Loading...
HomeMy WebLinkAbout100-09Of POLICY & PROCEDURE Subject: Index: ADMINISTRATION EMAIL USE AND RETENTION Number: 1 -09 (replaces 210-15) Effective Date: Supersedes: Pages: Staff Contact: Appro By: 7/15/2019 1 N/A 1 1-11 1 Jan Hawn 1.0 PURPOSE: Email messages sent or received by the City of Renton are considered public records, and as such, the City must enact policies and procedures in order to comply with public records laws. This policy establishes guidelines describing the acceptable use of the agency -provided email system; proper preservation and destruction of email as public records through the use of retention schedules; and maintaining the public's rights and abilities to access said records. 2.0 ORGANIZATIONS AFFECTED: All departments/divisions. 3.0 REFERENCES: RCW 40.10 — Protection of Essential Records RCW 40.14 — Preservation and Destruction of Public Records RCW 42.56 — Public Records Act Freedom of Information Act (FOIA) Generally Accepted Recordkeeping Principles (GARP) International Organization for Standardization (ISO) 15489: 2001 Resolution No. 4235 — Designating the Public Records Officer City of Renton Policy & Procedure Nos.: • 100-05 — Public Records Act • 230-02 — Records Management • 250-14 — Procurement, Management, and Usage of Cell Phones, PDAs, Pagers, and Other Electronic Devices • 250-16 — Electronic Data Security • 340-02 — Unlawful Discrimination, Harassment, and Retaliation City of Renton Ordinance 5881 WAC 434-622, Preservation of Electronic Public Records WA Secretary of State — Local Government Retention Schedule Email Use and Retention (100-09) p. 2 4.0 DEFINITIONS: 4.1 Access: The right of any person to access and use public records as defined by RCW 42.56. 4.2 Administrative Value: The usefulness of a record to the City of Renton in the conduct of its daily business. 4.3 Archives (noun): A place in which records selected for permanent preservation are kept, such as the Washington State Archives. 4.4 Archives (verb): The practice of moving or copying information from an active environment to a remote storage environment. For example, transferring emails from an Exchange Inbox to the City's email archiving software program. 4.5 Attachment: Any computer file regardless of format intentionally associated with, and received as part of an email message. 4.6 Backup: A copy of electronic records and data that are retained to protect an organization against loss of the information. Backups can be stored on disks, tapes, or other machine-readable media. 4.7 CJIS: Criminal Justice Information Systems. This is information related to law enforcement activity. 4.8 Classification: The systematic identification and arrangement of records into categories according to logically structured conventions, methods, and procedural rules, represented in a scheme or plan. 4.9 Convenience Copy: An unofficial copy of a record maintained for ease of access and reference that hold no retention value. 4.10 Correspondence: Records that, 1) document communications created or received by the City of Renton, 2) directly relate to City of Renton programs or administration, and 3) and are not otherwise specified in the State retention schedules. Records may include but are not limited to letters, memoranda, notes and electronic messages that communicate formal approvals, purchases, grants, personnel, and particular projects or programs. 4.11 Destruction: The process of eliminating or deleting data, documents, and records so that the recorded information no longer exists. Email Use and Retention (100-09) p. 3 4.12 Disposition: An action that occurs once a record's retention period has expired. Possible actions include transfer to permanent storage at the State Archives or deletion (destruction). 4.13 Email: Electronic mail (email) is an informational transfer system which uses computers for sending and receiving messages. Email messages are public records when they are prepared, owned, used, received or retained by the City of Renton and relate to the conduct of government or performance of any governmental or proprietary function. 4.14 Email Archive System: A system used to capture emails sent and received by the City for the purpose of protecting, preserving, maintaining, archiving, and making the messages searchable to enable fast retrieval. 4.15 Email Domain: In the simplest of terms, the email domain is the web address that comes after the @ symbol in an email address. The City's official email domain is rentonwa.gov, and currently also manages the rentonrfa.org email domain. 4.16 Email Folders: Are defined as a directory which is used for organizing and storing emails. All email systems are equipped with folders such as those for incoming mail, sent mail, and trash. City of Renton email users have the ability to create additional folders to which mail can be directed. 4.17 Email Retention: Emails are retained per the Washington State Local Government Common Records Retention Schedule (CORE) based on the content and context of the message — not the form by which the message was sent or received. The City uses Microsoft Exchange with individual email accounts for employees and business units. 4.18 Email System: A system for sending and receiving messages electronically or over a computer network. 4.19 HIPAA: Health Insurance Portability and Accountability Act. This is information related to health care privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals, and other health care providers. 