in a manner
that ensures that any information th at is confidential or exempt from
disclosure, including proprietary, or security information, cannot
practicably be read or reconstructed, and;
•
Recording media previously used for electronic records containing
information that is confidential or exempt from di sclosure, including
proprietary or security information, are not reused if the previously
recorded information can be compromised in any way by reuse.
5
Rule 1B-26.003(6), Florida Administrative Code
7
State of Florida Electronic Records and Records Management Practices
Managing Electronic Records
As with records in other formats, electronic records must be managed through their entire
life cycle from creation, when the records ar e created or received ; through their active
life, when the records are accessed frequen tly (at least once a month); through their
inactive life, when the records are no longer activ e but have to be retained for a period of
time for legal, fiscal, administ rative, or historical reasons ; until their fina l disposition
which could be destruction or pr eservation as a permanent record.
Records Inventory
In order to know what electronic records mu st be managed, agencies should create an
inventory or other means of identifying and lo cating all of their reco rds, regardless of
format, and ensure that all the records are included in approved retention schedules. The
Records Inventory Sheet included in Appendi x B can be used in this process.
Maintenance of Electronic Records and Media
There is often a presumption that because in formation is stored in the computer or on
disk or tape, it is somehow automatically preserved for all time. Unfortunately,
electronic storage media can easily become unreadable over time due to physical,
chemical, or other deterioration. Special car e and precautionary measures must be taken
to avoid the loss of records stored on electronic media. Rule 1B-26.003, Florida
Administrative Code , specifies maintenance requirement s for electronic storage media.
Preservation duplicates of permanent or l ong-term records must be stored in an
off-site storage facility with constant temperature (below 68 degrees Fahrenheit)
and relative humidity controls.
Storage and handling of magnetic tape cont aining permanent or long-term records
should conform to the magnetic tape standard AES22-1997 (r2003), "AES
recommended practice for audio preser vation and restoration - Storage and
handling - Storage of polyest er-base magnetic tape," available from the Audio
Engineering Society, Incorporated, 60 East 42nd Street, Room 2520, New York,
New York, 10165-2520, and at the Inte rnet Uniform Resource Locator:
http://www.aes.org/publicati ons/standards/search.cfm .
Agencies must annually read a statisti cal sample of all electronic media
containing permanent or long-term records to identify any loss of information and
to discover and correct the cause of data loss.
Agencies must test all permanent or long- term electronic records at least every 10
years and verify that the media are free of permanent errors. More frequent
testing (e.g., at leas t every 5 years) is highly recommended.
8
State of Florida Electronic Records and Records Management Practices
Additional tape maintenance:
•
Only rewind tapes immediately befo re use to restore proper tension.
•
When tapes with extreme cases of de gradation are discovered, they should
be rewound to avoid more permanent damage and copied to new media as
soon as possible.
•
To ensure even packing, tapes should be played continuously from end to
end.
•
Tapes should be stored so that a ll the tape is on one reel or hub.
Environmental Controls
Electronic records media should be stor ed in a cool, dry, dark environment
(maximum temperature 73 degrees Fahre nheit, relative humidity 20-50 percent).
Smoking, eating, and drinking must be prohibited in areas where electronic record
media are recorded, stored, used, or tested.
Electronic record media must not be stored closer than 2 meters (about 6 feet, 7
inches) from sources of magnetic fiel ds, including generators, elevators,
transformers, loudspeakers, microphones, headphones, magnetic cabinet latches,
and magnetized tools.
Electronic records on magnetic tape or disk must not be stored in metal containers
unless the metal is non-magnetic.
Storage containers must be resistant to impact, dust intrusion, and moisture.
Compact disks must be stored in hard cases, and not in cardboard, paper, or
flimsy sleeves.
Media Conversion
Agencies must convert storage media to provide compatibility with the agency’s
current hardware and software to ensure that information is not lost due to
changing technology or deterior ation of storage media.
Before conversion of information to different media, agencies must determine that
authorized disposition of the electro nic records can be implemented after
conversion.
Permanent or long-term electronic reco rds stored on magnetic tape must be
transferred to new media as needed to pr event loss of information due to changing
technology or deteriorati on of storage media.
9
State of Florida Electronic Records and Records Management Practices
Electronic Records Back-up for Disaster Recovery
Agencies must back up electronic records on a regular basis to safeguard against
loss of information due to equipment malf unctions, human error, or other disaster.
Back-up media created for disaster recovery purposes must be stored in an off-site
storage facility with constant temper ature (below 68 degrees Fahrenheit) and
relative humidity controls.
Disaster recovery back-up ta pes or other media should be kept solely as a security
precaution and are not intended to serve as a records retention tool. In the case of
disaster, the back-up would be us ed to restore lost records. Agency records that have not
met their retention should not be disposed of on the basis of the existence of a back-up.
If, for any reason (for instance, a disaster er ases e-mails on an agency server), the only
existing copy of an item that has not met its retention period is on a back-up tape or other
medium, the agency must ensure that the re cord on the back-up is maintained for the
appropriate retention period. A back-up containing record co pies or the only existing
copies of records that have not passed their retention would have to be retained for the
length of the longest unmet retention period. Pr eferably, the records should be restored to
an accessible storage device from the back-up to ensure that the back-up is not used as a
records retention tool.
Agency IT policies should es tablish, and agencies should ad here to, a regular cycle of
back-up overwrites based on the agency’s secu rity and disaster recovery needs.
Managing Exempt and Confidential Public Records
The Florida statutes contain hundreds of speci fic exemptions to the access and inspection
requirements of the Public Records Law. Th e statutes also designate many records as
exempt and confidential. Whethe r their records are designated as exempt and
confidential or simply exempt, agencies ar e responsible for ensu ring that these public
records are properly safeguarded. Electr onic recordkeeping systems must have
appropriate security in place to protect inform ation that is confiden tial or exempt from
disclosure.
When providing access to or destroying elec tronic records containing confidential or
exempt information, agencies must take steps to prevent unauthorized access to or use of
the exempt information.
Retention Requirements for Electronic Records
There is no single retention peri od that applies to all of any agency’s electronic records,
or all electronic records in a particular fo rmat such as e-mail. Retention periods are
determined by the content, nature, and purpos e of records, and ar e set based on their
legal, fiscal, administrative, a nd historical values, regardless of the format in which they
reside. Records in any format can have a vari ety of purposes and rela te to a variety of
10
State of Florida Electronic Records and Records Management Practices
program functions and activities. The retention of any particular el ectronic record will
generally be the same as the retention for r ecords in any other format that document the
same program function or activity.
The General Records Schedule GS1-SL fo r State and Local Government Agencies ,
available at http://dlis.dos.state.fl.us/record smgmt/gen_records_schedules.cfm , does
provide the following retention requirements or guidance for certain categories of
However, there are many other ca tegories of records in the GS1-
electronic records.
SL which agencies might be creating a nd maintaining in electronic form and
agencies may also have some electronic records covered by individual schedules; be
sure to use the applicable retention schedul e for your records based on their nature,
content, and purpose
.
AUDIT TRAILS: CRITICAL INFORMATION SYSTEMS Item #393
This record series consists of system-generated audit trails tracking events relati ng to records in critical
information systems including, but not limited to, sy stems containing patient records, law enforcement
records, public health and safety records, clinical trial records, voter and election records, and financial
transaction records. Audit trails link to specific records in a system and track such information as the
user, date and time of event, and type of event (data added, modified, del eted, etc.). Since audit trails
may play an integral part in prosecution, discipli nary actions, or audits or other reviews, agencies are
responsible for ensuring that internal management polic ies are in place for retaining audit trails as long
as necessary for these purposes.
RETENTION:
a) Record copy. Retain each audit trail entry as long as the record the entry relates to, provided
applicable audits have been released.
b) Duplicates. Retain until obsolete, supe rseded, or administrative value is lost.
AUDIT TRAILS: ROUTINE ADMINISTRATIVE INFORMATION SYSTEMS Item #394
This record series consists of system-generated aud it trails tracking event s relating to records in
information systems used for routine agency administrative activities. Audit trails link to specific records
in a system and track such information as the us er, date and time of event, and type of event (data
added, modified, deleted, etc.). Since audit trails ma y play an integral part in prosecution, disciplinary
actions, or audits or other reviews, agencies are responsible for ensuring that internal management
policies are in place for retaining audit trails as long as necessary for these purposes.
RETENTION:
a) Record copy. Retain until obsolete, superseded, or administrative value is lost, provided applicable
audits have been released.
b) Duplicates. Retain until obsolete, supe rseded, or administrative value is lost.
BACK-UP TAPES
There is no retention schedule for back-up tapes or other forms of data back-up. A back-up tape or
drive should be just that: a data/records back- up kept solely as a security precaution but not intended
to serve as the record copy or as a records retention tool. In the case of disaster, the back-up
would be used to restore lost records; otherwise , agency records that have not met their retention
should not be disposed of on the basis of the existence of a back-up. If for any reason (for instance, a
disaster erases e-mails on your server) the only exis ting copy of an item that has not met its retention
period is on a back-up tape or drive, the custodial agenc y of that record must ensure that the record on
the back-up is maintained for the appropriate retenti on period. A back-up containing record copies/only
existing copies of items that have not passed their retention would have to be retained for the length of
the longest unmet retention period. Preferably, th e records should be restored to the agency from the
back-up to ensure that the back-up is not used as a records retention tool.
COMPUTER LOGS Item #391
This record series consists of fire wall logs, system logs, network logs, or other logs used to maintain the
integrity and security of the agency’s computer syst ems. The logs may record such information as
source and destination Internet Protocol (IP) addresses; user identification informa tion; files, directories,
and data that have been accessed; user rights; and running applications and databases. Since these
logs may play an integral part in prosecution or disciplinary actions, agencies are responsible for
11
State of Florida Electronic Records and Records Management Practices
ensuring that internal management policies are in place establishing criteria for which logs or entries
should be retained for further investigation.
RETENTION:
a) Record copy. 30 days or until review of logs is complete, wh ichever occurs first.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
ELECTRONIC COMMUNICATIONS
There is no single retention period that applies to all electronic messages or communications, whether
they are sent by e-mail, instant messaging, text messaging (such as SMS, Blackberry PIN, etc),
multimedia messaging (such as MMS), chat messaging, social networking (such as Facebook, Twitter,
Retention periods are
etc.), or any other current or future electronic messaging technology or device.
determined by the content, nature, and purpose of records, and are set based on their legal,
fiscal, administrative, and historical values, regardless of the format in which they reside or the
method by which they are transmitted.
Electronic communications, as with records in other formats,
can have a variety of purposes and relate to a variety of program functions and activities. The retention
of any particular electronic message will generally be t he same as the retention for records in any other
format that document the same progr am function or activity. For instance, electronic communications
might fall under a CORRESPONDENCE series, a B UDGET RECORDS series, or one of numerous
other series, depending on the content, nature, and purpose of each message. Electronic
communications that are created prim arily to communicate information of short-term value, such as
messages reminding employees about scheduled meet ings or appointments, might fall under the
"TRANSITORY MESSAGES" series.
ELECTRONIC RECORDS SOFTWARE AND DOCUMENTATION Item #231
This record series consists of proprietary and non-proprietary software as well as related documentation
that provides information about the content, structure, and technical spec ifications of computer systems
necessary for retrieving information retained in machine-readable format. These records may be
necessary for an audit process.
RETENTION:
a) Record copy. Retain as long as software-dependent records are retained.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
GEOGRAPHIC INFORMATION SYSTEMS (GIS) DATA LAYERS AND DATASETS Item #381
This record series consists of individual layers of data and/or datasets us ed to populate Geographic
Information Systems (GIS). Data layers and datasets may include, but are not limited to, vector data,
such as point, line, and polygon data; imagery da ta, such as satellite imagery and aerial imagery;
topographic data, including elevation data and terrain contours; land use and planning data, including
habitat data, road data, zoning, and parcel owners hip; and jurisdictional boundary data, including
political subdivisions, historic districts, school districts, and urban growth areas. Since GIS data layers
and datasets are continuously updated, agencies should take periodic snapshots of data layers and
datasets considered to have long-term or continuing info rmational or historical value to ensure proper
retention of this data. See also “GE OGRAPHIC INFORMATION SYSTEMS (GIS) SOURCE
DOCUMENTS/DATA,” “GEOGRAPHIC INFO RMATION SYSTEMS (GIS) SNAPSHOTS:
ADMINISTRATIVE,” and “GEOGRAPHIC INFORMATION SYSTEMS (GIS) SNAPSHOTS:
HISTORICAL.”
