DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 1 of 11
STATEWIDE POLICY
NUMBER
107-001-020
SUPERSEDES
107-001-020 | 7/1/2016
EFFECTIVE DATE
2/1/2019
PAGE NUMBER
Pages 1 of 11
REVIEWED DATE
2/1/2019
DIVISION
Office of the Chief Operating Officer
REFERENCE/AUTHORITY
ORS 192.018, 174.112
Executive Order 16-06
POLICY OWNER
Department of Administrative Services
SUBJECT
Public Records Management
APPROVED SIGNATURE
Katy Coba, Director
(Signature on file with DAS Business Services)
PURPOSE
This policy supports statewide compliance with ORS 192.018 by establishing minimum standards for state
agency policies relating to the internal management of public records and providing a Model Public Records
Management Policy (model policy) for state agency reference or adoption.
State agencies may adopt the model policy language provided under each subsection of the POLICY
GUIDELINES section of this policy (and attached as EXHIBIT A) or adopt more restrictive requirements and
practices to meet agency-specific business needs. Agencies may also incorporate by reference any existing
internal policies that adequately address the policy areas outlined in the POLICY GUIDELINES and required
by this policy.
Agencies are required to seek review and approval from the State Archivist, in accordance with ORS 192.018,
prior to adopting an internal public records management policy.
Agencies must review and, if necessary, update their public records management policy at least once per
biennium to account for changes in applicable laws, policies and business needs, and to ensure ongoing
access to agency records. All policy amendments must be submitted to the State Archivist for review and
approval according to ORS 192.018, prior to adoption.
APPLICABILITY
This policy applies to all agencies within the Executive Branch, as defined in ORS 174.112, excluding the
following:
• Secretary of State.
• State Treasurer.
• The Attorney General, but only with respect to its authority, per ORS 182.124, over information systems
security in the Department of Justice.
• Oregon State Lottery.
• State Board of Higher Education or any public university listed in ORS 352.002.
The requirements in this policy do not supersede, modify or replace the existing legal responsibilities of any
state agency. Agencies must continue to meet obligations required by all applicable laws, policies, procedures
and standards including without limitation: state and federal public records laws, privacy laws and regulations,
and applicable DAS policies and procedures.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 2 of 11
EXCLUSIONS
ORS 192.018 requires every state agency to have a “written policy that sets forth the agency’s use, retention
and ownership of public records.” Therefore, other than the excluded organizations listed above in the
APPLICABILITY section of this policy, there are no other exclusions.
EXHIBITS
• EXHIBIT A: Model Public Records Management Policy
SPECIAL SITUATIONS
• Retained records may be subject to public disclosure upon request, even if their retention was not required
by law. The statutes requiring public disclosure of records apply more broadly than the statutes requiring
records to be retained.
• Agencies are not required to create public records that would not otherwise exist.
• Only the official copy of a public record must be retained. Stock of publications are not public records and
may be preserved for convenience or destroyed.
GENERAL INFORMATION
The goal of this policy is to ensure public records are managed and maintained appropriately across the
enterprise of state government and streamline compliance with ORS 192.018 by requiring agencies to adopt
internal public records management policies that address the following components, at a minimum:
I. Public Records Maintenance
II. Roles and Responsibilities
III. Education and Training
IV. Access and Ownership
V. Integrity
VI. Retention, Generally
VII. Storage and Retrieval
VIII. Public Records Requests
IX. Disposition and Destruction of Public Records
COMPLIANCE
Agencies subject to this policy must achieve compliance with ORS 192.018 within 90 days of the effective date
of this policy.
In addition, agencies must develop and implement internal processes and procedures that support compliance,
deter abuse and detect violations.
If an agency’s public records management policy, approved and adopted according to this policy, cannot be
feasibly implemented, the agency may submit a written request for assistance to the Secretary of State
Archives Division (Archives Division). The request should specify the policy section(s) and requirements
making implementation over-burdensome and the type of assistance necessary for the agency to achieve
compliance.
REPORTING
Agencies must notify the DAS Office of the Chief Operating Officer when the State Archivist has formally
approved their public records management policy and the agency is compliant with ORS 192.018.
DEFINITIONS
Authorized Retention Schedule: Either a General Schedule published by the State Archivist in the OAR in
which certain common public records are described or listed by title and a retention period is established for
each; or a Special Schedule approved by the State Archivist for the public records of a specific agency.
Cloud-computing: Has the meaning established in the National Institute of Standards and Technology (NIST)
Special Publication 800-145
.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 3 of 11
Custodian: A public body mandated, directly or indirectly, to create, maintain, care for or control a public
record. "Custodian" does not include a public body that has custody of a public record as an agent of another
public body that is the custodian, unless the public record is not otherwise available.