4.20 Legal (or Litigation) Hold: Is defined as a notice or communication initiated by the City of Renton's City Attorney's Office to the organization that suspends the normal disposition or processing of records. A legal hold will be issued as a result of current or anticipated litigation, audit, or other governmental investigation. Records flagged for legal hold will not be disposed of in any manner until the Email Use and Retention (100-09) p. 4 City Attorney's office provides a notice or other communication indicating the legal hold has been lifted. 4.21 Non -Record: Records created or received by authorized users of City of Renton electronic messaging systems that do not document the organization, functions, policies, decisions, procedures, operations, or other activities of the City of Renton. 4.22 PCI DSS: Payment Card Industry Data Security Standard. This is information related to the security of banking and credit card information. 4.23 Public Record: As defined by RCW 40.14.010(1): Official public records shall include all original vouchers, receipts, and other documents necessary to isolate and prove the validity of every transaction relating to the receipt, use, and disposition of all public property and public income from all sources whatsoever; all agreements and contracts to which the state of Washington or any agency thereof may be a party; all fidelity, surety, and performance bonds; all claims filed against the state of Washington or any agency thereof; all records or documents required by law to be filed with or kept by any agency of the state of Washington; all legislative records as defined in RCW 40.14.100; and all other documents or records determined by the records committee, created in RCW 40.14.050, to be official public records. As defined by RCW 40.14.010(2): Office files and memoranda include such records as correspondence, exhibits, drawings, maps, completed forms, or documents not above defined and classified as official public records; duplicate copies of official public records filed with any agency of the state of Washington; documents and reports made for the internal administration of the office to which they pertain but not required by law to be filed or kept with such agency; and other documents or records as determined by the records committee to be office files and memoranda. As defined by RCW 42.56.010(3): "Public record" includes any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics. For the office of the secretary of the senate and the Office of the Chief Clerk of the House of Representatives, public records means legislative records as defined in RCW 40.14.100 and also means the following: All budget and financial records; personnel leave, travel, and payroll records; records of legislative sessions; reports submitted to the legislature; and any other record designated a public record by any official action of the Senate or the House of Representatives. This definition does not include records that are not otherwise required to be retained by the agency and are held by volunteers who: Email Use and Retention (100-09) P. 5 a) Do not serve in an administrative capacity; b) Have not been appointed by the agency to an agency board, commission, or internship; and c) Do not have a supervisory role or delegated agency authority. As defined by RCW 42.56.010(4): "Writing" means handwriting, typewriting, printing, photostating, photographing, and every other means of recording any form of communication or representation including, but not limited to, letters, words, pictures, sounds, or symbols, or combination thereof, and all papers, maps, magnetic or paper tapes, photographic films and prints, motion picture, film and video recordings, magnetic or punched cards, discs, drums, diskettes, sound recordings, and other documents including existing data compilations from which information may be obtained or translated. If there is a conflict in the definitions, the City, subject to legal review, will apply the broadest definition. 4.24 Retention Schedule: A schedule that lists and assigns a minimum length of time each record series will be retained by the agency, whether the record is designated essential, archival, or potentially archival, and final disposition of the record. It is approved for all local government agencies or particular types of agencies by the Washington State Local Records Committee. 4.25 Retention Group: Authorized users of the City of Renton email system shall be placed in groups based on position and/or user type. Each Retention Group will have standards setting default retention period for the group. 4.26 Transitory Records: Transitory records are records that are temporary, short- term in nature, that hold no administrative, legal, fiscal, historical or archival value, and are not needed as evidence of a business transaction and are not covered by a more specific record series in the retention schedule. Transitory records should be deleted after receipt if they meet all of these mentioned requirements. 4.27 Spam (or Junk) Email: Is defined as unsolicited messages sent by email that are commercial in nature but may also contain disguised links that appear to be for familiar websites but in fact lead to phishing websites or other websites that host malware. Authorized City of Renton email users should never click on links contained within spam emails, and should delete email spam immediately. 