Source: http://docplayer.net/11837050-State-records-guideline-no-18-managing-social-media-records.html
Timestamp: 2018-04-20 19:44:22
Document Index: 174180483

Matched Legal Cases: ['art 2', 'art 4', 'art 1', 'art 2', 'art 3', 'art 4', 'art 1', 'art 2', 'art 3']

State Records Guideline No 18. Managing Social Media Records - PDF
Download "State Records Guideline No 18. Managing Social Media Records"
1 State Records Guideline No 18 Managing Social Media Records
2 Table of Contents 1 Introduction Purpose Authority Social Media records are State records Identifying Risks Legal risks Develop a Social Media Strategy Develop Social Media Policy Metadata capture Staff awareness and training Definitions Recommended Reading Checklist of Minimum Requirements Further Advice Acknowledgements Information Security Classification This document has been security classified using the Tasmanian Government Information Security classification standard as PUBLIC and will be managed according to the requirements of the Tasmanian Government Information Security Policy. Document Development History Build Status Version Date Author Reason Sections 2.0 April 2015 Sam Foster-Davies Revision All 1.0 April 2012 TAHO Initial Release All Amendments in this Release Section Title Section Number Amendment Summary All All Complete revision Issued: April 2015 Page 2 of 12
3 Ross Latham State Archivist Page 3 of 12
4 1 Introduction Social media is about using technology to create, share, and exchange ideas, knowledge and information. People can participate in this interaction by using a variety of social media tools. Although these tools are constantly evolving, they can be defined as applications that build on the ideas of Web 2.0 technologies that emphasise user-generated content, usability and interoperability. They include, but are not limited to: Social media hosted on external servers with third parties, such as: o social networking sites including Facebook, LinkedIn, Google+ o media sharing services including YouTube, Flickr, Pinterest, Tumblr o blogs (e.g. Blogger, WordPress) o micro-blogs (e.g. Twitter) o wikis and online collaborations (e.g Wikipedia) o forums, discussion boards and groups including Google Groups, Whirlpool o Vod and podcasts o instant messaging, including SMS, Facebook Chat, Microsoft Lync 1 o social bookmarking o geo-spatial tagging including Google maps o online surveys including Survey Monkey o streaming media o crowdsourcing Social media hosted within government, such as: o Yammer Social media within agency business systems, such as: o Agency intranets (e.g. internal forums, discussion boards) o Blogs hosted by agencies Note that Web 2.0 does not refer to any advancement in technical specification, but rather to changes in the way web technologies are developed and used where the emphasis is on interactivity rather than passive viewing of content. Today, this environment may be online, hosted internally within an agency, or an application either available on a local computer or mobile device. The Tasmanian Government recognises that the use of social media provides opportunity to improve accessibility, consult and engage with the community, undertake professional networking, and effectively deliver important information and services. Note that whilst collaboration platforms and messaging technologies are included under the umbrella of 'social media', they are dealt with in more detail in other TAHO Guidelines. 1.1 Purpose This guideline is to provide information about recordkeeping requirements applicable to the use of social media environments. Where government business is undertaken via social media applications, the applications may contain State records which are subject to the Archives Act See Guideline 7 Managing records of Messaging Technologies and mobile devices Page 4 of 12
5 1.2 Authority This guideline is issued under the provisions of Section 10A of the Archives Act Guidelines issued by the State Archivist under this Section set standards, policy, and procedures relating to the making and keeping of State records. This section also requires all relevant authorities to take all reasonable steps to comply with these guidelines, and put them into effect. Keyword MUST MUST NOT SHOULD SHOULD NOT Interpretation The item is mandatory. Non-use of the item is mandatory. Valid reasons to deviate from the item may exist in particular circumstances, but the full implications need to be considered before choosing this course. Valid reasons to implement the item may exist in particular circumstances, but the full implications need to be considered before choosing this course. RECOMMENDS The item is encouraged or suggested. RECOMMENDED MUST and MUST NOT statements are highlighted in capitals throughout the Guideline. Agencies deviating from these MUST advise TAHO of the decision to waive particular requirements. Agencies deviating from a SHOULD or SHOULD NOT statement MUST record: the reasons for the deviation, an assessment of the residual risk resulting from the deviation, the date at which the decision will be reviewed, and whether the deviation has management approval. Agencies deviating from a RECOMMENDS or RECOMMENDED requirement are encouraged to document the reasons for doing so. 2 Social Media records are State records Agencies that embrace the use of social media MUST manage the content created in accordance with recordkeeping requirements of the Archives Act 1983, and TAHO Guideline 1 Records Management Principles. The Archives Act 1983 defines a record as a document or object that is, or has been, made or