Instant Messaging: Real-time text communications between or among computers or mobile devices over the
internet or functionally similar communications networks.
Metadata: Data that provides information about other data. Metadata assists in resource discovery by allowing
resources to be found by relevant criteria, identifying resources, bringing similar resources together,
distinguishing dissimilar resources and giving location information.
Public Record: Has the meaning established in ORS 192.005. In general it refers to information that is
prepared, owned, used or retained by a state agency or political subdivision; relates to an activity, transaction
or function of a state agency or political subdivision; and is necessary to satisfy the fiscal, legal, administrative
or historical policies, requirements or needs of the state agency or political subdivision. Refer to the Secretary
of State’s guide for determination of a public record:
https://sos.oregon.gov/archives/Documents/recordsmgmt/rc/oregon-public-records-law-citations.pdf
.
Social Media: Web-based and mobile communication technologies that allow the creation and exchange of
user-generated content such as comments or responsive postings. Examples of social media include but are
not limited to Twitter, Flickr, blogging sites, Facebook, YouTube and Instagram.
Text Messaging: Messages exchanged between fixed-line phones or mobile phones and fixed or portable
devices over a network. Excluded from the definition of text messages are electronic mail (email)
communications, whether such messages are exchanged among or between official state government email
accounts or email accounts maintained by private entities.
Unified Communications: A service of IBM; the packaged services or user profiles available to agencies
(e.g., instant messaging, video conferencing, telephony, call management and call control across multiple
systems, etc.). Also known as IBM Unified Communications.
POLICY GUIDELINES
I. PUBLIC RECORDS MAINTENANCE
Agencies must adopt public records management policies and procedures to ensure public records are
maintained and managed in a manner that protects the integrity of each record, without regard to the
technology or medium used to create or communicate the record, from the time of creation of the
public record to the time of final disposition of the public record as determined by its authorized
records retention schedule.
Model Policy Language
Public records must be maintained and managed in a manner that protects the integrity of the
records within INSERT: Agency Name without regard to the technology or medium used to create
or communicate the record, from the time of creation of a public record to the time of final
disposition of the public record as determined by their authorized records retention schedule.
II. ROLES AND RESPONSIBILITIES
Agencies must develop a Records Management Program that includes the program’s organizational
structure, identified roles and associated responsibilities of agency employees necessary to properly
manage the agency’s public records.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 4 of 11
Agencies shall designate an Agency Records Officer according to ORS 192.105(2)(a) and assign
additional employees, as necessary, to be responsible for working with the Archives Division and State
Archivist to carry out the following:
Regular review of records, regardless of format (electronic, paper, etc.) to determine if records
should be retained or destroyed.
Identify and develop retention schedules for new records series (groups of records).
Maintain a filing system of the agency’s paper and electronic records based on authorized
retention schedules. Agency filing systems must include the description and location of public
records, including records the agency is required to retain due to litigation (active litigation hold)
and/or special audit. Records retained beyond their authorized retention period due to mitigating
administrative need must also be accounted for in the filing system. Agencies are required to
submit written justification of the mitigating administrative need to the State Archivist for approval.
Coordinate and track employee completion of public records management training to ensure
agency staff understand how to properly manage records, in compliance with authorized records
retention schedules.
Review and update internal public records management policies and procedures. Obtain State
Archivist approval of revisions to the agency public records management policy.
Develop and implement internal processes and procedures for the transfer, retrieval and
destruction of records in accordance with authorized retention periods.
Ensure that records are destroyed according to their authorized retention period. and
Document the destruction of public records and retain that documentation according to the
authorized records retention schedule found in OAR chapter 166-300.
Agencies must designate one or more employee(s) charged with the management of each
responsibility related to public records management outlined above. The organizational structure,
designated roles and associated responsibilities within the agency-specific records management
program is left to agency discretion based on the agency size and business requirements.
Model Policy Language
Oregon law requires agencies to designate an Agency Records Officer “to coordinate its agency’s
Records Management Program” (ORS 192.105(2)(a)). The INSERT: Agency Name records officer
will serve as primary liaison with the State Archivist and receive training from the State Archivist in
performing their duties.
INSERT: Agency Name will ensure agency public records are managed in accordance with their
authorized records retention schedules, from the time of creation to final disposition, by assigning
designated staff/positions with the following responsibilities:
[I
NSERT: Agency-Specific Information]
III. EDUCATION AND TRAINING
Agencies are responsible for developing a public records training program for all employees. The
Agency Records Officer will receive additional training from the State Archivist and will work within the
agency to coordinate staff training and awareness. The Archives Division will serve as a resource in
agency training development.