5.0 POLICY: 5.1 The City of Renton shall provide email resources to assist in conducting agency business. Email Use and Retention (100-09) p. 6 5.2 All messages composed and/or sent using agency -provided email resources must comply with this policy. 5.3 The transmittal of CAS, HIPAA, and/or PCI DSS information in open, plain text emails is prohibited. 5.4 The City of Renton prohibits discrimination as defined in Policy & Procedure 340-02 and Ordinance 5881. Use of email resources to harass or discriminate is prohibited. 5.5 Email resources are the property of the City of Renton. All messages stored in agency -provided electronic messaging systems composed, sent or received by any employee, elected official or volunteer are the property of the City of Renton. 5.6 Employees shall only conduct substantive City business via City email. The use of personal email accounts for conducting City business is prohibited. 5.7 Upon termination or separation from the City of Renton, access to email resources, including the ability to download, forward, print or retrieve any message stored in the system will be denied. 5.8 Employees are prohibited from automatically forwarding emails sent through agency -provided systems to external messaging systems. 5.9 The City of Renton reserves the right to intercept, monitor, review and/or disclose any and all messages composed, sent or received. The interception, monitoring and reviewing of messages may be performed with the assistance of content filtering software, or by designated agency employees and/or external entities. Employees designated to review the messages may include, but is not limited to, an employee's supervisor or manager, representatives from the Human Resources / Risk Management Department, City Attorney's Office, City Clerk Division, Police Department, and representatives from the Information Technology Division. 5.10 The City of Renton reserves the right to alter, modify, re-route or block the delivery of messages as appropriate. This includes but is not limited to: • Rejecting, quarantining or removing the attachments and/or malicious code from messages that may pose a threat to City of Renton resources. • Rejecting or quarantining messages with suspicious content. • Rejecting or quarantining messages with offensive/inappropriate language or content. Email Use and Retention (100-09) p. 7 • Re-routing messages with suspicious content to designated Information Technology personnel for manual review. • Rejecting or quarantining messages determined to be unsolicited commercial email (spam). • Appending legal disclaimers to messages. 5.11 Email resources may be used infrequently and occasionally for personal use. Excessive personal use may result in disciplinary action, including but not limited to termination. City of Renton email resources may not be used for the promotion of a business or any undertaking for personal gain. 5.12 All email messages sent or received that are related to the conduct of City business must be evaluated for public record content. The content of each email message shall be evaluated against the following criteria of a public record: • Created in the course of business • Received for action • Documents City activities, decisions, or actions • Mandated by statutes or regulations • Supports financial obligations or legal claims • Communicates City requirements 5.13 Messages that meet the definition of a public record must be managed according to their approved retention period in their native format (WAC 434- 662-150). (See page 8) 5.14 All email messages sent or received from a City email address will be automatically archived into the City's email archiving system and retained for a minimum of three years or two years after an employee's departure, whichever comes first. (See page 8) 5.15 All email messages in Inbox, Sent Items, and Deleted Items folders that are more than 180 days old are purged from the City email Exchange Server. City employees shall have access to their own emails that are more than 180 days old via the email archive system. Messages will remain in the email archive system until the appropriate retention periods are met. 5.16 The City of Renton does not authorize the use of instant messaging programs. 5.17 Employees shall not use any other means of electronic messaging to conduct substantive City business. 5.18 Any new communication tools or technologies must be reviewed and approved by the Information Technology and City Clerk Divisions before implementation. Email Use and Retention (100-09) p. 8 5.19 Any employee who discovers a violation of this policy shall immediately notify a manager, the Information Technology Division, the City Clerk Division, and/or the Human Resources / Risk Management Department. 5.20 Any employee in violation of this policy is subject to disciplinary action, including but not limited to, termination. 