RETENTION:
a) Record Copy. Retain until obsolete, su perseded, or administrative value is lost.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
12
State of Florida Electronic Records and Records Management Practices
GEOGRAPHIC INFORMATION SYSTEMS (GIS) SNAPSHOTS: ADMINISTRATIVE Item #382
This record series consists of periodic snaps hots of Geographic Information Systems (GIS) data
considered by the agency to have only short-term, adm inistrative value. This series does not include
GIS snapshots that document long-term community dev elopment and/or growth and are considered by
the agency to have long-term informational and/or hist orical value. This series may include daily or
monthly snapshots taken for general administrative or reference purposes. This series does not include
snapshots taken by an agency for the sole pur pose of back-up/disaster recovery. See also
“GEOGRAPHIC INFORMATION SYSTEMS (GIS) SNAPSHOTS: HISTORICAL,” “GEOGRAPHIC
INFORMATION SYSTEMS (GIS) SOURCE DOCUMENTS/DATA,” and “GEOGRAPHIC
INFORMATION SYSTEMS (GIS) DATA LAYERS AND DATASETS.”
RETENTION:
a) Record Copy. 1 anniversary year.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
GEOGRAPHIC INFORMATION SYSTEMS (GIS) SNAPSHOTS: HISTORICAL Item #383
This record series consists of periodic snaps hots of Geographic Information Systems (GIS) data
considered by the agency to have long-term informatio nal and/or historical value. This series may
include, but is not limited to, snapshots document ing community development and/or growth such as
geographic contour changes; infrastructure devel opment, including transport ation, utilities, and
communications; environmental changes; demographic shifts; changes to jurisdictional boundaries; and
changes in property values. This record series does not include GIS snapshots taken by an agency for
the sole purpose of back-up/disaster or snapshot s taken for general administrative or reference
purposes such as documentation of routine infrastr ucture maintenance (e.g., road repairs, utility line
repairs). See also “GEOGRAPHIC IN FORMATION SYSTEMS (GIS) SNAPSHOTS:
ADMINISTRATIVE,” “GEOGRAPHIC INFORMATION SYSTEMS (GIS) DATA LAYERS AND
DATASETS,” and “GEOGRAPHIC INFORMATION SYSTEMS (GIS) SOURCE DOCUMENTS/DATA.”
These records may have archival value.
RETENTION:
Permanent.
a) Record Copy. State agencies should contact the Stat e Archives of Florida for archival
review after 5 years. Other agencies should ensure appropriate preservation of records.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
GEOGRAPHIC INFORMATION SYSTEMS (GIS) SOURCE DOCUMENTS/DATA Item #384
This record series consists of documents and/or data used to update Geographic Information Systems
(GIS). This record series may include, but is not limited to, address change forms, survey data, field
notes, legal descriptions, and other documents and/or data submitted to or acquired by the agency for
the sole purpose of updating the agency’s Geographic Information Systems. Do NOT use this item if
records fall under a more appropriate retention sched ule item or if the unique content/requirements of
the records necessitate that an individual retent ion schedule be established. See also “GEOGRAPHIC
INFORMATION SYSTEMS (GIS) DATA LAYERS AND DATASETS,” “GEOGRAPHIC INFORMATION
SYSTEMS (GIS) SNAPSHOTS: ADMINISTRATIVE, ” and “GEOGRAPHIC INFORMATION SYSTEMS
(GIS) SNAPSHOTS: HISTORICAL.”
RETENTION:
a) Record Copy. Retain until obsolete, su perseded, or administrative value is lost.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
SPAM/JUNK ELECTRONIC MAIL JOURNALING RECORDS Item #370
This record series consists of electronic mail items identified by an agency’s filtering system as spam or
junk mail that are blocked from entering users’ mail boxes and instead are journaled, or captured as an
audit log along with their associated tracking informa tion, as evidence of illegal acts. The journaling
records lose their value within a brief period after t heir capture unless it is determined that they should
be forwarded to a law enforcement agency for investigation.
RETENTION:
a) Record copy. Retain until obsolete, superseded, or administrative value is lost.
b) Duplicates. Retain until obsolete, superseded, or administrative value is lost.
13
State of Florida Electronic Records and Records Management Practices
Destruction of Electronic Records
Rule 1B-24, Florida Administrative Code , sets forth requirements for destruction of
public records. Section (10) of the rule specifies the following:
Agencies must ensure that all destructi on of records is conducted in a manner that
safeguards the interests of the state a nd the safety, security, and privacy of
individuals.
In destroying records containing informati on that is confidential or exempt from
disclosure, agencies must use destruction methods that prevent unauthorized
access to or use of the information a nd ensure that the information cannot
practicably be read, recons tructed, or recovered.
Agencies must specify the manner of destruction of such records when
documenting disposition.
When possible, recycling followi ng destruction is encouraged.
For electronic records containing informati on that is confidential or exempt from
disclosure, appropriate destruction me thods include physical destruction of
storage media such as by shredding, crushing, or incineration; high-level
overwriting that renders the data unrecove rable; or degaussing/demagnetizing.
Many commercial shredding companies offer shredding services for electronic storage
media such as compact disks and DVDs.
14
State of Florida Electronic Records and Records Management Practices
Electronic Communications as Public Records
Electronic communication is the el ectronic transfer of information, typically in the form
of electronic messages, memoranda, and attach ed documents, from a sending party to one
or more receiving parties by means of an intermediate telecommunications system.
Electronic communications include e-mail, instant messaging, text messaging (such as
SMS, Blackberry PIN, etc.), multimedia messaging (such as MMS), chat messaging,
social networking (such as Facebook, Twitter, etc.), or any other current or future
electronic messaging technology or device. Electronic communications created or
received in connection with th e transaction of official busin ess are public records subject
to inspection and copying in accordance with Chapter 119, Florida Statutes, and subject
to applicable state retention laws and regul ations, unless expressly exempted by law.
Electronic communications crea ted or received for pers onal use are not generally
considered public record and do not fall with in the definition of public records simply by
virtue of their placement on a government-own ed computer system. However, if an
agency discovers misuse of their electronic communications system and personal
electronic messages are identified as being in violation of the agency’s policy, the
electronic messages may become public reco rd as part of an investigation.
Retention Requirements for El ectronic Communications
All public records must have an approved re tention schedule in place before they can be
Retention Requirements
destroyed or otherwise disposed of. As indicated above under
for Electronic Records
(page 11), retention periods ar e determined by the content,
nature, and purpose of records, and are set based on the lega l, fiscal, administrative and
historical values, regardless of physical format in which they reside or the method by
which they are transmitted. Electronic communica tions, as with records in other formats,
can have a variety of purposes and relate to a variety of program f unctions and activities.
Therefore, there is no single re tention schedule that applies to all electronic messages or
communications. The retention period of a ny particular electronic message will be the
same as the retention for records in any ot her format that document the same program
function or activity. For in stance, electronic communi cations might fall under a
CORRESPONDENCE series, a BUDGET RECORDS series, or one of numerous other
record series, depending on the content, nature, and purpose of each message.
Electronic communications that are created primarily to communicate information of
short-term value, such as messages remindi ng employees about scheduled meetings or
appointments, might fall under the "TR ANSITORY MESSAGES" record series.
value
“Transitory” refers to short-term based upon the content and purpose of the
not
message, the format or technology used to transmit it. Examples of transitory
messages include, but are not limited to, e- mail messages or other communications
reminding employees about sc heduled meetings or appoi ntments; most telephone
messages (whether in paper, voice mail, or other electronic form ); announcements of
office events such as holiday parties or group lunches; and recipient copies of
announcements of agency-sponsored events such as exhibits, lectur es, workshops, etc.
15
State of Florida Electronic Records and Records Management Practices
Transitory messages are not intended to form alize or perpetuate knowledge and do not set
policy, establish guidelines or pr ocedures, certify a transaction, or become a receipt. The
retention requirement for transitory messages is "retain until obsolete, superseded or
administrative value is lost." Therefore, electronic communications that fall into this
category can be disposed of at any ti me once they are no longer needed.
Agencies that allow the use of electronic co mmunications on their networks, including e-
mail, instant messaging, text messaging (such as SMS, Blackberry PIN, etc), multimedia
messaging (such as MMS), chat messaging, social networking (such as Facebook,
Twitter, etc.), or any other current or future electronic messaging technology or device
must recognize that such content may be a public record and must manage the records
accordingly. The seemingly ephemeral na ture of some electronic communications
heightens the need for users to be aware th at they may be creating public records using
these technologies and must properly manage and preserve record content. Agencies
must make sure the systems in use allow them to adhere to all retention requirements.
Agencies developing a comprehensive polic y need to ensure that electronic
communications content is managed consiste ntly across the agency in its component
offices. An effective policy addresses the authorized use of th e various electronic
communications technologies and provides guide lines for the management of the records
generated by these communications. This is especially important because electronic
communications content may be subject to va rious types of access requests, including
public records requests or as part of a di scovery process in a litigation context.
Sorting electronic communications such as e-ma il into appropriate personal folders is a
helpful way to manage these records and to ensure that appropriate retention
requirements are identified and met. That is , just as file cabinets are set up to house
different sets of files, and employees know wh ere to file paper reco rds in those files, e-
mail files and folders can be set up with th e appropriate retenti on period designated for
each of those files and folders. If no reten tion schedule exists for records relating to a
particular activity, then one must be establ ished and that retention schedule would then
apply to all documentation of that activity, regardless of format (paper, microfilm,
electronic, etc.).
E-mail Archiving
Although e-mail archiving applications may pr ovide business benefits to an agency, e-
mail archiving applications can be limited in their capabilities to keep and organize
records according to records management laws, regulations, and policies. If an agency
decides to use e-mail archiving applications to manage public records, the agency must
ensure that records management requirements are addressed.
E-mail archiving generally refers to applicati ons that remove e-mail from the mail server
and store it in a central locati on also known as an archive. IT professionals use the term
"archiving" to mean the copying or transfer of files for st orage. In general, these
applications collect in a central archives or “repository” the e-mail (which may include
attachments, calendars, task lis ts, etc.) of some or all agen cy users. E-mail archiving
16
State of Florida Electronic Records and Records Management Practices
applications typically require little to no action on the part of the us er to store the e-mail
records. Once messages are stored, authorized users are able to search the repository.
In the archiving process, e-mail may be rem oved from the mail server either manually by
the user or automatically after a predetermined period of time. Automatic transfer to the
e-mail archive server may be based on a charac teristic or combinati on of characteristics
explicitly found in the e-mail such as the iden tity of the sender or recipient, date, or
keywords found in the subject line or text of the message. The archive server then
indexes the e-mail and associated files for fu ture search and retrieval. E-mail systems
continue to provide access to archived e- mail through pointers or shortcuts. In most
situations, only one copy of the e-mail gets archived.
Recordkeeping systems that include electroni c mail messages, including e-mail archiving
systems being used to store record copy emails, must:
Provide for the grouping of related record s into classifications according to the
business purposes th e records serve;
Permit easy and timely retrieval of both individual records and files or other
groupings of related records;
Retain the records in a usable format for their required retention period and allow
their disposal when the retention is met;
Be accessible by individuals who have a business need for information in the
system;
Preserve the transmission and receipt da ta specified in agency instructions.
Depending on the agency and its business purpo ses, e-mail archiving applications may
provide the following benefits. Each applica tion has different feat ures and different
strengths, so this list is not exhaustive:
More efficient storage of e-mail because it is moved from a distributed network of
servers, desktop applications, and other places to be managed in one place;
Enhanced electronic search capability for content that may be germane to a
subpoena, public records request, e-disc overy request, or similar purpose;
Back-up and disaster recovery features.