kept by reason of any information or matter that it contains or can be obtained from it or by reason of its connection with any event, person, circumstance or thing. The Act is not format specific, so records can be in any format, including those created through the use of social media. Social media records are subject to the same requirements as records created by other means. Agencies MUST ensure that accurate and sufficient records of government business are created and kept in a useable and accessible form for as long as they are required to support agencies business, and to ensure that agencies can meet legal and regulatory obligations. Note that agencies may use social media channels to re-publish information available through other means, such as corporate websites. Where social media is used to re-post news and information managed elsewhere, and Page 5 of 12
6 the social media content is simply a duplication of information captured in an agency s recordkeeping system, the requirement to capture and maintain the information is already met. 3 Identifying Risks Agencies intending to use social media MUST identify their high risk business processes, the systems that support these, and ensure these systems can make and keep records to document and support these high risk processes. Agencies MUST conduct risk assessments both of the platform limitations and the intended content for distribution, as the adoption of these technologies may involve some risk to the integrity, security and long term preservation of records. These risk assessments SHOULD be undertaken on a case-by-case basis, and documented in a risk management plan, including strategies to export information (where appropriate) for maintenance in corporate systems. Social media platforms are not typically designed for record capture and management, and information professionals will need to investigate and document those platforms being used by their agency, the sorts of records being created, whether the area of business is considered 'high risk', and devise strategies to capture and preserve required records appropriately. Social media applications are typically: Third party owned Located in the cloud Subject to regular change, and Unable to be relied upon to maintain business information to meet business and legislative requirements. (Additional information on identifying information risk can be sourced from the following resources: Guideline 25 Managing Information Risk, Guideline 17 Managing the Recordkeeping Risks associated with Cloud Computing, and Advice 60 Risk Management). 3.1 Legal risks Agencies MUST determine where the records of the social media provider are stored. If outside of Australia, consider whether sending or storing information breaches any laws, legislation or standards. Further analysis SHOULD be undertaken, including whether the records may be subject to legislation of the jurisdiction that hosts the storage servers, and whether there is any likelihood of the records being accessed, compromised or altered. Services for backing up social media records often require the data to be stored in the cloud. Agencies SHOULD refer to the Terms of Service, investigate whether the service is cloud based, and be aware of the legal and privacy implications of storing data in a cloud computing system, before subscribing to any back up service. Different categories of records carry different levels of risk according to their level of sensitivity and business value. Risk assessments may determine records and information categories considered unsuitable for the social media environment due to issues of confidentiality and security, including records containing personal information, commercial-in-confidence, or records of original research. Page 6 of 12
7 3.1.1 Ownership Records generated by your agency SHOULD be under your control, and ideally in your custody. Where possible, use in-house technology in preference to third party sites and software. If third party sites are used, Agencies MUST be aware of the terms and conditions of use. Issues such as copyright, privacy and intellectual property MUST be considered when publishing content. For example, some social networking sites state in their Terms of Use that content remains the intellectual property of the individual or entity that posts it. Others, however, assert copyright over content posted to their platform. Note that Records kept in an electronic document and records management system (EDRMS) can be simultaneously accessed by multiple users, which may constitute being 'broadcast' under copyright legislation, leading to potential compensation claims by individuals regarding content published to a social media site being stored in a government agency's EDRMS Privacy A statement regarding data storage and privacy is a prudent inclusion on any Tasmanian government agency social media profile, when capturing social media records. This will allow members of the community who may have privacy concerns to select an alternative method of communication Record destruction and loss When using third party sites, agencies are vulnerable to record destruction or loss, for which they may not be responsible, but will be accountable. There is the potential a provider could delete information, damaging the integrity of the agency. The provider could go out of business and close the site, effectively removing all access to the records. It is RECOMMENDED that agencies use services such as the Australian Government GovDex platform where appropriate. This particular service supports private, secure cross-agency and cross-jurisdictional collaboration and communications (see for more information). 