Each agency must implement a training program that includes basic public records training as a
component of new employee orientation training, completed at the time of hiring, and incorporate basic
public records training as part of regular employee training, completed once a biennium. The manner
and mechanism through which training is disseminated is left to agency discretion (e.g., iLearn,
Secretary of State Archives training, etc.).
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 5 of 11
Model Policy Language
Basic public records training will be completed as a component of INSERT: Agency Name new
employee orientation training and incorporated as part of regular employee training, completed
once a biennium.
INSERT: Agency Name will utilize the following training program to provide public records training:
[INSERT: Agency-Specific Information]
IV. ACCESS AND OWNERSHIP
Without regard to how public records are being stored, agencies must have custody and control over
created records and ensure all public records are maintained and accessible for as long as required by
their authorized retention schedules or litigation holds.
Agencies must develop a plan and implement procedures to ensure ongoing access to public records
in the event of a disaster. Additionally, agencies must continuously review the technological advances
related to their business practices and the availability of retained records and, migrate public records
to keep up with technology and to ensure enduring access.
Model Policy Language
Without regard to how public records are being stored, INSERT: Agency Name will have custody
and control over public records. Through ongoing review of technological advances, INSERT:
Agency Name will ensure all public records are maintained and accessible for as long as required
by authorized retention schedules or litigation holds.
INSERT: Agency Name’s disaster mitigation process is addressed in the INSERT: Agency Name
disaster preparedness and recovery plan and incorporated by reference here.
V. INTEGRITY
Agencies must ensure all public records reliably represent information actually used to conduct state
business and must apply adequate controls to ensure that the integrity of public records can be
demonstrated by certified copy or accompanying metadata.
Model Policy Language
INSERT: Agency Name will ensure appropriate access and version controls are applied to all
electronically stored records from record creation to final disposition.
The authenticity of each record can be demonstrated either by certified copy of paper records or
via accompanying metadata for all electronic records.
VI. RETENTION, GENERALLY
The public records retention practices of agencies must comply with ORS chapter 192 and OAR
chapter 166-300. Records not found on the State Agency General Records Retention Schedule are
considered to be program records listed under the Special Retention Schedules approved by the State
Archivist for the public records of a specific agency.
Agencies must preserve and classify public records according to ORS chapter 192, OAR chapter 166-
300 and DAS Statewide Policy 107-004-050 regarding Information Asset Classification.
Model Policy Language
INSERT: Agency Name will preserve and classify public records according to ORS chapter 192,
OAR chapter 166-300 and DAS Statewide Policy 107-004-050 regarding Information Asset
Classification.
INSERT: Agency Name will work with the Archives Division to establish retention practices to
ensure compliance with ORS chapter 192 and OAR chapter 166-300.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 6 of 11
CLOUD-COMPUTING
Refer to the DAS Statewide Cloud Computing Policy 107-004-150.
Model Policy Language
INSERT: Agency Name practices and procedures with respect to public records management
in the Cloud will comply with DAS Statewide Cloud Computing Policy 107-004-150 and OAR
chapter 166-300.
EMAIL
Official Email Accounts:
Employees are to use their official, state-issued email accounts primarily for communications
regarding official state business, and virtually all email messages composed or sent using
employees’ official equipment or official email addresses are assumed to be public records.
Employees must limit personal use of official email accounts and must not: (1) interfere with normal
business activities; (2) be associated with any outside for-profit business activity; or (3) otherwise
contain any content that would embarrass state government.
Personal Email Accounts:
If employees must use personal email accounts, they must copy their official email accounts on all
such outgoing communications, and forward any received messages on which their official email
accounts are not copied.
Personal email accounts (addresses) used for communications related to state business may be
subject to search and production.
Model Policy Language
Official Email Accounts
In most circumstances, emails sent to or from a state employee’s official email account will meet
the definition of a public record. Therefore, this policy requires that virtually all email messages
composed or sent using employees’ official equipment or official email addresses be for primarily
business purposes.
When INSERT: Agency Name receives a public records request, all official email accounts and
systems used for official state business are subject to search and production.
Personal Email Accounts
If employees must use personal email accounts to conduct state business, INSERT: Agency
Name requires that employees copy their official email accounts on all such outgoing
communications, and forward any received messages on which their official email accounts are
not copied, immediately or as soon as practicably possible.
INSTANT MESSAGING
The policy regarding Instant Messages is the same as that recited below regarding TEXT
MESSAGING.