6.0 PROCEDURES: UNDER CURRENT STATE LAW, THE RETENTION PERIOD FOR EMAIL IS BASED ON THE CONTENT OF EACH INDIVIDUAL EMAIL MESSAGE. THE CITY OF RENTON DECLARES READING EVERY EMAIL SENT OR RECEIVED BY THE AGENCY TO DETERMINE ITS UNIQUE RETENTION PERIOD VALUE TO BE UNDULY BURDENSOME. BECAUSE OF THIS, THE FOLLOWING GROUP -BASED RETENTION SCHEDULES WILL NOT BE IMPLEMENTED UNTIL THE WASHINGTON STATE LOCAL RECORDS COMMITTEE PROVIDES GREATER CLARITY REGARDING THE RETENTION REQUIREMENTS OF EMAIL. UNTIL THAT TIME, ALL CITY -BUSINESS RELATED EMAILS WILL BE KEPT PERMANENTLY. THEREFORE, THE GROUPS LISTED BELOW ARE CURRENTLY INTENDED TO BE USED SOLELY FOR ORGANIZATIONAL PURPOSES. THE CITY OF RENTON INTENDS TO IMPLEMENT THE GROUP -BASED RETENTION SCHEDULES ONLY AT SUCH TIME THE WASHINGTON STATE LOCAL RECORDS COMMITTEE DESIGNATES RETENTION PERIODS FOR EMAILS BASED ON THE TYPE OF RECORD INSTEAD OF THE CONTENT OF THE EMAIL. Default Email Retention Schedules Based on User Role with the City of Renton: Emails will be retained based upon the following retention groups: 6.1 Group 1— The lessor of Term of Office/Employment plus 2 years • Group Membership — The members of this group shall include and be strictly limited to the following City employees: o Elected Officials o Chief Administrative Officer o City Administrators/Chiefs o Deputy or Assistant City Administrators/Chiefs o City Attorney Department Employees Email Use and Retention (100-09) P. 9 • Retention Period — Emails sent or received by members of this group shall be retained for a period of the individual's term of office/employment plus two years. Emails from this group may be selected to be transferred to the State Archives. Emails not selected for transfer to the State Archives will be deleted. 6.2 Group 2 — The lessor of Ten Years or Term of Employment Plus 2 Years • Group Membership — The members of this group shall include and be strictly limited to the following City employees unless the employee is promoted to a Group 1 position: o City Clerk/Public Records Officer o Deputy City Clerk/Enterprise Content Manager o Assistant Public Records Officer o Directors and Assistant/Deputy Directors o Human Resources and Risk Management Personnel o Police Department Personnel o Emergency Management Personnel o Community and Economic Development Personnel o Public Works Personnel o Court Services Personnel o Community Services Personnel o Finance and Information Technology Personnel • Retention Period — Emails sent or received by members of this group shall be retained for a period of ten years or term of employment plus two (2) years based on the send/receive date of the message. All messages sent or received by members of this group that are older than ten years will be deleted from the City's email messaging systems. • Any member of Group 2 many request his/her email communications be retained longer than the recommended retention period of his/her assigned group if approved by the City Clerk Division. 6.3 Group 3 — The greater of Three Years or Term of Employment plus 2 Years • Group membership shall include: o Employees not already included in another group o Volunteers and Board and Commission members if provided with City of Renton email address Email Use and Retention (100-09) P. 10 • Retention Period — Emails sent or received by members of this group shall be retained for a period of three years or term of employment plus two (2) years based on the sent/received date of the message. All messages sent or received by members of this group that are older than three years will be deleted from the City's email messaging systems. • Any member of Group 3 may request his/her email communications be retained longer than the recommended retention period of his/her assigned group if approved by the City Clerk Division. 7.0 LEGAL HOLD: 7.1 When a reasonable expectation of litigation exists, the City of Renton is required to preserve electronically stored information including emails relevant to the lawsuit or potential lawsuit. Emails, either topic -specific or for certain named individuals, will be placed on a legal (or litigation) hold until the retention period for the lawsuit expires or when the hold has been lifted by the City Attorney's Office. Legal holds can only be established by the City Attorney's Office. 8.0 TRAINING: All City employees are required to acknowledge in writing that he/she has received training on this policy. The City Clerk's Office will provide training on the policy, and will maintain attendance records. 9.0 AUDITING: The City Clerk Division will coordinate with departments to monitor email usage and conduct periodic audits. This will help assess the effectiveness of the training and provide feedback for the annual review of the policy. 10.0 ENFORCEMENT: Failure to comply with this policy may lead to corrective actions up to and including termination of employment. All supervisors are responsible for the enforcement of this policy. 11.0 BEST PRACTICES: Be thoughtful of the content and context of the email sent or received as it relates to City business. If an email meets any of the following criteria, it is required to be kept per the retention schedule: • Created in the course of business. • Received for action. Email Use and Retention (100-09) P. 11 • Documents City activities, decisions, or actions. • Mandated by statutes or regulations. • Supports financial obligations or legal claims. • Communicates City requirements. Email tips and best practices: • Use descriptive subject lines that indicate the topic of the communication. • Break threads of communication. If an originating email is about one topic, do not respond about a different topic. • Keep email concise. • Call someone if you need clarification. • Keep things appropriate. • Simply storing emails is not managing them. • Avoid sending large attachments. • Avoid using unnecessary graphics and colors.