4 Develop a Social Media Strategy Lack of an overarching strategy for the agency's use of social media can lead to information loss, duplication of process, and increased risk exposure. Agencies SHOULD develop a social media strategy and framework of policy and procedures to ensure business information generated through social media is consistently identified, captured, maintained, and accessible over time. Different strategies may be required for different applications, as the majority of social media platforms make it clear they are not in the business of managing your information in their terms of use. Technologies may have a variety of behaviours and may need multiple strategies to capture and/or manage information appropriately. As an example, a blog site may offer: A live feed (e.g. RSS) Recent comments that may change even if main content remains static Site administration features Page 7 of 12
8 Bookmarks and tagging which may connect to other related services Thought should be given to if, when and how information distributed through social media platforms needs to be captured. Appraisal SHOULD be undertaken to identify what kinds of records are being created, whether they are duplicates of a master record held elsewhere, or whether the content is being created directly in the social media application. Considerations include: the business requirements for the information (eg. whether records may be required for future planning or evidentiary purposes). legal and regulatory requirements (e.g. whether a forum of public submissions should be retained) cultural requirements (e.g. images of key events posted on Flickr may need to be preserved) It is important to identify all uses of social media platforms across the organisation, and ensure the social media strategy covers their use. The social media strategy SHOULD be regularly reviewed, as the level of engagement with social media platforms by the agency becomes more widely accepted. The strategy SHOULD provide for the uptake of new technologies to be closely monitored to ensure defined procedures are applied, and where necessary updated to accommodate new and emerging formats. Similarly, operating policies/terms of use of any third party providers will need to monitored, and when changes occur, examined in light of legislative, copyright and IP requirements. An effective social media strategy may encompass one or more policies, for example, a governance policy, and an 'acceptable use' policy for staff. Such policies help to define official, professional and personal use of social media, and acceptable standards of behaviour for each. (Additional information on recordkeeping strategies for social media can be sourced from Advice 57 Managing Social Media Records). 4.1 Develop Social Media Policy Agencies MUST develop and implement social media policy to support the social media strategy. The policy SHOULD define: How business is to be performed through the various social media channels in use (required procedures and processes including recordkeeping obligations) Security, privacy and copyright issues that need to be considered in the use of social media. The corporate code of conduct for use ('acceptable use') including authorised or official roles that may publish on behalf of the agency Public terms of use for social media channels The information that needs to be captured to support operations Social media policies SHOULD be regularly reviewed and updated to reflect current agency practice and changing technology. (Additional information on social media policy can be sourced from Advice 57 Managing Social Media Records Part 2: Strategies for implementing social media recordkeeping. Also see the Template - Sample Social Media Acceptable use Policy). Page 8 of 12
9 Agencies SHOULD review Section 8.5 Non-Tasmanian Government websites of the Tasmanian Government Communications policy 2 to ensure internal strategies and policy also align with these requirements. 4.2 Metadata capture Many activities undertaken through social media may be considered low-risk, and only require very simplistic recordkeeping approaches, if any. Higher risk activities will require more investment in effective recordkeeping strategies, including maintaining the context of the record. This may be undertaken through capture to the agency s recordkeeping system, or by ensuring there is adequate functionality built into the social media software application. Similarly, any automated process for capturing social media records SHOULD be able to store the metadata required to contextualise the message appropriately. The metadata should communicate the relationship between the record, the context that the social media was used in (for example, a statement or a reply), and any other related documents that help make the social media usage understandable. High risk social media records MUST include the following contextual metadata at a minimum: The date and time the message was sent or received by the public officer or agency representative For messages sent by the agency, the name of the public officer that sent the message, who authorised the social media message (if relevant), and to whom it was sent (at a minimum a group address is sufficient) For messages received by the agency, the public officer and account name that received the message, the person to whom it was sent, and the name used by the person who posted the message (for privacy reasons, no attempt should normally be made to determine the actual identity of the sender) The purpose of the message (the relationship between the message and other records; why the message was sent or received; what it was in response to) The name of the social media application that the message was created on. Where social media platforms and applications in use do not provide the required contextual metadata as part of the export process, manual strategies will be required. Refer the section Tools for Capturing Social Media (pg 11) in TAHO Information Management Advice 57 Part 4: How to Capture Social Media Records, for more detailed information. 