Managing Records in Ministers Offices Records Management and the Freedom of Information and Protection of Privacy Act Security Classification: PUBLIC 1
Introduction Records management is an essential tool for fulfilling the government s responsibility of being accountable to the public. There is specific records management guidance for the different records produced and used in Ministers offices. The delicate and often sensitive nature of the information requires strong foundational guidelines, to protect information from security and privacy risks. 2
Context For Ministers records, there are two essential authorities to consider: Records Management Regulation under the Government Organization Act: Establishes the records management program which includes the way the organization plans, identifies, captures, manages, preserves, and disposes of its information across all formats (paper and digital). Freedom of Information and Protection of Privacy Act: Provides for access to information. Protects an individual s privacy by setting out rules for the collection, use, disclosure, retention, and security of personal information. 3
Context Along with people and finances, information is a key business resource for the Government of Alberta. Government records document and provide evidence of business transactions or decisions, and can exist in any medium or format. This means both paper and electronic records, which includes email. This applies to all media including instant messaging, videos, texts, voice mail, Facebook, tweets, photographs, blue prints, etc. 4
What types of records will you find in a Minister s office? Government Records Departmental: related to the mandate of the department. - Specific program policy, annual reports, minister s expense claims. Other Records Constituency: created and received as an MLA. - Election campaigns, constituency business. Cabinet: related to Cabinet committees and subcommittees. - Approval of government policy, recommendation for approval of Orders in Council. Personal: created and received as a private citizen. - Home electric bill, association membership receipt, email to family members. 5
How do you manage records in a Minister s office? The records found in a Minister s office have specific records management requirements, and must be followed accordingly. Separate and manage records: Departmental records Cabinet records Constituency and personal records 6
How do you manage departmental records? The Minister s office retains only those departmental records needed for current business, and returns those records to the originating department when they are no longer needed. Organize Departmental records are organized and kept by the department. They have primary responsibility to manage these records. Keep separate from Cabinet, personal and constituency records. Dispose Departmental records must only be disposed using an approved records retention and disposition schedule. 7
How do you manage Cabinet records? Cabinet records are created in relation to Cabinet, including committees and sub-committees. Organize Cabinet records are organized and kept by the Minister s office or Executive Council. Keep separate from departmental, personal and constituency records. Dispose Cabinet records are to be disposed under the Minister s Records Schedule (2002/041). 8
How do you manage constituency and personal records? Constituency and personal records are generated or received by Ministers in their capacity as MLAs and private citizens. Organize Constituency and personal records are organized by the Minister s office. Keep separate from departmental and Cabinet records. Dispose Records Management Regulation does not apply to constituency and personal records. These are not government records. A Minister may dispose of these records as they see fit. The Minister may take these records with them, destroy the records, or donate the records to the Provincial Archives of Alberta. 9
How do you manage transitory records? Some records will have no further value to government beyond an immediate or minor transaction. These transitory records provide no evidence of business transactions, and no future value (legal, financial, operational, archival). These typically apply to departmental and Cabinet records. Examples Announcements, advertising and junk mail, obsolete forms, publications (books, magazines, newspapers), distribution messages, duplicates, working documents, etc.) Dispose Transitory records can be routinely destroyed/deleted under the transitory records schedule (1995/007-A001). 10
11
How do you properly dispose of transitory records? Protect confidential information including an individual's personal information Follow the government process for boxing and storing records Standard disposal for paper records is cross-cut shredding Consider electronic records Standard disposal for electronic records is to double delete Immediately dispose of transitory records once no longer needed. 12