While e-mail archiving applications offer business benefits, these technologies do not
necessarily meet all of the requi rements of the public records laws and rules. Unless the
agency appropriately configures and implemen ts the application, it can weaken a records
management program. For instance:
17
State of Florida Electronic Records and Records Management Practices
Current e-mail archiving applications may not be capable of grouping related
records in accordance with recordkeeping requirements or maintaining the records
in a usable format for their full required retention periods;
It may make it difficult to identify and distinguish between permanent records and
short-term records and carry out proper di sposition at the end of their retention
periods, be that destruction of records or transfer to th e State Archives of Florida
or a local historical records repository;
An agency that adopts e-mail archiving while continuing a print and file policy
for official e-mail records could uninten tionally undermine records management
compliance as users may assume that th e e-mail application has replaced the e-
mail print and file policy; therefore, an agency should provide clear guidance if
print and file should be done in addition to e-mail archiving.
If an e-mail archiving app lication is adopted as the only means of storing e-mail
messages, agencies must use e-mail archiving technologies in conjunction with additional
controls such as records management policie s and procedures, business rules, and other
conditions necessary to ensure compliance with records management requirements. Any
agency that adopts e-mail archiving applicatio ns as its means of of ficial recordkeeping
must create policies, provide adequate us er training, and take steps to identify and
manage the limitations in current e-mail archiving applications in order to ensure that
records are kept according to publ ic records laws and rules.
18
State of Florida Electronic Records and Records Management Practices
E-Discovery
Electronic discovery (or e- discovery) refers to discovery in civil litigation of
electronically stored information, or ESI. The widespread use of computers to conduct
business in both the private and public sectors, as well as for personal use, has forced the
courts to address the unique challenges posed by using ES I as evidence in the legal
process. As a result, the Federal Rules of Civil Procedure (FRCP) were amended in
December 2006 to address e-discovery.
The FRCP amendments do not require agencies to keep all of th eir e-mails (or other
electronic records) permanen tly. In fact, these amendm ents do not address records
retention periods at all. However, they do underscore the importance of applying records
management policies, practices, and procedures to electronic record s, and the value of
having electronic records policies in pl ace that explicitly accommodate records
management requirements.
Further, recent case law demons trates that courts expect organizations to produce ESI in
the same electronic format in which the or ganization normally created or maintained it
for business purposes. Therefore, in the ev ent of litigation or reasonably anticipated
litigation, existing reco rds in electronic form must be maintained in their current
electronic format; printing them out or conver ting them to another format at that point
might not only be unnecessary, but also might be unacceptable to the court. If an agency
has a print and file policy for e-mail, deleti on of e-mails once printed must be suspended
6
until all legal discovery issues are closed.
Agencies that are already following State of Florida records management requirements
and guidelines and working with their legal office to ensure that records relating to
litigation are retained as long as required for that litigation are already doing most of the
things necessary to accommoda te the FRCP e-discovery amendments. Agencies can do
the following to prepare for e-discovery:
Have a formal, active records management program and policy which applies to
all records regardless of format.
Maintain records inventories or other m eans of identifying and locating all agency
records.
Ensure that retention schedules and all other retention requirements have been
met before disposing of records in any form, including electronic records.
6
See, for example, Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Secs, No. CIV.
05-9016, 2010 U.S. Dist. LEXIS 1839 (S.D.N.Y. Jan. 11, 2010) and subsequent amended opinions;
Zubulake v. UBS Warburg LLC , 220 F.R.D. 212 (S.D.N.Y. 2003); and Vagenos v. LDG Fin. Servs., LLC,
No. 09-cv-2672, 2009 WL 5219021 (E.D.N.Y. Dec. 31, 2009).
19
State of Florida Electronic Records and Records Management Practices
Properly document disposition of records.
Have a formal procedure for placing a litiga tion hold on records in all formats that
might be relevant to anticipa ted, pending, or ongoing litigation.
Ensure regular consultation among agency legal staff, RM, and IT staff.
Consultation between agency legal staff, records management staff, and information
technology staff is critical to ensuring that all the pieces are in place and all the key
players are familiar with their responsibiliti es relating to e-discovery and other records
management requirements. Agencies should c onsult with their lega l counsel to verify
their legal requirements for compliance with th ese and other rules of civil and criminal
procedure.
The complete text of the FRCP e-discovery amendments and the accompanying
committee notes (commentary) by the Advisory Committee on the Rules of Civil
Procedure are available on the United Stat es Courts website in pdf format at
http://www.uscourts.gov/uscourts/RulesAndPolicies/rules/EDiscovery_w_Notes.pdf . A
few key provisions of interest to records managers are briefly summarized below. The
following summary is not intended to be, and shou ld not be construed to be legal advice.
For more information on the legal obligations that these and other provisions impose,
agencies should refer to the full te xt and consult their legal counsel.
Pretrial Conferences:
The judge’s pretrial conferen ce scheduling order may include
“provisions for disclosure or discovery of electronically stor ed information” [FRCP Rule
16(b)(5)]. According to the Committee Note, th is amendment is designed to alert the
court to the possible need to address the ha ndling of discovery of electronically stored
information early in the litigation.
Required Disclosures:
Each party (an individual or or ganization involved in a legal
proceeding) must, “without awaiting a discovery request, provide to other parties . . . a
copy of, or a description by category and loca tion of, all documents, electronically stored
information, and tangible things that are in the possession, custody, or control of the party
and that the disclosing party may use to suppor t its claims or defenses, unless solely for
impeachment” [FRCP Rule 26(a)(1)(B)]. According to the Committee Note, this
amendment clarifies “that a part y must disclose electronically stored information as well
as documents that it may use to support its claims or defenses.”
Undue Burden:
A party is not required to provide discovery of elect ronically stored
information if that information is “not r easonably accessible because of undue burden or
cost.” The party must be able to demonstrat e that undue burden or cost, but the court may
still order discovery upon showing of good cause by the requesting party [FRCP Rule
26(b)(2)(B)]. According to the Committee No te, “The responding party has the burden
[to show that] the identified sources are not r easonably accessible in light of the burdens
20
State of Florida Electronic Records and Records Management Practices
and costs [and] the requesting party has the burden of showing that its need for the
discovery outweighs the burdens and costs of locating, retrieving, and producing the
information.”
Discovery Planning Conferences:
Prior to a scheduling conf erence or scheduling order,
parties must discuss issues a nd develop a discovery plan, incl uding “any issues relating to
disclosure or discovery of el ectronically stored information, including the form or forms
in which it should be produced” [FRCP Ru le 26(f)(3)]. According to the Committee
Note, this amendment directs parties “to di scuss discovery of electronically stored
information during their discovery-planning conference” if elect ronic discovery is
anticipated.
Option to Produce Records in Response to Interrogatories:
A party served with an
interrogatory that can be answered from an ex amination of that party’s records, including
electronically stored information, may “specify the records from which the answer may
be derived or ascertained and [allow] the party serving the in terrogatory . . . to examine,
audit or inspect such records and to make c opies, compilations, abstracts, or summaries”
[FRCP Rule 33(d)]. According to the Committee Note, the “responding party [may]
substitute access to documents or electroni cally stored information” under specified
circumstances.
Production of Electronically Stored Information:
A party may request another party to
produce “any designated documents or electronic ally stored information . . . The request
may specify the form or forms in which elec tronically stored information is to be
produced . . . if a request does not specify th e form or forms for producing electronically
stored information, a responding party must pr oduce the information in a form or forms
in which it is ordinarily maintained or . . . reasonably usable . . . a party need not produce
the same electronically stored information in more than one form” [FRCP Rule 34(a, b)].
According to the Committee Note, this amendment “confirm[s] that discovery of
electronically stored information stands on equal footing with discovery of paper
documents.” Rule 34(b) “protect[s] against . . . production in ways that raise unnecessary
obstacles for the requesting party.”
Failure to Make Disclosure or Cooperate in Discovery:
This amendment, known as
the “safe harbor” provision, prohi bits sanctions under this rule, “[a]bsent exceptional
circumstances,” for “failing to provide electroni cally stored information lost as a result of
the routine, good-faith operati on of an electronic informati on system” [FRCP Rule 37(f)].
According to the Committee Note, this amendm ent recognizes that “t he routine alteration
and deletion of information . . . attends or dinary use” of computers. “The good faith
requirement of Rule 37(f) means that a part y is not permitted to exploit the routine
operation of an information system to thwa rt discovery obligations by allowing that
operation to continue in order to destroy specific stored inform ation that it is required to
preserve.”
21
State of Florida Electronic Records and Records Management Practices
Cloud Computing
Cloud computing is a term that refers to acce ssing via the Internet computer resources
that are owned and operated by a service provider in one or more data center locations.
Cloud computing customers use resources as a service and pay only for resources that
they use, thereby avoiding capital expenditu re on hardware and software. Services may
include data storage and management, software , and computing resources. This service
delivery model is attractive for its “potential cost savings brought about by economies of
scale and the ability to rapidl y deploy new applications a nd services. Cloud computing
has the potential to have a substantial im pact on archival and records management
7
programs as well.”
Agencies thinking of using cloud computing should make sure they have a clear
understanding of exactly what is being pr oposed. Records management requirements
will apply to public records maintained in the cloud just as they would if the records were
stored on agency computers. Some of the i ssues that should be considered are listed
below.
Scope
– What agency records will be stored, processed, or accessed through the cloud?
Will they include confidential or exempt records?
Retention
– With cloud computing serv ices, often multiple copies of the data are stored
on geographically-dispersed resources for data protection and access. How will the
vendor ensure destruction of all copies of records that have met their retention?
Location
– It is not uncommon for the end-user to have no idea where their information
is stored or processed in the cloud. If agency records must be maintained within
jurisdictional boundaries, this re quirement should be included in the vendor contract.
Legal/Policy Compliance
– Cloud computing may not adequately address some
compliance issues such as those related to the Health Insurance Portability and
Accountability Act (HIPAA), the Sarbanes-O xley Act of 2002, and the Payment Card
Industry (PCI) security requirements.
E-Discovery
– How will the agency ensure that it can comply with an e-discovery order
if some or all of its reco rds are stored in the cloud?
Interoperability
– As with any information technol ogy, it is important to ensure that
records are not trapped in a proprietary system in the cloud that will require considerable
expense or effort to remove it from that system or move it to another system.
7
Conrad, Mark, “Distributed Computing – Cloud Computing and Other Buzzwords: Implications for
Archivists and Records Managers.” Crossroads 2009, no. 3. CERIS White Papers.
http://www.nagara. org/associations/5924/files/Crossroads_2009_3.pdf
22
State of Florida Electronic Records and Records Management Practices
Security
– There is debate as to whether or not cloud services provi de more or less
security than traditional IT infrastructure. Some argue that data is more secure when
managed internally, while others argue that cloud providers have a strong incentive to
maintain trust and as such em ploy a higher level of security.
For agencies considering deploying cloud com puting services, it will be important to
Have the provider demonstrate or
address these issues and others like them upfront.
describe in detail how they can meet al l agency requirements, and clearly delineate
those requirements in the co ntract with the provider.
23
State of Florida Electronic Records and Records Management Practices
Creating Electronic Records / Implementing Automated
Systems
When creating electronic records and implemen ting automated systems that will contain
public records, agencies must take steps to en sure the records are maintained according to
applicable public records laws and rules.
Conduct a Cost Benefit Analysis
Electronic recordkeeping systems containing pub lic records must maintain the records in
accordance with applicable public records laws and rules.
Rule 1B-26.003, Florida Administrative Code , states that “before existing records are
committed to an electronic recordkeeping system, the agency shall conduct a cost benefit
analysis to insure that the pr oject or system contemplated is cost effective.” Agencies
should study the pros and cons of automation rather than assuming automation is the best
choice. For example, conversion of paper reco rds to electronic format is not always the
best option for maintaining records, particularly records that only have to be retained for
a short period of time. The cost of convert ing short-term records may be greater than
simply storing the records in paper format until they are eligible for disposal. If the
agency has a high volume of short-term records, off-site storage can be an economical
alternative to keeping the records in the office or scanning them.
Incorporate Recordkeeping Requirements into System Design
Rule 1B-26.003, Florida Administrative Code , further states that “recordkeeping
requirements must be incorporated in th e system design and implementation of new
systems and enhancements to existing systems. ” Agencies must “establish procedures for
addressing records management requirements, including recordkeep ing requirements and
disposition, before approving, recommending, adopting, or implementing new electronic
recordkeeping systems or enhancements to existing systems.” Recordkeeping
requirements are best addressed and incor porated when automated systems are being
planned and designed. Selected technologi es must accommodate records retention,
exemption, and access requirements. For instance, an agency implementing a new
surveillance recording system must ensure th at the system is capable of accommodating
the minimum 30-day retention requirement fo r surveillance recordi ngs as well as the
ability to preserve the recordings longer in the event of an incident investigation ( General
Records Schedule GS1-SL for Stat e and Local Government Agencies , Item #302,
Surveillance Recordings).
