Data

While all data is technically a record, for the record to be evidentially valuable it needs to meet additional requirements. The Standards issued by the Keeper define the components needed to ensure that public records have and retain their integrity as evidence of government decision making, actions and communications over time for as long as they are needed. The Standards cover the lifecycle of a record as well as strategic and operational management. 

For example, requirements for PROS 25/02 Create, Capture and Control Standard include the following:

Public offices must determine:

• what records are needed
• how the records should be described (i.e. required metadata)
• how the records should be created (i.e. responsibilities and processes)
• how these records are to be consistently and routinely captured (i.e. systems, processes, formats).

This determination must be based on the value and function of the records to the organisation, government and the community, considering both current and future needs.

Addressing the above requirement needs consideration of:

• the purpose of the data: for example, what function and activity or process does it relate to?
• the value of the data: how is it valuable, to who, and why?
• the completeness of the data: what is needed for it to be full and accurate?
• the context of the data: what does it relate to, how, and why?
• the longevity of the data: how long will it be needed for, what does it need to continue to be accessible and usable during that time?
• any risks associated with the data: for example, security risks, preservation risks, privacy risks and system functionality risks all impact on how the data is to be stored, managed and accessed over time.
• any additional information that may need to be captured and associated with the data: for example, information about its format to enable it to be read, who is authorised to access it and under what conditions, what happens to the data once its retention period is completed and so on.

This will help to identify what data will form the record as well as what additional data and metadata will need to be captured and related to it in order to best describe it in context. All of this together forms the 'record'.

Data may be part of the record, or the whole record, as well as being the metadata used to describe the record. Metadata elements required for recordkeeping are specified in metadata standards. The standards preferred in Victoria are:

• AS/NZS 5478: 2015 Recordkeeping Metadata Property Reference Set
• Australian Government Recordkeeping Metadata Standard (AGRkMS)

Another standard which has previously been used is:

• AS 5044.1-2010 AGLS Metadata Standard, as implemented by the AGLS Victoria: Metadata Implementation Manual.

This standard is no longer maintained and so should be avoided where possible.

The minimum metadata set for Victorian public records is provided in PROS 19/05 S2 Minimum Metadata Requirements Specification. When digital records of permanent value are transferred to PROV as state archives, they must be packaged with required metadata as specified in PROS 25/02 S5 Adding Metadata Packages to VERS Encapsulated Objects (VEOs) Specification.

Data is constantly being updated, added to, deleted, adjusted and moved. Decisions need to be made about what is to be preserved, how, when to preserve it and in what form.

PROV developed the Victorian Electronic Records Strategy (VERS) to enable the long-term preservation of electronic/digital records. VERS uses the VERS Encapsulated Object (VEO) format to ensure that records are captured along with their contextual metadata in a long-term sustainable format so they may be accessed, read and used over time in a manner that preserves the integrity of the record.

Software Independent Archiving of Relational Databases (SIARD) was developed by the Swiss Federal Archives in 2004 for long-term preservation of databases. It is one of the long-term sustainable formats recommended by PROV in PROS 19/05 S3 Long Term Sustainable Formats Specification.

Under the Act, anything (including data) created or received by a public officer in the course of their duties is a public record and must be managed as such. Disposal of data must be lawful and undertaken in accordance with a disposal authority issued by the Keeper.

Requirements for disposal are covered by PROS 22/04 Disposal Standard. This includes the development and use of Retention and Disposal Authorities (RDAs) which are issued as Standards under the Act.

RDAs:

• set the mandatory minimum retention period(s) for records based on the records purpose
• authorise the destruction of records once the minimum retention time has been met
• specify records that are to be retained permanently as State Archives.

General RDAs cover the records related to functions and activities that are common to many public offices in the Victorian Government.

Function specific RDAs cover records relating to functions that are carried out by a select number of public offices or those unique to a single public office.

PROV recognises that data is frequently and legitimately updated, overwritten and deleted. The principle of disposal in accordance with normal administrative practice (NAP) enables the revision and deletion of minor content updates, such as those in databases, which will not be needed to show actions, decisions or approvals.

Access provisions are generally in relation to:

• State Archives held by PROV being open unless specifically closed under a relevant section of the Act
• Public records being able to be identified, located, retrieved, read and used for the duration of their retention periods.

PROV access requirements are located in PROS 26/01 Access Standard.

Moving data from one public office to another due to machinery of government change or administrative change is addressed in PROS 23/01 Strategic Management Standard.

PROV does not have specific requirements regarding the sharing of data between public offices. Please refer to the Data Sharing Policy and associated Heads of Agreement and the Data Exchange Framework.

For access in relation to privacy and security, see the Office of the Victorian Information Commissioner.

The European Union (EU) General Data Protection Regulations (GDPR) are a set of laws and regulations which exist to protect the rights which European residents have around the use of their data. It is currently unclear to what degree the GDPR should be considered to apply to Australian government bodies, but it is likely some functions (especially commercial ones) would come under the GDPR umbrella. In the Victorian government context, if the work your public office performs:

• has an 'establishment' in the EU
• is outside the EU but offer goods or services in the EU, or
• is outside the EU but monitor the behaviour of individuals in the EU

Then it is more likely that the GDPR could apply. Examples of public offices that may fit these criteria include offices:

• with an office in the EU
• whose website targets or mentions users in the EU
• which track individuals in the EU on the internet and uses data processing techniques to profile individuals to analyse and predict personal preferences, behaviours and attitudes.

Potential Victorian public offices to which GDPR may apply could include research, higher education and health institutions where they conduct activities or receive data from the EU.

OVIC and the Office of the Australian Information Commissioner (OAIC) have detailed information on the context behind the GDPR and the places where state and federal protection laws in Australia overlap with those of the GDPR. We would recommend utilising these resources and/or contacting these bodies for further information about compliance considerations.