Model Policy Language
INSERT: Agency Name policy regarding Instant Messages is the same as that recited below
regarding TEXT MESSAGING.
SOCIAL MEDIA
Agency use of social media must comply with all applicable laws, policies, procedures and standards
including without limitation: public records laws, privacy laws and regulations, statewide and agency-
specific IT security policies, internal audit controls, risk management standards, and applicable DAS
policies and procedures.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 7 of 11
Agencies will develop a social media plan, including practices and procedures, to address agency
use of social media for official state business to establish appropriate protocols for public records
posted to, stored on, or generated by use of social media, when records are not documented
elsewhere.
Content placed on a social media platform will be an accurate copy of an official record that is
retained elsewhere by the agency per the official retention schedule.
Public records generated by use of social media must be accurately captured and retained in
compliance with public records laws, authorized records retention schedules as well as other
applicable federal and state rules and policies.
Public records stored on social media must be accessible and retained in accordance with the
authorized records retention schedule, as well as other applicable federal and state rules and
policies.
Model Policy Language
Any content INSERT: Agency Name places on any social media platform must be an accurate
copy of an official record that is retained elsewhere by INSERT: Agency Name per the
authorized records retention schedules.
INSERT: Agency Name will develop practices and procedures to manage agency use of social
media to ensure public records are accurately captured and retained per authorized records
retention schedules.
[INSERT: Agency-Specific | Social Media Plan]
Agency Use Policy
• List of Approved Social Media Platforms [Facebook, Twitter, Snapchat, etc.]
List of Official Agency Social Media Sites
Records Management Protocols
• Agency Generated
• Use Generated
• Stored/Archived
Site Maintenance and Monitoring Practices
TEXT MESSAGING
Acceptable Use:
• Business Communications
Agencies may use text messages to communicate factual and logistical information related to
official state business, only if the content of the communication is documented elsewhere in an
official public record, meaning that the content of the text message:
o Has already been documented in a separate public record; or
o Necessarily will be documented and retained as a separate public record to comply with
applicable laws.
In the absence of separate documentation, state employees are not to use text messages for
official purposes other than routine communications that do not meet the definition of a public
record.
• Routine Communications
Agencies may use text messages for communicating factual or logistical information that would
not result in the creation of a text message-based public record, meaning text messages:
o Regarding scheduling or logistical information; or
o Providing factual information unrelated to official state business.
DAS
Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 8 of 11
Unacceptable Use:
State employees are to avoid communicating official state business or engaging in discussions
regarding the primary business of employees’ work over text message. As noted above, relevant
facts pertaining to official state business may be reported only if they are already documented in
separate public records or they necessarily will be documented in a separate public record.
I
f, notwithstanding this policy, an employee uses text message to communicate information (not
otherwise documented) relating to official state business or the primary business of the employee’s
work, such discussion is to be immediately converted and saved in a separate public record format
(e.g., by forwarding the relevant text messages to their official state email).
State-owned devices with text message capability are always subject to search.
A
gency employees’ personal electronic devices are not to be used to transmit text messages
related to state business. Personal devices used to transmit text messages regarding official state
business or other substantive information related to an employee’s work are subject to search.
Model Policy Language
Acceptable Use:
INSERT: Agency Name
employees may use text messaging to communicate factual and
logistical information related to official state business, only if that information has been
documented elsewhere, or will be documented and retained as a separate public record
according to the agency’s authorized records retention schedule.
In the absence of separate documentation, INSERT: Agency Name employees are not to use
text messages for official purposes other than for routine communications that do not meet the
definition of a public record.
Examples of Acceptable Uses
Scheduling.
Requesting a call or email on a matter, without substantive discussion.
Requesting or offering logistical assistance (“Can you help me get these boxes to th
e
C
apitol?”).
Forwarding any person’s contact information (“I’m at 503-378-6002.”).
Explaining your current whereabouts, or inquiring about someone else’s (“We’re at the
meeting discussing this morning’s announcement. Are you around?”).
Describing facts or events that do not relate to the substance of the agency’s wor
k
(“Spilled coffee all over myself right before my presentation!”), or that have been or
necessarily will be separately recorded (“Mr. Jones just testified to the committee tha
t
our b
ill would cost taxpayers $3 million.”).
Inquiring about e
vents like those in the previous bullet (“Has Mr. Jones testified in
c
ommittee yet?”).
U
nacceptable Use:
INSERT: Agency Name em
ployees must avoid communicating official state business or
engaging in discussions regarding the primary business of their work over text message.