If an agency utilizes an information sy stem development methodology (ISDM), system
development life cycle (SDLC), or similar process when designing and planning
information systems, records management requi rements should be included in the earliest
stages of this process.
24
State of Florida Electronic Records and Records Management Practices
Agencies should include steps to ensure that:
All records are covered by records retent ion schedules approved by the Division
of Library and Information Services.
Records can be migrated to new storage media or formats in order to avoid loss
due to media decay or technology obsolescence.
Provisions are made for pr oviding access to records wh ich are not exempt from
disclosure.
Records can be disposed of when they ha ve met their required retention. Disposal
might be destruction of reco rds or transfer to the Stat e Archives of Florida or a
local historic records repository for pe rmanent preservation. Destruction of
public records must be in accordance with Rule 1B-24.003(10), Florida
Administrative Code .
Records needed for legal discovery are w ithheld from disposal and retained in
their native format until litigation is resolved.
These recordkeeping requirements should be in corporated into the agency’s procedures
and apply when the agency contracts with a ny person or entity for services as well as
when systems are developed in house.
Document Electronic Recordkeeping Systems
Maintaining documentation of all agency system s that store electronic records is a best
practice for both records management and info rmation technology; of ten, but not always,
the IT program maintains such documentation. Documentation does not necessarily have
to be completely separate for each and every application, as long as it is sufficient to
ensure preservation and access to all of the records for as long as they need to be
maintained by the agency.
Agency RM and IT staff should work together to ensure the development of up-to-date
documentation for all agency electronic records systems that is adequate to specify all
technical characteristics nece ssary for reading or processi ng the records and the timely,
authorized disposition of records. Docume ntation includes written descriptions and
procedures that provide information about a computer program or a computer system so
that it can be properly used and main tained. The documentation should also:
Identify all defined inputs and outputs of the system,
Define the contents of the files and records,
Determine restrictions on access and use,
Provide an understanding of the purpose(s) and function(s) of the system, and
25
State of Florida Electronic Records and Records Management Practices
Describe update cycles or conditions and rules for adding information to the
system, changing information in it, or deleting information.
For purchased software, the documentation s upplied by the software vendor, along with
any agency-specific documentation that IT ma intains such as user permissions, etc.,
should be sufficient. The agency should deve lop similar documentation for software that
is developed in-house.
Agencies must establish and adopt procedures for external labeling of the contents of
diskettes, disks, tapes, and optical disks so that all authorized users can identify and
retrieve the stored information.
Refer to Rule 1B-26.003(7), Florida Administrative Code , for other specific
documentation standards and requirements. Re gardless of how an agency’s electronic
records are stored, subsection (7) of the rule is intended to ensure that all of the records
can be identified, accessed, and read.
Provide Training for Users of Electronic Records
Agencies must provide for users of the syst ems to be trained in the operation, care, and
handling of the equipment, software, media used in the system, and system security
controls.
Training for individuals who creat e, edit, store, retrieve, or dispose of records is an
important aspect of electr onic records management. Training should enable agency
personnel to identify public records, understa nd how records are file d in an electronic
recordkeeping system, how records are safegua rded, what procedures are used to edit
records, and how records should be dispos ed of according to legal requirements.
Agencies must ensure that record (master) copies of electronic records are maintained by
personnel properly trained in the use and handling of the records and associated
equipment.
Methods of providing training for the use a nd management of electronic records could
include one or more of the following:
Classroom training, offered several times a year on a recurring basis or as needed
for special situations.
A self-learning center within the agency, where operators can teach themselves at
their own rates of learning through intera ctive programs. The commercial tutorial
programs do not usually include records management information, but tutorials
teaching records management concepts for electronic records could be developed
by the agency.
26
State of Florida Electronic Records and Records Management Practices
Telephone "hotlines" or "help desks" staffed by knowledgeable computer support
professionals within the agency who can answer technical questions and provide
"quick fix" solutions. This process may not be an adequate learning tool for good
records management unless the computer support professionals have received
specialized records management training.
Training offered by the manuf acturer or vendor. This usua lly covers the operation
of computer hardware and software but does not include records management
concepts.
Essential Characteristics of Electron ic Records and Legal Admissibility
Managing and preserving electronic records can be challenging since they are easily
revised, deleted, changed, and manipulated. If appropriate measures are not taken, the
essential characteristics of records can be alte red or lost in the pr eservation process.
Careful planning and system design are re quired to guarantee that the essential
characteristics of electronic records are both captured and maintained for the lifetime of
the record.
The essential characteristics of electronic records are:
Content
- Information in the record that documents government business.
Content can be composed of numbers, text , symbols, data, images or sound. The
information content of a record should be an accurate reflection of a particular
business transaction or activity.
Context
- Information that shows how the record is related to the business of the
agency and other records. Contextual in formation is crucial to the evidentiary
function of records. If a record lacks key information about its creator, the time
of its creation, or its relations hip to other records, its value as a record is severely
diminished or lost entirely.
Structure
– Appearance and arrangement of a record’s content and technical
characteristics of the record (e.g., file format, data organization, relationship
between fields, page layout, style, font s, page and paragraph breaks, hyperlinks,
headers, footnotes). It is easier to pres erve a record over time if it has a simple
record structure. It is al so advisable to base record structure on open standards to
avoid dependence on a specific company or organization.
In order for records to serve as evidence, th ese three essential characteristics must be
maintained. Whenever one of the characterist ics is altered, the ability of records to
accurately reflect the activities of an agency is diminished.
Legal admissibility concerns whether a piece of evidence wo uld be accepted by a court of
law. If a record does not hold evidential we ight, it could potentia lly harm a case being
fought. If the authenticity and accuracy of the records can be demonstrated then they will
27
State of Florida Electronic Records and Records Management Practices
have evidential weight. There are two main elements that demonstr ate authenticity of
electronic records:
The system’s ability to “freeze” a record at a specific moment in time; and
Maintenance of a documented audit trail.
Section 92.29, Florida Statutes, provides that “photographic reproductions or
reproductions through electronic recordkeeping systems…shall in al l cases and in all
courts and places be admitted and received as evidence with a like force and effect as the
original would be…” To enhance the legal ad missibility of electronic records, Rule 1B-
26.003, Florida Administrative Code , requires that agencies:
Document that similar kinds of records generated and stored electronically are
created by the same processes each time and have a standardized retrieval
approach.
Substantiate that security procedures prevent unauthorized addition, modification,
or deletion of a record and ensure systems are protected against such problems as
power interruptions.
Identify the electronic media on which records are stored throughout their life
cycle, the maximum time span that records remain on each storage media, and the
official retention requirements as a pproved by the Division of Library and
Information Services.
Sustainable Formats
Typically, agencies select electronic fo rmats based on business needs and current
technical requirements. Selected formats mu st be sustainable, that is accessible both
throughout their lifecycle and as technology ev olves, regardless of the technology used
when it was originally created. A sustainable format is one that increases the likelihood
of a record being accessible in the future. Formats that are not sustainable may cause
records to become obsolete and inaccessible before they are eligible for deletion as
authorized in the approved r ecords retention schedule.
Rule 1B-26.003, Florida Administrative Code , defines long-term records as those with a
retention requirement of more than 10 years. When records need to be maintained over
the long term (susta inability), agen cies should consider each of the following
characteristics of formats:
Published Documentation and Open Disclosure
- Publicly and openly
documented formats adhere to specificati ons that are published and accessible.
Publicly accessible specifica tions allow developers to create a wide variety of
applications to read, process, and validate files. Openly documented
specifications assist developers in cr eating tools to access the information in
obsolete formats, and/or assist in migrati ng files to future formats. Tagged Image
28
State of Florida Electronic Records and Records Management Practices
File Format (TIFF) and Portable Document Format (PDF) are examples of
formats based on a publicly available, authoritative specification for scanned
images.
Widespread Adoption and Use
- Formats adopted for widespread use have a
higher probability of being sustainable over time. When a format has been widely
adopted by users, multiple software tools are created to open, read, and access the
records and the market supports ongoing sust ainability of the file format. This
extends the time that the information can be maintained in the format using
readily-available tools. The adoption of a file format by information creators,
disseminators, and users is an indicato r of sustainability. Hyper-text Markup
Language (HTML) is an example of a form at that has been widely adopted for
Internet use.
Self-describing Formats
- Self-describing formats contain metadata needed to
interpret the content, context, and/or st ructure of the record. Metadata embedded
within the format minimizes reliance on external documentation and the risk of
disassociation of metadata from the file over time. While self-describing formats
provide the capability for including metadata (e.g., in the file header or through
tags within the file structure), they may not necessarily mandate it in the format
specification. If present, the metadata should be easily accessed. This ensures
that descriptive information about the reco rd is sustainable. Extensible Markup
Language (XML) is an example of a self-documenting format because it describes
its structure and field names.
When agencies use formats that exhibit these characteristics, they increase the likelihood
that the information will be accessible over the long term.
When creating electronic records or conve rting source data, agencies can enhance
sustainability by maintaining th e original quality of source data. The following methods
are typically applied through so ftware settings and vary depending on the format being
used.
Technical Protection Mechanisms
- Long-term records should be unrestricted
and/or unencrypted so that user IDs and/or passwords ar e not needed to maintain
the file. User IDs and passwor ds can be lost over time.
Maintain Integrity of Source Data
- When using compression to reduce file
size, agencies should use lossless compressi on to maintain the integrity of source
data. Lossless compression produces sma ller file sizes without removing any
information. Maintaining the original qual ity of source data ca n facilitate future
migration and conversion. Minimizing subsequent modification of the records
after production is also recomme nded to maintain integrity.
While selecting appropriate formats does not guarantee sustainability, it does
significantly increase the probability that those records will remain accessible and
readable for as long as necessary. Of cour se, agencies need to follow other record
29
State of Florida Electronic Records and Records Management Practices
policies and procedures governing creation a nd management of el ectronic records and
adhere to approved records re tention schedules to furthe r ensure that records are
maintained properly.
Selecting Storage Media
As specified in Rule 1B-26.003(10), Florida Administrative Code , agencies must select
appropriate media for storing record (mas ter) copies of electronic public records
throughout their life cycle that m eet the following requirements:
Permit easy and accurate retrie val in a timely fashion;
Retain the records in a usable format until their authorized disposition; and
When appropriate, meet the requirements necessary for transfer to the State
Archives of Florida.
Agencies should consider the following fact ors before selecting a storage media or
converting from one media to another:
The authorized reten tion of the records;
The maintenance necessary to retain the records;
The cost of storing and retrieving the records;
The access time to retrieve the stored records;
The portability of the medium (can be read by multiple manufacturer’s
equipment);
The ability to transfer the informa tion from one medium to another.
When storing permanent or long-term records, agencies must adhere to additional
standards. Long-term records are defined as those that have an established retention of
more than 10 years.
Agencies shall not use floppy disks, audio cassettes, or VHS-format video
cassettes for the storage of record (mas ter) copies of permanent or long-term
records.
Permanent or long-term records on magneti c tape shall be stored on polyester-
based media.
Agencies shall use only previously unreco rded audio or video tape for record
(master) copies of permanent or l ong-term audio or video recordings.
30
State of Florida Electronic Records and Records Management Practices
A scanning density with a minimum of 300 dots per inch (dpi) is required for
scanned images created by the agency fr om hard copy permanent or long-term
records.
Record (master) copies of scanned images created by the agency from hard copy
permanent or long-term records must be in accordance with a published
International Organization for Standardiza tion (ISO) open standard image format.
Published standards can be found at http://www.iso.org/iso/home.htm . There is
no specific image format requirement for r ecords with a retention of less than 10
years, although the agency must ensure that the records remain accessible and
readable for as long as they are retained.
Using CDs and DVDs for Storage
CDs and DVDs are not recommended for storing the record copy of permanent or long-
term records. If you choose to use CDs and DVDs for storing short-term records, you
should understand their pr operties and limitations.