What happens when there is a FOIP request or litigation? Records disposition must be halted for specific records when: A FOIP request has been received, Records are responsive to a litigation action, or Records are responsive for an anticipated litigation action. Records disposition can continue once the: FOIP request has been closed, Litigation case is completed and appeals are exhausted, Scope of the litigation case has changed, or The records are no longer responsive. Transitory records are included in the records hold. 13
FOIP Requests: Why do we have access to information? the overarching purpose of access to information legislation, then, is to facilitate democracy. It does so in two related ways. It helps to ensure first, that citizens have the information required to participate meaningfully in the democratic process, and secondly, that politicians and bureaucrats remain accountable to the citizenry. Justice La Forest, in a landmark Supreme Court of Canada decision in Dagg vs. Canada 14
What is FOIPable? Part One of the FOIP Act: Access to Information Generally FOIP Requests are communicated to the MO through the DMO How does a FOIP request impact you? Files are frozen Legislated timelines to provide response (30 Calendar days = approximately 20 Working days) Duty to assist Comprehensive Search (i.e. ARTS, inactive files, blackberry) Responsive versus Release Exceptions to the Right of Access: Mandatory versus Discretionary e.g. Cabinet confidences, personal information, legal advice, advice from officials Who is the Applicant? Why do they want the information? 15
What is privacy? Part Two of the FOIP Act: Protection of Privacy It is not defined in the FOIP Act, PIPA, or any Canadian legislation. Although none of the statutes define privacy, they aim to achieve it with rules for how personal information is to be collected, used, and disclosed. The foundation of privacy laws: Informational self determination an individual s personal information is their own to the extent possible, the individual controls how their personal information is collected, used and disclosed This is reflected in a Code of Fair Information Practices 16
Fair Information Practices Understands purpose of program and use of their information Informational self-determination Directly provides personal information Authorises indirect collection of personal information Only provides information that is necessary to the program Knows who to contact for queries re: collection/use Understands and consents to record linkages Has access to own personal file Can request corrections and up-dates to own information Is protected from un-authorized access/disclosure of personal information Information is only retained for as long as necessary 17
Places limits on: Part Two of the FOIP Act: Protection of Privacy Collection, use and disclosure of personal information (s. 33, 34, 39 and 40) Requires: accuracy and completeness (s. 35) retention of records (s. 35) access (Part 1) and correction (s. 36) protection: reasonable security (s. 38) 18
Things to Consider about FOIP Some of the Powers of the Office of the Information and Privacy Commissioner (OIPC) include: Applicants and Third Parties can ask the OIPC to review a decision made by the public body Investigates privacy breaches, complaints, and records management practices related to destruction of records Security (section 38) Reasonable security arrangements against unauthorized Access Collection Use Disclosure Destruction A person who is guilty of an offence is liable for a fine of up to $10,000 FOIP is intended as a last resort 19
Tools and Resources: Contacts Each department has: FOIP Coordinator http://www.servicealberta.gov.ab.ca/foip/find-a-foip-office.cfm Senior Records Officer (SRO) https://www.alberta.ca/assets/documents/im-sro-list.pdf Sector or Department Chief Information Officer (CIO) Ministry Information Security Officer (MISO) http://www.servicelink.gov.ab.ca/security/ministryinformationsecurityofficers.cfm Corporate Information Offices (Service Alberta) FOIP / Access and Privacy SAFOIP@gov.ab.ca SA.AccessAndPrivacy@gov.ab.ca Information Management Branch SA.InformationManagement@gov.ab.ca Corporate Information Security Office ciso@gov.ab.ca 20
Tools and Resources: Training Online training modules available to GoA employees through the Learning Management System (LMS) http://goalms.alberta.ca Information management (IM) FOIP Cyber security Physical security Managing Records in Ministers Offices Guideline https://www.alberta.ca/assets/documents/im-ministers-records-guide.pdf Managing Records in Ministers Offices https://www.alberta.ca/assets/documents/im-ministers-records-ppt.pdf 21
Tools and Resources: Related Websites Freedom of Information and Protection of Privacy Act http://foip.alberta.ca Personal Information Protection Act http://pipa.alberta.ca Information management resources https://www.alberta.ca/information-management-branch.aspx Information security resources http://www.servicelink.gov.ab.ca/security 22