As noted above, relevant facts pertaining to official state business may be reported only if they
are already documented in separate public records or they necessarily will be documented in a
separate public record.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 9 of 11
If, notwithstanding this policy, an employee uses text message to communicate information
(not otherwise documented) relating to official state business or the primary business of their
work , such discussion is to be immediately converted and saved in a separate public record
format (e.g., by forwarding the relevant text messages to their official state email).
Because INSERT: Agency Name requires that no text message-based public records be
created – or if they are created, that they be converted and saved in an alternate format, which
would serve as the official copy of the record – INSERT: Agency Name will not retain text
messages.
INSERT: Agency Name employees’ personal electronic devices should not be used to transmit
text messages related to state business. Personal devices are subject to search if used to
transmit text messages regarding official state business or information related to an employee’s
work that rises to the level of creating a public record.
UNIFIED COMMUNICATIONS
State government has entered into a contract with IBM to offer Unified Communications solutions
directly to agencies. Agencies must carefully select a user profile that includes specific packaged
services and determine which services should be active for employees based on agency-specific
business needs.
Certain features offered to agencies, if actively used by agency employees for official state
business, will result in the creation of public records. Agencies must develop internal policies and
practices to ensure such public records are retained if necessary and, otherwise, appropriately
managed according to authorized records retention schedules as well as other state and federal
policies and laws.
Model Policy Language
INSERT: Agency Name will identify public records created by use of active Unified
Communications features and ensure those records are appropriately managed according to
authorized records retention schedules as well as other applicable state and federal policies
and laws.
INSERT: Agency Name will implement the following practices and procedures to accurately
capture public records created by use of active Unified Communications features:
[I
NSERT: Agency-Specific Information]
VOICEMAIL
Unless otherwise required, messages on voicemail or other telephone message storage and
retrieval system will not be retained.
Email transcription of voicemail messages is a feature of Unified Communications solutions
referenced in the previous section. Email transcriptions of a voicemail message may be considered
a public record subject to retention and must be retained according to authorized records retention
schedules.
Model Policy Language
Unless otherwise required, INSERT: Agency Name will not retain messages on voicemail.
Email transcriptions of voicemails that are determined to be public records will be retained
according to authorized records retention schedules and may be subject to public disclosure
upon request.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 10 of 11
VII. STORAGE AND RETRIEVAL
PAPER RECORDS
Agencies will maintain a filing system of the agency’s paper records. The filing system will include the
location of records, retention periods and procedures for retrieval of agency records.
Agencies may transfer paper records to micrographics or convert paper records to an electronic format
for storage using electronic or cloud systems according to the technical and management standards in
OAR chapter 166 and DAS Statewide Cloud Policy requirements. The exception to this is for records
with an authorized retention period of 100 years or more where agencies are required to follow the
requirements of OAR 166-017-0045(3) prior to converting or destroying the paper records.
Model Policy Language
INSERT: Agency Name will maintain a filing system of the agency’s paper records based on
authorized retention schedules. The filing system will include the location of records, retention
periods and procedures for retrieval to ensure access to agency records.
ELECTRONIC RECORDS
At a minimum, agencies must establish a filing system and naming conventions for all agency records
stored in an electronic format. The filing system and naming conventions must support the agency’s
inventory of electronic records and must include the location of the records in agency directories,
retention periods, access controls and privacy conditions of the records.
Before deleting any large electronic record system, the agency must ensure that all retention periods
have been met before the data is destroyed.
Model Policy Language
INSERT: Agency Name will maintain a filing system and naming conventions for all agency records
stored in electronic format based on the agency’s authorized retention schedules. The filing system
and naming conventions will include the location of records in agency directories, retention periods,
access controls and privacy conditions to support management of the agency’s inventory of
electronic records.
INSERT: Agency Name will work with the State Archivist to ensure the agency meets retention
periods for all records before any data is destroyed and prior to deleting any large electronic record
system.
VIII. PUBLIC RECORDS REQUESTS
Agencies will process and respond to all official requests for public records as soon as practicable and
without unreasonable delay, according to timelines outlined in ORS 192.324 and ORS 192.329.
Agencies will develop and adopt internal policies and procedures to appropriately manage, track and
fulfill requests for public records.
Consistent with ORS 192.324(7), agencies will make available to the public a written procedure for
making public records requests. The written procedure must include the name of one or more
individuals within the public body to whom public records requests may be sent, with addresses, and
indicate that agencies will charge fees for fulfilling public records request according to the DAS
Statewide Policy on Public Records Requests Fees and Charges 107-001-030. Instructions and
supporting forms for submitting a public records request must be accessible, clear and user friendly.