Compact Disk-Read Only Memory (CD-ROM) is a type of optical disk capable of storing
up to 1GB (gigabyte) of data - although th e most common size is 650MB (megabytes). A
8
single CD-ROM has enough memory to store about 300,000 text pages.
Digital Versatile Disk or Digital Video Disk (DVD) is a type of op tical disk technology
similar to the CD-ROM. A DVD holds a minimum of 4.7GB of data with enough
memory for a full-length movie. DVDs are commonly used as a medium for digital
representation of movies and other multimed ia presentations that combine sound with
9
graphics.
CD-R stands for CD-Recordable; DVD- R stands for DVD-Recordable. With CD-
R/DVD-R, data can be recorded once, after which the disk becomes read-only. Use only
CD-R/DVD-R disks for storing short-term r ecords. These disks provide protection for
your records against tampering or loss of data.
CD-RW/DVD-RW stands for CD Re-Writabl e or DVD Re-Writable. Rewritable media
are not appropriate for electroni c records storage or retention. RW disks can be written to
multiple times. The film layer on RW disks degrades at a faster rate than the dye used in
CD-R/DVD-R disks, especially with frequent recording and re-writing.
CD and DVD media often support multiple logi cal and physical formats that determine
the hardware and software that will be require d to read from the disks in the future. For
example, Apple computers can read and write CDs in the HFS+ logical format while PCs
running Microsoft Windows operating systems us ually read and write CDs using the ISO
9660 logical format with Joliet extensions.
8
www.webopedia.com .
9
www.webopedia.com .
31
State of Florida Electronic Records and Records Management Practices
The color of a CD/DVD indicates its quality. It is best to look for a gold or silver
CD/DVD; look at the color from the underside of the disk, not the top. In addition, to
assure the highest quality of a CD-R, look fo r those manufactured using phthalocyanine
dye with gold or silver reflec tive layers. Do not use Azo- or (plain) cyanine-dyed media.
For DVD-Rs, purchase double-sided/single-layer with a gold reflective underside. To
assure you're using the highest quality CD/DVD and/or to avoid pitfal ls in purchasing the
correct type, refer to the sour ce references below (page 33).
It is best to purchase new CDs/DVDs as they are needed. According to the Optical
Storage Technology Association (OSTA), th e unrecorded shelf life of a CD-R/DVD-R
10
disk is conservatively estimated to be between 5 and 10 years.
CD/DVD experiential life expectancy is 2 to 5 years even though published life
expectancies are often cited as 10 years, 25 years, or longer. A variety of factors
discussed in the source references below (pag e 33) may result in a much shorter life span
for CDs/DVDs. Life expectancies are sta tistically based; any specific medium may
experience a critical failure before its life expectancy is reached. Additionally, the quality
of your storage environment may increase or d ecrease the life expectan cy of the media.
We recommend testing your media at least ever y two years to assure your records are still
readable.
Agencies should develop policie s and procedures to ensure access to electronic records
stored for a long duration on CDs or DVDs. Some things you should consider as you
develop your policies an d procedures are:
The disk should be read immediately afte r writing and/or be fore storing it to
verify that what was writte n is what was intended, that it is readable, and that it
conforms to your inventory.
Disks might only be readable on the specifi c drive on which they were originally
recorded or on some other compatible drive.
The data recorded onto CDs/ DVDs should not be "zipped."
A detailed inventory of the content of each CD/DVD should be created and maintained.
This includes information sufficient to locat e an individual record, including identifiers
that maintain the uniqueness of the record w ithin the collection. To ensure the records
contained on the CD/DVD can be retrieved and/or migrated when necessary, include the
name and version of the software applicati on for each file (e.g., Microsoft Word 2007) on
your detailed inventory.
Disks should be handled only by the outer edge or the center hole, never by touching the
surface. Fingerprints can disrupt the track ing of the laser on the disk. Follow the
manufacturer's instructions to remove any dirt, fingerprints, or smudges.
10
http://www.osta.org/technology/cdqa13.htm .
32
State of Florida Electronic Records and Records Management Practices
CDs and DVDs and their containers should be la beled so that they can be identified and
organized according to your inventory. Ma ny vendors sell CD-safe markers. For risk-
free labeling of any disk, it is best to mark the clear inner hub or the so-called mirror
band of the disk where they contain no data . Do not apply adhesive labels to the
CD/DVD because they can damage the disk.
Disks are best stored upright (like a book) in "jewel" cases that are designed specifically
for CDs/DVDs. Ideally, store the cases in plastic or steel containers manufactured
specifically for the type of medium in cool, dry storage that is free of large temperature
fluctuations. Generally, useful life will be in creased by storing disks at a low temperature
and low relative humidity, since chemical de gradation is reduced in these conditions.
Store at 62-70 degrees Fahrenheit and 35-50% relative humidity. Daily fluctuations in the
storage area should not exceed +/- 2 degrees Fahrenheit in temperature or +/- 5% in
relative humidity.
When short-term records reach the end of thei r retention period, or if damage occurs to
media while in storage, you will want to ensure that the data are irretr ievable. See section
Destruction of Electronic Records
on (page 13).
The following sources provide additional resources and publications on electronic storage
media:
NIST Special Publication 500-252, "Infor mation Technology: Care and Handling
of CDs and DVDs: A Guide for Librarians and Archivists," published by the U.S.
Department of Commerce, National In stitute of Standards and Technology
( http://www.itl.nist.gov/iad/894.05/docs/ CDandDVDCareandHa ndlingGuide.pdf );
Digital Preservation Guidance Note: "Car e, Handling and Storage of Removable
Media," from United Kingdom Digital Pres ervation Department of The National
Archives ( http://www.nationalarchives .gov.uk/documents/media_care.pdf );
"Using CDs for Data Storage," from the School of Library, Archival, and
Information Studies, University of British Columbia, Canada
( http://www.slais.ubc.ca/P EOPLE/students/student-
projects/C_Hill/hill_libr516/index.htm );
Professional organizations such as the Association of Reco rds Managers and
Administrators (ARMA, www.arma.org ), and the Association of Image and
Information Management (AIIM, www.aiim.org );
The Optical Storage Technology Association (OSTA, http://www.osta.org/ ); and
Report: "Relative Stabilities of Optical Disk Formats," Joe Iraci, in the
Restaurator - International Journal for th e Preservation of Library and Archival
Material (2005) ( http://www.uni-muenster.de/Forum-
Bestandserhaltung/ downloads/iraci.pdf ).
33
State of Florida Electronic Records and Records Management Practices
File Naming
Managing electronic files can be overwhelm ing if there is no organized method for
naming and storing files. Effici ent electronic filing practices he lp to ensure that files can
be retrieved quickly and with the lowest possible cost.
File naming is an important part of managing a ny system of records. A file name is the
principal identifier for a record. Having a unified naming system can help place records
in context with other records as well as associ ated record series and retention schedules.
Records that are named using a consistent, lo gical system can be more easily located and
shared among users. Agencies may want to consider an agency-w ide file naming policy
as part of their strategy fo r managing electronic records.
When developing a file naming policy, consider including as part of the file name some
of the following common conventions:
Version number (e.g., vers ion 1 [v1, vers1])
Date of creation (e.g., April 14, 2010 [04142010, 04_14_2010])
Name of creator (e.g., Edward N. Johnson [ENJohnson, ENJ])
Description of content (e.g., media kit [medkit, mk])
Name of intended audience (e.g., general pub lic [pub])
Name of group associated with the record (e.g., Committee ABC [CommABC])
Release date (e.g., released on Marc h 24, 2008 at 10:30 a.m. eastern time
[03242008_1030ET])
Publication date (e.g., publishe d on December 31, 2009 [pub12312009])
Project number (e.g., project number 625 [PN625])
Department number (e.g., Department 126 [Dept126])
Records series (e.g., Series2036)
The following issues should also be considered when developing a file naming policy:
Access and ease of use. The policy shoul d be simple and straightforward. A
simple policy will help staff members logically and easily name records and help
ensure that records are accessible to sta ff members and/or to the public. A simple
policy will be more consistently used, resu lting in records that are consistently
named and thus easier to organize and access.
34
State of Florida Electronic Records and Records Management Practices
Ease of administration. The policy should work with your computer
infrastructure, so that you can monitor policy compliance, manage records and
records series, gather metadata (metadata in the context of records management is
data describing context, c ontent, and structure of re cords and their management
through time), and perform other administ rative tasks easily and in compliance
with all legal requirements. For example, if all the records in a specific record
series are easily identifiable by file name, they will be easier to gather and
manage.
Uniqueness. To avoid file names conflicting when they are moved from one
location to another, each record's file name should be unique. Having multiple
files with the same name is confusing a nd there is the danger that a file might
automatically overwrite another file w ith the same name. How you arrive at
unique file names will require some thought. Once you have developed a system,
it is important to standardize and adhere to it.
Version control. Determine how and whethe r to indicate the version of the record.
Sometimes current and obsolete drafts are put in different electronic file folders
without altering the file name. However, when these records are moved from the
active electronic file folder to another storage area, identical file names may
conflict and cause confusion.
Scalability. Consider how scalable your file naming policy needs to be. For
example, if you want to include the project number, don't limit your project
numbers to two digits, or you can only have ninety-nine projects.
Persistence over time. File names s hould outlast the records creator who
originally named the file. With good sta ff input, and training, you should be able
to develop file names that make sense to staff members once the file creators are
no longer available.
Automated Systems to Manage Electronic Records
Agencies may want to consider acquiring co mputer software written specifically to
manage electronic records. These systems can be costly and require a substantial
commitment to implement, but they offer features that help control documents and
records and some have built in records mana gement features to help safeguard the
agency’s records. Agencies considering acquiring such systems should understand the
differences in the types of system available.
Electronic Records Management Systems (ERMS) are designed primarily to manage an
organization’s electronic record s, although they can be used for some physical records
management functions also. ERMS functiona lity includes capture of electronic records
and their accompanying metadata, discovery, records retention in accordance with set
schedules or rules, authorized disposition, litigation holds, and other functionality
designed to ensure the appropriate maintena nce, accessibility, authenticity, and security
of records for as long as required by the organization.
35
State of Florida Electronic Records and Records Management Practices
Electronic Document Management Systems (EDMS) are also widely used in
organizations to control the creation, use, and destruction of electronic documents to
facilitate workflow. EDMS often lack some of the functionality needed to fully manage
records but support such func tions as indexing of docum ents, storage management,
version control, close integration with deskt op applications, and retr ieval tools to access
the documents.
Some systems, known as Electronic Docu ment and Records Management Systems
(EDRMS), combine ERMS and EDMS functiona lity into one integrated system. The
chart below compares EDMS and ERMS feat ures and shows important distinctions
between them.
An EDMS… An ERMS…
• •
allows documents to be prevents records from being
modified and/or to exist in modified;
•
several versions; prevents records from being deleted
•
may allow documents to except in certain strictly controlled
be deleted by their circumstances;
owners; •
must include rigorous retention
•
may include some controls;
•
retention controls; must include a rigorous record
•
may include a document arrangement structure (classification
storage structure, which scheme) which is maintained by an
may be under the control administrator;
•
of users; may support day-to-day working, but
•
is intended primarily to is also intended to provide a secure
support day-to-day use of repository for business records.
documents for ongoing
business.
The United States Department of Defense (D oD) has developed func tional requirements
and standards for that Department’s electr onic records management systems which can
be helpful to Florida agencies planning to ac quire these types of systems. DoD standard
DoD 5015.2-STD, Electronic Records Management Software Applications Design
Criteria Standard, April 25, 2007, is a requi rement for DoD records management
applications and is endorsed by the National Archives for use by all federal agencies.
The federal government certifies compliant soft ware as meeting the requirements of the
DoD standard and provides a list of certifie d products. The standard is available at
http://www.dtic.mil/whs/dir ectives/corres/pdf/501502std.pdf and the register of
compliant software applications is available at
http://jitc.fhu.disa.mil/recmgt/register.html . While not a requirement for Florida
agencies, the DoD standard can serve as a useful reference for evaluating ERMS software
and a basis upon which agencies can deve lop their own functi onal requirements.
Another useful resource is the Europ ean Commission’s Model Requirements for the
Management of Electronic Records (MoReq2) . This publication is a model set of
requirements that users can adapt to their n eeds when developing or selecting systems for
36
State of Florida Electronic Records and Records Management Practices
managing electronic records. This document is very readable and has practical advice for
evaluating and selecting these sy stems. It is available at
http://ec.europa.eu/transparency/archival_policy/moreq/doc/moreq2_spec.pdf .