4.3 Staff awareness and training Agencies MUST ensure their staff are aware of recordkeeping responsibilities in regard to work-related social media use. Education and training programs MUST align with agency social media strategy and SHOULD ensure that: staff understand the purpose of each social media platform, authorised use of the tool is undertaken in accordance with the agency's policy and procedures, and a standardised approach to records and associated metadata capture is supported. 2 Page 9 of 12
10 Agencies do not have the capacity to stipulate conditions to consumer service providers such as Facebook, and therefore the responsibility lies with the agency to educate staff in regards to acceptable use, after determining the level of risk. 5 Definitions Blogs Online journals set up by individuals or businesses using a blog interface such as Blogger, WordPress, or TypePad. Entries are made using a content management system, with the most recent entry appearing first. Forums Online discussion areas that encourage individuals, customers and communities to post and comment on specific products, services, topics and interests. Media sharing services online communities that organise and share particular types of content. Most popular are Flickr (photos), and YouTube (videos). Micro-blogs Social networking combined with bite-sized blogging, where small amounts of content are distributed online and through the mobile phone networks, eg Twitter, Tumblr, and Posterous. Podcasts Online audio files made available by subscription or as one-offs, using software that automatically detects and downloads new broadcasts. Social bookmarking a centralised online service enabling users to add, annotate, edit and share bookmarks of web documents. Users save links to webpages they want to remember and/or share. Social networks social networking sites such as Facebook and LinkedIn allow individuals and organisation to build web pages that can be shared with fans, friends and colleagues, who in turn can share their news, stories, photos and videos etc. Streaming media multimedia constantly received by a user, delivered by a streaming provider Syndication and notification technologies allows users to be notified when a website is changed or updated (e.g. RSS feeds) Wikis These websites allow people to add content or edit the information on them, acting as a communal document or database. The best-known is Wikipedia, an online encyclopaedia which has over 2 million English language articles. 6 Recommended Reading Managing Social Media Records Part 1 - Overview (2014: Advice 57) Managing Social Media Records Part 2 - Strategies for implementing social media recordkeeping (2014: Advice 57) Managing Social Media Records Part 3 - Determine what records need to be kept (2014: Advice 57) Managing Social Media Records Part 4 - How to capture social media records (2014: Advice 57) Template - Sample Social Media Acceptable use Policy (2014: Advice 57) Risk Management - Part 1: Introduction (2014: Advice 60) Page 10 of 12
11 Risk Management - Part 2: Applying Risk Management processes (2014: Advice 60) Risk Management - Part 3: Information Risk Register template (2014: Advice 60) Managing the recordkeeping risks associated with cloud computing (2014: Guideline 17) 7 Checklist of Minimum Requirements Ref. Mandatory Requirement Compliance? 1 Agencies that use social media MUST manage the content created in accordance with the Archives Act 1983, and TAHO Guideline 1 Records Management Principles 2 Agencies MUST ensure that accurate and sufficient records of government business are created and kept in a useable and accessible form 3 Agencies intending to use social media MUST identify their high risk business processes and MUST conduct risk assessments 4 Issues such as copyright, privacy and intellectual property MUST be considered 5 Agencies MUST determine where the records of the provider are stored 6 Agencies MUST be aware of the terms and conditions of use of third party platforms and sites 7 Agencies MUST develop and implement social media policy 8 High risk social media records MUST include required minimum metadata 9 Agencies MUST ensure their staff are aware of recordkeeping responsibilities in regard to social media use 10 Education and training programs MUST align with agency social media strategy and policy Page 11 of 12
12 Further Advice For more detailed advice please contact: Government Information Strategy Unit Tasmanian Archive and Heritage Office 91 Murray Street HOBART TASMANIA 7000 Telephone: Acknowledgements Queensland State Archives, Public records brief, Social media and public records 3 National Archives of Australia, Social media policy 4 National Archives of Australia, Social media: Another type of Commonwealth record 5 Public Record Office Victoria, Government Users, FAQ Social Media pages Public Record Office Victoria, Social Media Policy Nov State Records NSW, Strategies for managing social media information Page 12 of 12