Model Policy Language
INSERT: Agency Name will respond to all official requests for public records as soon as
practicable and without unreasonable delay, according to timelines outlined in ORS 192.324 and
ORS 192.329.
INSERT: Agency Name’s procedures for managing public records requests are incorporated by
reference here.
DAS Policy No. 107-001-020 | Effective Date: 2/1/2019
Page 11 of 11
IX. DISPOSITION AND DESTRUCTION OF PUBLIC RECORDS
Public records retained beyond their authorized retention period may be subject to public disclosure
upon request, even if their retention was not required by law. Unless otherwise stated, a retention period
begins on the date the public record was created. Retention periods are both a minimum retention and
maximum retention period.
Agencies must dispose of or destroy public records according to the requirements of OAR chapter 166-
300.
Pursuant to ORS 357.855, state employees within the Executive Branch must consult the State Archivist
for advice and assistance with determining the disposition of certain record types not accounted for in
State Agency General or Special Retention Schedules, and reconciling unforeseen issues regarding
public records.
Model Policy Language
INSERT: Agency Name will dispose of or destroy public records according to the requirements of
authorized records retention schedules and OAR chapter 166-300.
Pursuant to ORS 357.855, INSERT: Agency Name employees will consult the State Archivist for
advice and assistance with determining the disposition of certain record types not accounted for in
State Agency General or Special Retention Schedules, and reconciling unforeseen public records
issues.
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 1 OF 6
STATEWIDE POLICY
POLICY NUMBER 107-001-020
EFFECTIVE DATE
February 1, 2019
EXHIBIT A – Model Public Records Management Policy
POLICY
ORS 192.018 requires every state agency to have a “written policy that sets forth the agency’s use, retention
and ownership of public records” so that public records are maintained and managed appropriately across the
enterprise of state government, from the time of creation of a public record to the time of final disposition of the
public record.
Agencies are required to seek review and approval from the State Archivist, in accordance with ORS 192.018,
prior to adopting an internal public records management policy.
Agencies must review and, if necessary, update their public records management policy at least once per
biennium to reflect changes in applicable laws, policies and business needs, and to ensure ongoing access to
agency records. Any updates or revisions must be submitted for review and approval by the State Archivist
according to ORS 192.018, prior to adoption.
SPECIAL SITUATIONS
• Retained records may be subject to public disclosure upon request, even if their retention was not required
by law. The statutes requiring public disclosure of records apply more broadly than the statutes requiring
records to be retained.
• Agencies are not required to create public records that would not otherwise exist.
• Only the official copy of a public record must be retained. Stock of publications are not public records and
may be preserved for convenience or destroyed.
GENERAL INFORMATION
The goal of this policy is to ensure public records are managed and maintained appropriately within INSERT:
Agency Name and consistently across the enterprise of state government.
This INSERT: Agency Name Public Records Management Policy, adopted according to the requirements of
DAS Statewide Policy 107-001-020 and ORS 192.018, addresses the following components:
I. Public Records Maintenance
II. Roles and Responsibilities
III. Education and Training
IV. Access and Ownership
V. Integrity
VI. Retention, Generally
VII. Storage and Retrieval
VIII. Public Records Requests
IX. Disposition and Destruction of Public Records
COMPLIANCE
INSERT: Agency Name will develop and implement internal processes and procedures that support
compliance, deter abuse and detect violations of this policy.
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 2 OF 6
DEFINITIONS
Authorized Retention Schedule: Either a General Schedule published by the State Archivist in the OAR in
which certain common public records are described or listed by title and a retention period is established for
each; or a Special Schedule approved by the State Archivist for the public records of a specific agency.
Cloud-computing: Has the meaning established in the National Institute of Standards and Technology (NIST)
Special Publication 800-145
.
Custodian: A public body mandated, directly or indirectly, to create, maintain, care for or control a public
record. "Custodian" does not include a public body that has custody of a public record as an agent of another
public body that is the custodian, unless the public record is not otherwise available.
Instant Messaging: Real-time text communications between or among computers or mobile devices over the
internet or functionally similar communications networks.
Metadata: Data that provides information about other data. Metadata assists in resource discovery by allowing
resources to be found by relevant criteria, identifying resources, bringing similar resources together,
distinguishing dissimilar resources and giving location information.
Public Record: Has the meaning established in ORS 192.005. In general it refers to information that is
prepared, owned, used or retained by a state agency or political subdivision; relates to an activity, transaction
or function of a state agency or political subdivision; and is necessary to satisfy the fiscal, legal, administrative
or historical policies, requirements or needs of the state agency or political subdivision. Refer to the Secretary
of State’s guide for determination of a public record:
https://sos.oregon.gov/archives/Documents/recordsmgmt/rc/oregon-public-records-law-citations.pdf
.