37
State of Florida Electronic Records and Records Management Practices
Frequently Asked Questions (FAQ)
1. What are the requirements for scanning public records?
Public records must be scanned in accordance with Rule 1B-26.003, Florida
Administrative Code . For records with a minimum rete ntion of over 10 y ears, the rule
states that the records must be scanne d at a minimum 300 dpi and use “a published
International Organization for Standardiza tion (ISO) open standard image format.”
These formats include TIFF, PDF, PDF/A, and ot hers. To find out if a particular format
is ISO-approved, go to the ISO website at http://www.iso.org/ and search for the format
(e.g., search for PDF, TIFF, etc.).
For records with a minimum retention requireme nt of 10 years or less, any dpi and image
format can be used; however, the agency st ill must ensure that the records remain
accessible and readable for as long as they are required to be retained.
2. If I scan my records, can I get rid of the original hard copy?
In general, scanned images of public record s can be designated as the record (master)
copies of the records, and the original ha rd copy can be designated as duplicates and
disposed of when no longer needed, provide d that the electronic records are in
compliance with Rule 1B-26.003, Florida Administrative Code , and the completeness
and accuracy of the scanned copies have been verified. The electronic version can then
be designated the record (master) copy and as such must be retained for the length stated
in the applicable retention schedule and in accordance with Rule 1B-26.003, Florida
Administrative Code . The paper original can then be designated as a duplicate and
disposed of at any time.
However, Rule 1B-24.003(9)(a), Florida Administrative Code , states “… An agency that
designates an electronic or microfilmed copy as the reco rd (master) copy may then
designate the paper original as a duplicat e and dispose of it in accordance with the
retention requirement for duplicates in the applicable retention schedule unless another
law, rule, or ordinance speci fically requires its retention.” Although this is a rare
exception, we recommend that agencies consul t with their legal c ounsel for guidance if
they are unsure if their records have to be maintained in paper form.
3. How long do we have to keep our e-mail?
Retention of e-mail and other electronic commun ications, as with rete ntion of records in
any other format, is based on the content of the particular e-mail or electronic message.
As stated in the General Records Schedule GS1-SL for State and Local Government
Agencies :
ELECTRONIC COMMUNICATIONS
There is no single retention peri od that applies to all electron ic messages or communications,
whether they are sent by e-mail, instant me ssaging, text messaging (such as SMS, Blackberry
38
State of Florida Electronic Records and Records Management Practices
PIN, etc), multimedia messaging (such as MMS), chat messaging, social networking (such as
Facebook, Twitter, etc.), or any other current or future elec tronic messaging technology or
device. Retention periods are determined by the c ontent, nature, and purpos e of records, and are
set based on their legal, fiscal, administrative, and historical valu es, regardless of the format in
which they reside or the method by which they are transmitted. Electr onic communications, as
with records in other formats, can have a variet y of purposes and relate to a variety of program
functions and activities. The retention of any pa rticular electronic message will be the same as
the retention for records in any other format that document the same program function or
activity. For instance, el ectronic communications might fall under a CORRESPONDENCE
series, a BUDGET RECORDS series, or one of numerous other series, depending on the content,
nature, and purpose of each message. Electronic communications that are created primarily to
communicate information of short-term value, such as messages reminding employees about
scheduled meetings or appointments, might fall under the "TRANSITORY MESSAGES" series.
The retention requirements are based on the na ture, content, and purpose of the records
and not on the physical format in which they exist.
4. If we print out our e-mail messages, do we also have to keep them in electronic
form?
Printouts of e-mail files are ac ceptable in place of the electronic files provided that the
printed version contains all date/time stamps, routing information, etc. This information
usually prints automatically at the top of each printed e-mail and includes name of the
sender, names of all recipien ts (including To, CC, and BCC), date/time sent or received,
subject line, and an indicati on if an attachment was pr esent (attachments should be
printed and retained with the printed e-mail). This can be applied broadly to other types
of electronic records that you are going to pr int and retain only in paper form. Any
metadata that is necessary to understanding the nature and content of the record should be
printed along with the record.
E-Discovery
However, as indicated in the section (page 18), in the event of litigation or
reasonably anticipated litigation, existing record s in electronic form must be maintained
in their current electronic format until all legal discovery issues are closed.
5. How long do we have to keep our back -ups? Should we k eep e-mail back-ups
permanently in case they are ever needed?
As stated in the General Records Schedule GS1-SL for State and Local Government
Agencies:
BACKUP TAPES
There is no retention schedule for back-up tape s or other forms of data back-up. A back-
up tape or drive should be just that: a data /records back-up kept solely as a security
precaution but not intended to serve as the reco rd copy or as a record s retention tool. In
the case of disaster, the back-up would be used to restore lost records; otherwise, agency
records that have not met their retention s hould not be disposed of on the basis of the
existence of a back-up. If for any reason (for instance, a disaster erases e-mails on your
39
State of Florida Electronic Records and Records Management Practices
server) the only existing copy of an item that has not met its retention period is on a back-
up tape or drive, the custodial agency of that record must ensure that the record on the
back-up is maintained for the appropriate re tention period. A back-up containing record
copies or the only existing copi es of records that have not passed their retention would
have to be retained for the length of the l ongest unmet retention pe riod. Preferably, the
records should be restored to an accessible storage device from the back-up to ensure that
the back-up is not used as a records retention tool.
6. Are postings or messages on our website, Facebook page, or Twitter site public
records? If so, how long do we have to keep them?
If postings on a website or so cial networking site meet the definition of a public record,
then they would, indeed, be public records. The retention of the postings will be
determined by the content, nature, and purpose of the posting. Just like e-mail and other
forms of electronic communicati on, no single retention period would necessarily apply to
all of the postings.
Attorney General’s Opinion Number AGO 2009-19 (April 23, 2009) states the following
regarding Facebook pages established by a city – this will of course apply to any public
agency maintaining a Facebook page:
Since the city is authorized to exercise powers for a municipal purpose, the
creation of a Facebook page must be for a municipal, not private purpose. The
placement of material on the city’s page would presumably be in furtherance of
such purpose and in connection with the transaction of official business and thus
subject to the provisions of Chapter 119, Fl orida Statutes. In any given instance,
however, the determination would have to be made based upon the definition of
"public record" contained in se ction 119.11, Florida Statutes. . .
The city is under an obligation to follo w the public records retention schedules
established by law. . .
Communications on the city’s Facebook pa ge regarding city business by city
commissioners may be subject to Florid a’s Government in the Sunshine Law,
section 286.011, Florida Statutes. Thus, me mbers of a city board or commission
must not engage on the city’s Facebook page in an exchange or discussion of
matters that foreseeably will come befo re the board or commission for official
action. . .
It is the nature of the record created ra ther than the means by which it is created
which determines whether it is a public record.[5] The placement of information
on the city’s Facebook page would app ear to communicate knowledge. Thus, the
determination in any given instance as to whether information constitutes a public
record will depend on whether such information was made or received in
connection with the tran saction of official business by the city. . .
Similarly, a 2009 Department of State’s Genera l Counsel’s Office opini on states that “A
posting or comment to a state agency page on a social networking site is a public record
40
State of Florida Electronic Records and Records Management Practices
when the content of the posting or comment sa tisfies the definition of “public record” in
section 119.011(12), Fla. Stat. (2008). . . thos e comments whose content falls within the
definition of public record must be reta ined by agencies in accordance with the
appropriate Division re tention schedules.”
If you post a copy of a public record (such as the minutes of a meeti ng) to a website or
social networking site, it is not necessary to maintain that Web copy indefinitely as long
as you retain the record copy in your office in accordance with the applicable retention
schedule.
So it is the nature, content, and purpose of the record that will determine if it meets the
definition of public record and, if so, what th e retention of that record would be. While
some Twitter messages (“tweets”) might indeed be transitory messages, other “tweets”
might fall under other retention schedules , such as one of the CORRESPONDENCE
items, again depending on the content of the me ssage. Just as with public records in any
other form, agencies will need to determin e the appropriate retention item based on the
nature, content, and purpose of th e record and ensure that it is retained for that period of
time.
One possible option when using Facebook or so me other social networking technologies
is to disallow postings from outside sour ces, thus saving the agency the trouble of
determining and implementing retention requ irements for those out side postings. If
outside postings are allowed, the agency will need to find a way to ensure the appropriate
We advise agencies to carefully
retention of those postings th at are public records.
consider public records access and retenti on requirements, responsibilities, and
implications when considering the use of any social networking technologies.
7. What are Florida’s requirements for electronic signatures?
The statutory governance for electronic signat ures is Florida’s Electronic Signature Act
of 1996, Section 668.001-006, Florida Statutes, a nd Uniform Electronic Transaction Act,
Section 668.50, Florida Statutes . In particular, the follo wing sections may apply:
668.004 Force and effect of electronic signa ture.--Unless othe rwise provided by
law, an electronic signature may be used to sign a writing and shall have the same
force and effect as a written signature.
668.50(7) LEGAL RECOGNITION OF ELECTRONIC RECORDS,
ELECTRONIC SIGNATURES, AN D ELECTRONIC CONTRACTS.—
(a) A record or signature may not be deni ed legal effect or enforceability solely
because the record or signat ure is in electronic form.
(b) A contract may not be denied legal e ffect or enforceability solely because an
electronic record was used in th e formation of the contract.
41
State of Florida Electronic Records and Records Management Practices
(c) If a provision of law requires a record to be in writing, an electronic record
satisfies such provision.
(d) If a provision of law requires a signatu re, an electronic signature satisfies such
provision.
668.50(13) ADMISSIBILITY IN EVIDENCE .--In a proceeding, evidence of a
record or signature may not be excluded so lely because the record or signature is
in electronic form.
In essence, unless otherwise specified by law or administrative rule, digital signatures are
acceptable. Agencies are advised to review Chapter 668, Florida Statutes, as well as
consult with their lega l counsel for further guidance on this issue.
42
State of Florida Electronic Records and Records Management Practices
APPENDIX A
APPENDIX A - Department of State E-Mail Policy
Florida Department of State
Policies and Procedures
ELECTRONIC MAIL POLICY
1. Scope
This policy provides guidelines for the manage ment and usage of electronic mail (e-mail)
messages as public records within the Florida Department of State (“Department”). This
policy applies to the entire Department workforce with access to the Department’s e-mail
system including all offices, divisions, bureaus, advisory bodies, and contract agents of the
Department in the conduct of their o fficial duties as prescribed by law.
This policy does not provide specific procedures for system backups or “archiving” of
inactive e-mail. Employees should refer to intern al Department operating procedures for this
information.
2. Purposes
The purposes of this policy are to:
a. Ensure that Department employees comply with Florida’s Public Records Law, Chapter
119, Florida Statutes, when using the Department’s e-mail system;
b. Ensure that Department employees properly ma nage and retain e-mail as public records in
accordance with applicable records mana gement statutes and rules; and
c. Ensure proper usage of the Department's e- mail system and that us ers understand the types
of e-mail usage that are considered inappr opriate and a violation of this policy.
3. Authority
a. Chapters 119, 257, and 282, Florida Statutes;
b. Rules 1B-24 and 60DD-2, Flor ida Administrative Code.
4. Definition of E-Mail
E-mail is the electronic transfer of information, typically in the form of electronic messages,
memoranda, and attached documents, from a sendi ng party to one or more receiving parties
by means of an intermediate telecommunications system.
5. E-Mail as a Public Record
a. E-mail which is created or received by a Department employee in connection with the
transaction of official business of the Department is considered a public record and is subject
to inspection and/or copying in accordance with Chapter 119, Florida St atutes, and is subject
to applicable state retention laws and regul ations, unless expressly exempted by law.
b. E-mails created or received for personal use are not generally consid ered public records and
do not fall within the definition of public records by virtue of their placement on a
43
State of Florida Electronic Records and Records Management Practices
APPENDIX A
Department of State Policies and Procedure
Electronic Mail Policy
Page 2 of 4
government-owned computer system. However, if the Department discovers misuse of the e-
mail system, personal e-mails that are identified as being in violati on of Department policy
may become public record as part of an investigation.
c. The Florida Statutes contain numerous spec ific exemptions to th e access and inspection
requirements of the Public Records Law. Em ployees are responsible for ensuring that
electronic public records which are exempt fr om access or inspection by statute are properly
safeguarded.