Social Media: Web-based and mobile communication technologies that allow the creation and exchange of
user-generated content such as comments or responsive postings. Examples of social media include but are
not limited to Twitter, Flickr, blogging sites, Facebook, YouTube and Instagram.
Text Messaging: Messages exchanged between fixed-line phones or mobile phones and fixed or portable
devices over a network. Excluded from the definition of text messages are electronic mail (email)
communications, whether such messages are exchanged among or between official state government email
accounts or email accounts maintained by private entities.
Unified Communications: A service of IBM; the packaged services or user profiles available to agencies
(e.g., instant messaging, video conferencing, telephony, call management and call control across multiple
systems, etc.). Also known as IBM Unified Communications.
POLICY GUIDELINES
I. PUBLIC RECORDS MAINTENANCE
Public records must be maintained and managed in a manner that protects the integrity of the records
within INSERT: Agency Name without regard to the technology or medium used to create or
communicate the record, from the time of creation of a public record to the time of final disposition of
the public record as determined by their authorized records retention schedule.
II. ROLES AND RESPONSIBILITIES
Oregon law requires agencies to designate an Agency Records Officer “to coordinate its agency’s
Records Management Program” (ORS 192.105(2)(a)). The INSERT: Agency Name records officer will
serve as primary liaison with the State Archivist and receive training from the State Archivist in
performing their duties.
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 3 OF 6
INSERT: Agency Name will ensure agency public records are managed in accordance with their
authorized records retention schedules, from the time of creation to final disposition, by assigning
designated staff/positions with the following responsibilities:
[I
NSERT: Agency-Specific Information]
III. EDUCATION AND TRAINING
Basic public records training will be completed as a component of INSERT: Agency Name new
employee orientation training and incorporated as part of regular employee training, completed once a
biennium.
INSERT: Agency Name will utilize the following training program to provide public records training:
[INSERT: Agency-Specific Information]
IV. ACCESS AND OWNERSHIP
Without regard to how public records are being stored, INSERT: Agency Name will have custody and
control over public records. Through ongoing review of technological advances, INSERT: Agency
Name will ensure all public records are maintained and accessible for as long as required by
authorized retention schedules or litigation holds.
INSERT: Agency Name’s disaster mitigation process is addressed in the INSERT: Agency Name
disaster preparedness and recovery plan and incorporated by reference here.
V. INTEGRITY
INSERT: Agency Name will ensure appropriate access and version controls are applied to all
electronically stored records from record creation to final disposition.
The authenticity of each record can be demonstrated either by certified copy of paper records or via
accompanying metadata for all electronic records.
VI. RETENTION, GENERALLY
INSERT: Agency Name will preserve and classify public records according to ORS chapter 192, OAR
chapter 166-300 and DAS Statewide Policy 107-004-050 regarding Information Asset Classification.
INSERT: Agency Name will work with the Archives Division to establish retention practices to ensure
compliance with ORS chapter 192 and OAR chapter 166-300.
a. CLOUD COMPUTING
INSERT: Agency Name practices and procedures with respect to public records management in
the Cloud will comply with the DAS Statewide Cloud Computing Policy 107-004-150 and OAR
chapter 166-300.
b. EMAIL
Official Email Accounts
In most circumstances, emails sent to or from a state employee’s official email account will meet
the definition of a public record. Therefore, this policy requires that virtually all email messages
composed or sent using employees’ official equipment or official email addresses be for primarily
business purposes.
When INSERT: Agency Name receives a public records request, all official email accounts and
systems used for official state business are subject to search and production.
Personal Email Accounts
If employees must use personal email accounts to conduct state business, INSERT: Agency Name
requires that employees copy their official email accounts on all such outgoing communications,
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 4 OF 6
and forward any received messages on which their official email accounts are not copied,
immediately or as soon as practicably possible.
c. INSTANT MESSAGING
INSERT: Agency Name policy regarding Instant Messages is the same as that recited below
regarding TEXT MESSAGING.
d. SOCIAL MEDIA
Any content INSERT: Agency Name places on any social media platform must be an accurate
copy of an official record that is retained elsewhere by INSERT: Agency Name per the authorized
records retention schedules.
INSERT: Agency Name will develop practices and procedures to manage agency use of social
media to ensure public records are accurately captured and retained per authorized records
retention schedules.
[I
NSERT: Agency-Specific | Social Media Plan]
Agency Use Policy
• List of Approved Social Media Platforms [Facebook, Twitter, Snapchat, etc.]
List of Official Agency Social Media Sites
Records Management Protocols
• Agency Generated
• Use Generated
• Stored/Archived
Site Maintenance and Monitoring Practices
e. TEXT MESSAGING
Acceptable Use:
INSERT: Agency Name employees may use text messaging to communicate factual and logistical
information related to official state business, only if that information has been documented
elsewhere or will be documented and retained as a separate public record according to the
agency’s authorized records retention schedule.
In the absence of separate documentation, INSERT: Agency Name employees are not to use text
messages for official purposes other than for routine communications that do not meet the
definition of a public record.
Examples of Acceptable Uses
Scheduling.
Requesting a call or email on a matter, without substantive discussion.
Requesting or offering logistical assistance (“Can you help me get these boxes to the
Capitol?”).
Forwarding any person’s contact information (“I’m at 503-378-6002.”).
Explaining your current whereabouts, or inquiring about someone else’s (“We’re at the
meeting discussing this morning’s announcement. Are you around?”).
Describing facts or events that do not relate to the substance of the agency’s work (“Spilled
coffee all over myself right before my presentation!”), or that have been or necessarily will be
separately recorded (“Mr. Jones just testified to the committee that our bill would cost
taxpayers $3 million.”).
Inquiring about
events like those in the previous bullet (“Has Mr. Jones testified in committee
yet?”).
Unacceptable Use:
INSERT: Agency Name employees must avoid communicating official state business or engaging
in discussions regarding the primary business of their work over text message.
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 5 OF 6
As noted above, relevant facts pertaining to official state business may be reported only if they are
already documented in separate public records or they necessarily will be documented in a
separate public record.
If, notwithstanding this policy, an employee uses text message to communicate information (not
otherwise documented) relating to official state business or the primary business of their work,
such discussion is to be immediately converted and saved in a separate public record format (e.g.,
by forwarding the relevant text messages to their official state email).
Because INSERT: Agency Name requires that no text message-based public records be created –
or if they are created, that they be converted and saved in an alternate format, which would serve
as the official copy of the record – INSERT: Agency Name will not retain text messages.
INSERT: Agency Name employees’ personal electronic devices should not be used to transmit
text messages related to state business. Personal devices are subject to search if used to transmit
text messages regarding official state business or information related to an employee’s work that
rises to the level of creating a public record.
f. UNIFIED COMMUNICATIONS
INSERT: Agency Name will identify public records created by use of active Unified
Communications features and ensure those records are appropriately managed according to
authorized records retention schedules as well as other applicable state and federal policies and
laws.
INSERT: Agency Name w
ill implement the following practices and procedures to accurately
capture public records created by use of active Unified Communications features:
[INSERT:
Agency-Specific Information]
g. VOICEMAIL
Unless otherwise required, INSERT: Agency Name will not retain messages on voicemail.
Email transcriptions of voicemails that are determined to be public records will be retained
according to authorized records retention schedules and may be subject to public disclosure upon
request.
VII. STORAGE AND RETRIEVAL
Paper Records:
INSERT: Agency Name will maintain a filing system of the agency’s paper records based on
authorized retention schedules. The filing system will include the location of records, retention periods
and procedures for retrieval to ensure accessibility of agency records.
Electronic Records:
INSERT: Agency Name will maintain a filing system and naming conventions for all agency records
stored in electronic format based on the agency’s authorized retention schedules. The filing system
and naming conventions will include the location of records in agency directories, retention periods,
access controls and privacy conditions to support management of the agency’s inventory of electronic
records.
INSERT: Agency Name will work with the State Archivist to ensure the agency meets retention periods
for all records before any data is destroyed and prior to deleting any large electronic record system.
VIII. PUBLIC RECORDS REQUESTS
INSERT: Agency Name will respond to all official requests for public records as soon as practicable
and without unreasonable delay, according to timelines outlined in ORS 192.324 and ORS 192.329.
DAS STATEWIDE MODEL PUBLIC RECORDS MANAGEMENT POLICY PAGE 6 OF 6
INSERT: Agency Name’s procedures for managing public records requests are incorporated by
reference here.
IX. DISPOSITION AND DESTRUCTION OF PUBLIC RECORDS
INSERT: Agency Name will dispose of or destroy public records according to the requirements of
authorized records retention schedules and OAR chapter 166-300.
Pursuant to ORS 357.855, INSERT: Agency Name employees will consult the State Archivist for advice
and assistance with determining the disposition of certain record types not accounted for in State
Agency General or Special Retention Schedules, and reconciling unforeseen public records issues.