6. Use of E-Mail System
a. The Department's e-mail system is to be us ed to conduct official Department business and
is not to be used for any other purpose unle ss expressly approved by au thorized Department
officials. E-mail may be used to communicate wi th Department staff and with other public
and private entities to conduct o fficial Department business.
b. Incidental, personal use of the e-mail system is permitted; however, the personal use must
be brief, must not interfere w ith the employee's work or the wo rk of others, must not subject
the Department to any additional cost, and must not be prohibited by this policy or any
federal, state or local law, statut e, ordinance, rule or regulation.
7. Prohibited Uses of E-Mail
The Department's e-mail system shall not be us ed for any unauthorized purpose including, but
not limited to:
a. Sending solicitations including, but not limited t o, advertising the sale of goods or services
or other commercial activities, which have not been approved by the Department.
b. Sending copies of documents in violation of copyright laws or licensing agreements.
c. Sending information or material prohibited or restricted by government security laws or
regulations.
d. Sending information or material which may reflect unfavorably on the Department or
adversely affect the Department’s ability to carry out its mission.
e. Sending information or material which may be perceived as representing the Department’s
official position on any matter when authority to disseminate such information has not been
expressly granted.
f. Sending confidential or proprietary information or data to persons not authorized to receive
such information, either within or outside the Department.
g. Sending messages or requesting info rmation or material that is fraudulent, harassing,
obscene, offensive, discriminator y, lewd, sexually suggestive, sexually explicit, pornographic,
44
State of Florida Electronic Records and Records Management Practices
APPENDIX A
Department of State Policies and Procedure
Electronic Mail Policy
Page 3 of 4
intimidating, defamatory, derogatory, violent or which contains pr ofanity or vulgarity ,
regardless of intent. Among those which are cons idered offensive includ e, but are not limited
to, messages containing jokes, slurs, epithets, pictures, caricatures, or other material
demonstrating animosity, hatred, disdain or contempt for a person or group of people because
of race, color, age, national origin, gender, religious or political beliefs, marital status,
disability, sexual orientation or any ot her classification protected by law.
h. Sending messages or requesting information re flecting or containing chain letters or any
illegal activity, including, but not limited to gambling.
i. Sending or requesting information or material that proselytizes or promotes a religious or
political view, cause, position or action.
8. No Right of Privacy
Department employees have no right of personal privacy in any material created, stored in,
received, or sent over the De partment’s e-mail system. The Department reserves and may
exercise the right, at any time and without prior notice or permission, to intercept, monitor,
access, search, retrieve, record, copy, inspect, review, bl ock, delete and/or disclose any
material created, stored in, re ceived, or sent over the Department’s e-mail system for the
purpose of protecting the system from unauthori zed or improper use or criminal activity.
9. Retention Requirements for E-Mail
a. All public records must have an approved re tention schedule in place before they can be
destroyed or otherwise disposed of. Retention periods are determined by the content, nature
and purpose of records, and are set based on thei r legal, fiscal, admini strative and historical
values, regardless of their form. Therefore, th ere is no single retention schedule that would
apply across the board to all e-mails. E-mail, lik e other records, irresp ective of its form, can
have a variety of purposes and relate to a va riety of program functi ons and activities. The
retention period of any particular e-mail message will generally be the same as the retention
for records in any other form that documen t the same program function or activity.
b. Department employees are required to relate e ach e-mail that is created or received by the
employee through the Department's e-mail system to the activity it documents, as well as to
other records documenting that activity, and ap ply the appropriate retention period based on
that activity or function. Approve d retention schedules for State Government Agencies can be
found at http://dlis.dos.state.fl.us/recordsmgmt/gen_records_schedules.cfm
c. It is the responsibility of each Department employee to ensure that e-mail and other public
records in their custody are maintained for the required retention period(s). Although the
Department routinely backs up its servers, each back-up is mainta ined only briefly for disaster
recovery purposes and therefore cannot be rega rded as a tool for meeting public records
retention requirements.
45
State of Florida Electronic Records and Records Management Practices
APPENDIX A
Department of State Policies and Procedure
Electronic Mail Policy
Page 4 of 4
10. Transitory Messages
Many, though not all, e-mails fall under th e retention schedule for "TRANSITORY
MESSAGES" (General Records Schedule GS1-SL for State and Local Government Agencies,
Item #146). "Transitory Messages" are messages th at do not set policy, esta blish guidelines or
procedures, certify a transaction or become a receipt. For instance, an e-mail message
notifying employees of an upcoming meeting w ould only have value until the meeting has
been attended or the employee receiving the me ssage has marked the date and time in the
calendar. The informal nature of transitory messages might be compared to a telephone
conversation or a conversation in an office hallw ay. The retention requirements for Transitory
Messages is "Retain until obsolete, superseded or administrative value is lost." Therefore, e-
mails that fall into this category can be dis posed of at any time once they are no longer
needed.
11. Managing E-mail
Sorting e-mail into appropriate personal folders is a helpful way to manage these records and
to ensure that appropriate rete ntion requirements are id entified and met. That is, just as file
cabinets are set up to house diffe rent sets of files and employ ees know where to file paper
records in those files, e-mail files and folder s can be set up with th e appropriate retention
period designated for each of those files and folders. If no retention schedule exists for
records relating to a particular activity, then one must be es tablished and that retention
schedule would then apply to a ll documentation of that activity, regardless of form (paper,
film, electronic, etc.).
12. Violations
Violations of this policy may result in disciplinary action, up to and including termination of
employment.
APPROVED BY:
Original Signature on File
______________________________________
Dawn Roberts
Assistant Secretary of State/Chief of Staff
Date Approved: 4/18/07
This policy amends the Department’s E-Mail Po licy dated June 30, 2005, to update references to
the General Records Sc hedule in Section 10.
46
State of Florida Electronic Records and Records Management Practices
APPENDIX B
APPENDIX B - Records Inventory Worksheet
Fillable Worksheet form in Word format available at http://dlis.dos.state.fl.us/r ecordsmgmt/publications.cfm .
47
State of Florida Electronic Records and Records Management Practices
APPENDIX B
48
State of Florida Electronic Records and Records Management Practices
APPENDIX C
APPENDIX C - Rule 1B-26.003 Fl orida Administrative Code
1B-26.003 Electronic Recordkeeping.
(1) PURPOSE. These rules provide standards for record (master) copies of public records which reside in
electronic recordkeeping systems. Reco rdkeeping requirements must be in corporated in the system design
and implementation of new systems and enhancements to existing systems. Public records are those as
defined by Section 119.011(11), F.S.
(2) AUTHORITY. The authority for the establishment of th is rule is Sections 257.14 and 257.36(1) and (6),
F.S.
(3) SCOPE.
(a)1. These rules are applicable to all agencies as defined by Section 119.011(2), F.S.
2. These rules establish minimum requirements for th e creation, utilization, maintenance, retention,
preservation, storage and disposition of electronic re cord (master) copies, regardless of the media.
3. Electronic records include numeric, graphic, audio, video, and textual information which is recorded or
transmitted in analog or digital form.
4. These rules apply to all electronic recordkeeping systems, including, but not limited to, microcomputers,
minicomputers, main-frame computers, and image reco rding systems (regardless of storage media) in
network or stand-alone configurations.
(b) Before existing records are committed to an electro nic recordkeeping system, the agency shall conduct
a cost benefit analysis to insure that the proj ect or system contemplat ed is cost effective.
(4) INTENT. Electronic recordkeeping sy stems in use at the effective date of this rule, that are not in
compliance with the requirements of this rule, may be used until the systems are replaced or upgraded. New
and upgraded electronic recordkeeping systems created after the effective date of this rule shall comply
with the requirements contained herein. The Department is aware that it may not be possible to implement
this rule in its entirety immediately upon its enactment, and it is not the intent by this rule to disrupt
existing recordkeeping practices provided that agen cies make no further disposition of public records
without approval of the Division of Library and Information Services of the Department of State.
(5) DEFINITIONS. For the purpose of these rules:
(a) “ASCII” means the American Standard Code for In formation Interchange, a 7-bit coded character set
for information interchange which was formerly ANSI (American National Standards Institute) Standard
X3.4 and has since been incorporated into the Unic ode standard as the firs t 128 Unicode characters.
(b) “Database” means an organized co llection of automated information.
(c) “Database management system” means a set of so ftware programs that controls the organization,
storage and retrieval of data (fields, records and files) in a database. It also controls the security and
integrity of the database.
(d) “Digital signature” means a type of electronic sign ature (any letters, charact ers, or symbols executed
with an intent to authenticate) that can be used to authenticate the identity of the sender of a message or the
signer of a document and to ensure that the original content of the message or document that has been sent
is unchanged. Digital signatures can be created through hashing algorithms.
(e) “Electronic record” means any information th at is recorded in machine readable form.
(f) “Electronic recordkeepin g system” means an automated informati on system for the organized collection,
processing, transmission, and disse mination of information in accord ance with defined procedures.
(g)“Hashing algorithm” (hash function, checksum) means a formula or procedure for checking that
electronically transmitted messages or documents ha ve not been altered by transforming a string of
characters into a usually shorter fixed-length “hash valu e” or key that represents the original string. The
receiver of the message can execute the same hashin g algorithm as the sender and compare the resulting
hash values; any difference in the hash values indicates an alteration of the message or document sent.
Hashing algorithms can be used to create digital signatures.
(h) “System design” means the design of the nature and content of input, files, procedures, and output and
their interrelationships.
(i) “Permanent or long-term records” means any public records as defined by Section 119.011(11), F.S.
which have an established retention period of more than 10 years.
49
State of Florida Electronic Records and Records Management Practices
APPENDIX C
(j) “Record (master) copy” m eans public records specifically designat ed by the custodian as the official
record.
(k) “Geographic information system” means a comput er system for capturing, storing, checking,
integrating, manipulating, analyzi ng and displaying data related to positions on the Earth’s surface.
(l) “Open format” means a data format that is defined in complete detail, allows transforma tion of the data
to other formats without loss of information, and is open and available to the public free of legal restrictions
on use. An open format may be either standards-based or proprietary. (m) “Unicode” means the universal
character encoding standard maintained by the Unicode Consortium, providing the basis for processing,
storage, and interchange of text data in any language in all modern software and information technology
protocols.
(6) AGENCY DUTIES AND RESPONSIBILITIES. Each agency shall:
(a) Develop and implement a program for the management of electronic records.
(b) Ensure that all records are incl uded within records retention schedules, either by being included within
an applicable General Records Schedule, or by developing and obtaining approval for an individual
agency-specific records retention schedule in accorda nce with Rule 1B-24.003, F.A.C., Records Retention
Scheduling and Dispositioning.
(c) Integrate the management of electronic records with other records and information resources
management programs of the agency.
(d) Incorporate electronic records management objec tives, responsibilities, and authorities in pertinent
agency directives, or rules, as applicable.
(e) Establish procedures for addressing records management requirements, including recordkeeping
requirements and disposition, before approving, recommending, adopting, or implementing new electronic
recordkeeping systems or enhancements to existing systems.
(f) Provide training for users of el ectronic recordkeeping systems in the operation, care, and handling of the
equipment, software, and media used in the system.
(g) Ensure that agency electronic recordkeeping systems meet state requirements for public access to
records in accordance with Chapter 119, F. S.
1. STANDARD. Each agency which maintains public re cords in an electronic recordkeeping system shall
provide, to any person making a public records request pursuant to Chapter 119, F.S., a copy of any data in
such records which is not exempt from disclosure by statute. Said copy shall be on paper, disk, tape, optical
disk, or any other electronic storage device or media requested by the person, if the agency currently
maintains the record in that form, or as otherwise required by Chapter 119, F.S. Except as otherwise
provided by state statute, the co st for providing a copy of such data shall be in accordance with the
provisions of Sections 119.07(4), F.S.
2. STANDARD. Except as otherwise provided by law, no agency shall enter into a contract with, or
otherwise obligate itself to, any person or entity for electronic recordkeeping hardware, software, systems,
or services if such contract or obligation impairs the right of the public under state law to inspect or copy
the agency’s nonexempt public records, or impairs th e agency’s ability to retain the records in accordance
with established records retention schedules.
3. STANDARD. In providing access to electronic reco rds, agencies shall ensure that procedures and
controls are in place to maintain c onfidentiality for information which is exempt from public disclosure.
(7) DOCUMENTATION STANDARDS.
(a) STANDARD. Agencies shall develop and maintain adequate and up-to-date technical and descriptive
documentation for each electronic recordkeeping system to specify characteristics necessary for reading or
processing the records. Documentati on for electronic records systems sha ll be maintained in electronic or
printed form as necessary to ensure access to th e records. The minimum documentation required is:
1. A narrative description of the system, including all inputs and outputs of the system; the organization and
contents of the files and records; policies on access an d use; security controls; purpose and function of the
system; update cycles or conditions and rules for adding information to the system , changing information in
it, or deleting information; and the location and media in which electronic records are maintained and their
retention requirements to ensure appropriate dispos ition of records in accordan ce with Chapter 1B-24,
F.A.C.
2. The physical and technical charact eristics of the records, including a record layout or markup language
that describes each file or field including its name, si ze, starting or rela tive position, and de scription of the
form of the data (such as alphabetic, decimal, or numeric), or a data dictionary or the equivalent
50
State of Florida Electronic Records and Records Management Practices
APPENDIX C
information associated with a database management system including a description of the relationship
between data elements in databases;
3. For information coming from geographic information systems, the physical an d technical characteristics
of the records must be described including a data dic tionary, a quality and accuracy report and a description
of the graphic data structure, such as recommended by the federal Spatial Data Transfer Standards; and
4. Any other technical information need ed to read or process the records.
(8) CREATION AND USE OF ELECTRONIC RECORD S. Electronic recordkeeping systems that
maintain record (master) copies of public records on electronic media shall me et the following minimum
requirements:
(a)1. Provide a method for all authorized users of the system to retrieve desired records;
2. Provide an appropriate level of security to ensure the integrity of the records, in accordance with the
requirements of Chapter 282, F.S. Security controls should include, at a minimum, physical and logical
access controls, backup and recovery procedures, and training for cu stodians and users. Automated
methods for integrity checking should be incorporated in all systems that generate and use official file
copies of records. Hashing algorithms and digital signatu res should be considered for all official file copies
of electronic records. The use of automated integrity controls, such as hashing algorithms and digital
signatures, can reduce the need for other security controls. Hashing algorithms used to protect the integrity
of official file copies of record s should meet the requirements of US Federal Information Processing
Standard Publication 180-2 (FIPS- PUB 180-2) (August 1, 2002) entitled “Secure Hash Standard” (or
“Secure Hash Signature Standard”) which is hereby incorporated by reference, and made a part of this rule.
This publication is available from the National T echnical Information Service (NTIS), 5285 Port Royal
Road, U.S. Department of Commerce, Springfield, VA 22161, and at the Internet Uniform Resource
Locator: http://csrc.nist.gov/publications/fips/fips 180-2/fips180-2.pdf. Agencies utilizing hashing
algorithms shall only use validated implementations of hashing algorithms.
3. Identify the open format or standard interchange format when necessary to permit the exchange of
records on electronic media betw een agency electronic recordkeeping systems using different
software/operating systems and the conversion or migration of records on electronic media from one
system to another. For text records in the absence of other conversion capabilities, the word processing or
text creation system should be able to import and export files in the ASCII or Unicode format as prescribed
by the Unicode 5.0 Standard (or successor Unicode Standard), which is hereby incorporated by reference,
and made a part of this rule. This publication is av ailable from the Unicode Consortium, P.O. Box 391476,
Mountain View, CA 94039-1476, and at the Internet Uniform Resource Locator:
http://www.unicode.org/book/bookform.html; and
4. Provide for the disposition of the records including, when appropriate, transfer to the Florida State
Archives.
(b) STANDARD. Before a record (master) copy is cr eated on an electronic r ecordkeeping system, the
record shall be uniquely identified to enable author ized personnel to retrieve, protect, and carry out the
disposition of records in the system. Agencies shall ensure that records maintained in such systems can be
correlated with any existing related records on paper, microfilm, or other media.
(9) LEGAL AUTHENTICATION. Agencies shall implement the following procedures to enhance the legal
admissibility of electronic records:
(a) Document that similar kinds of records generate d and stored electronically are created by the same
processes each time and have a st andardized retrieval approach.
(b) Substantiate that security procedures prevent un authorized addition, modification, or deletion of a
record and ensure systems ar e protected against such problems as power interruptions.
(c) Identify the electronic media on which records are stored throughout their life cy cle, the maximum time
span that records remain on each storage media, and th e official retention require ments as approved by the
Division of Library and Information Services.
(d) State agencies shall, and other agencies are encour aged to, establish and maintain integrity controls for
record (master) copies of electroni c records in accordance with the requirements of Chapter 282, F.S.
(10) SELECTION OF ELECTRONIC RECORDS STORAGE MEDIA. For storing record (master) copies
of electronic public records through out their life cycle, agencies shall select appropriate media and systems
which meet the following requirements:
(a) Permit easy and accurate retrieval in a timely fashion;
51
State of Florida Electronic Records and Records Management Practices
APPENDIX C
(b) Retain the records in a usable format until their authorized disposition and, when appropriate, meet the
requirements necessary for transfer to the Florida State Archives.
(c) STANDARD. Agencies shall not use floppy disks, audio cassettes, or VHS-format video cassettes for
the storage of record (master) copies of permanent or long-t erm records. Permanent or long-term records on
magnetic tape shall be stored on polyester-based medi a. Agencies shall use only previously unrecorded
audio or video tape for record (master) copies of pe rmanent or long-term audio or video recordings.
(d) STANDARD. A scanning density with a minimum of 300 dots per inch is required for scanned images
created by the agency from hard co py permanent or l ong-term records.
(e) STANDARD. Record (master) copies of scanned images created by the agency from hard copy
permanent or long-term records must be stored in accordance with a published International Organization
for Standardization (ISO) open standard image format.
(f) The following factors are to be considered before selecting a storage media or converting from one
media to another:
1. The authorized retention of the records as determined during the scheduling process;
2. The maintenance necessary to retain the records;
3. The cost of storing and retrieving the records;
4. The access time to retrieve stored records;
5. The portability of the medium (that is, selecting a medium that can be read by equipment offered by
multiple manufacturers); and
6. The ability to transfer the information from one me dium to another, such as from optical disk to
magnetic tape.
(11) MAINTENANCE OF ELECTRONIC RECORDS.
(a) STANDARD. Agencies shall back up electronic records on a regular basis to safeguard against the loss
of information due to equipment malfunctions, human error, or other disaster. Agencies shall maintain
backup electronic recording media creat ed for disaster recovery purposes , and all preservation duplicates of
permanent or long-term records, in an off-site storag e facility with constant temperature (below 68 degrees
Fahrenheit) and relative humidity (20 to 30 percent) controls. Storage and handling of permanent or long-
term records on magnetic tape shall conform to the standards contained in Standard AES22-1997 (r2003),
“AES recommended practice for audio preservation and restoration – Storage and handling – Storage of
polyester-base magnetic tape” (published 1997, reaffirmed 2003), which is hereby incorporated by
reference and made a part of this rule. This publication is available from the Audio Engineering Society,
Incorporated, 60 East 42nd Street, Room 2520, New York, New York, 10165-2520, and at the Internet
Uniform Resource Locator: http://www.aes.org/publica tions/standards/search.cfm. If an agency cannot
practicably maintain backups and preservation duplicates as required in this section, the agency shall
document the reasons why it cannot do so. Other electronic records media should be stored in a cool, dry,
dark environment when possible (maximum temperature 73 degrees Fahrenheit, relative humidity 20-50
percent),
(b) STANDARD. Agencies shall annua lly read a statistical sample of all electronic media containing
permanent or long-term records to identify any loss of information and to discover and correct the cause of
data loss.
(c) STANDARD. Agencies shall test all permanent or long-term electronic records at least every 10 years
and verify that the media are free of permanent errors. More frequent testin g (e.g. at least every 5 years) is
highly recommended.
(d) STANDARD. Agencies shall only rewind tapes immedi ately before use to restore proper tension. When
tapes with extreme cases of degradation are discovered, they should be rewound to avoid more permanent
damage and copied to new media as soon as possible. Tapes shall be played continuously from end to end
to ensure even packing. Tapes shall be stored so that the tape is all on one reel or hub.
(e) STANDARD. Agencies shall prohibit smoking, eating, and drinking in areas where electronic records
are created, stored, used, or tested.
(f) STANDARD. External labels (or the equivalent automated management system) for electronic
recording media used to store permanent or long-term records shall provide unique identification for each
storage media, including:
1. The name of the organizational unit responsible for the data;
2. System title, including the version number of the application;
3. Special security requirements or restrictions on access, if any; and
52
State of Florida Electronic Records and Records Management Practices
APPENDIX C
4. Software in use at the time of creation.
F
(g) STANDARD. or all media used to store permanent or lo ng-term electronic records, agencies shall
maintain human readable information specifying recording methods, formats, languages, dependencies, and
schema sufficient to ensure continued access to, and in tellectual control over, the records. Additionally, the
following information shall be main tained for each media used to stor e permanent or long-term electronic
records:
1. File title;
2. Dates of creation;
3. Dates of coverage; and
4. Character code/software dependency.
(h) STANDARD. Electronic records shall not be stored closer than 2 meters (about 6 feet, 7 inches) from
sources of magnetic fields, including generators, elevators, transformers, loudspeakers, microphones,
headphones, magnetic cabinet latches and magnetized tools.
(i) STANDARD. Electronic records on magnetic tape or disk shall not be stored in metal containers unless
the metal is non-magnetic. Storage containers shall be resistant to impact, dust intrusion and moisture.
Compact disks shall be stored in hard cases, and not in cardboard, paper or flimsy sleeves.
(j) STANDARD. Agencies shall ensure that record (mas ter) copies of electronic records are maintained by
personnel properly trained in the use and handling of the records and associated equipment.
(k) Agencies shall establish and adopt procedures for ex ternal labeling of the contents of diskettes, disks,
tapes, or optical disks so that all authorized users can identify and retrieve the stored information.
(l) Agencies shall convert storage media to provide compatibility with the agency’s current hardware and
software to ensure that information is not lost due to changing technology or deterioration of storage media.
Before conversion of information to different media, agencies must determine that authorized disposition of
the electronic records can be impl emented after conversion. Permanent or long-term electronic records
stored on magnetic tape shall be transferred to new media as needed to prevent loss of information due to
changing technology or deterioration of storage media.
(12) RETENTION OF ELECTRONIC RECORDS. Each ag ency is responsible for ensuring the continued
accessibility and readability of public r ecords throughout their entire life cy cle regardless of the format or
media in which the records are maintained. Agencies shall establish policies and procedures to ensure that
electronic records and their document ation are retained and accessible as long as needed. These procedures
shall include provisions for:
(a) STANDARD. Scheduling the retention and disposition of all electronic records, as well as related
access documentation and indexes, in accordance w ith the provisions of Chapter 1B-24, F.A.C.
(b) STANDARD. Establishing procedures for regular recopying, reformatting, and other necessary
maintenance to ensure the retention and usability of the electronic records throughout their authorized life
cycle.
(c) STANDARD. Transferring a copy of the electronic records and any related documentation and indexes
to the Florida State Archives at the time specified in the records retention schedule, if applicable. Transfer
may take place at an earlier date if conven ient for both the agen cy and the Archives.
(13) DESTRUCTION OF ELECTRONIC RECORDS. El ectronic records may be destroyed only in
accordance with the provisions of Ch apter 1B-24, F.A.C. At a minimu m each agency shall ensure that:
(a) Electronic records scheduled fo r destruction are disposed of in a manner that ensures that any
information that is confidential or exempt from disclo sure, including proprietary, or security information,
cannot practicably be read or reconstructed, and;
(b) Recording media previously used for electronic records containing information that is confidential or
exempt from disclosure, including prop rietary or security in formation, are not reused if the previously
recorded information can be compromised in any way by reuse.
Specific Authority 257.14, 257.36(1), 257.36(6) FS. Law Implemented 257.36(1)(a) FS. History–New 8-16-92,
Amended 5-13-03, 5-21-08.
53