Social media records

The Public Records Act 1973 (s2) defines a public record as “any record made or received by a public officer in the course of [their] duties.” This definition includes all messages sent, and responses received, by public officers when carrying out their duties, regardless of the:
•    medium used to send or receive the message
•    account name used to send or receive the message
•    role or seniority of the public officer sending or receiving the message.

Social media posts are records when…

Social media posts created or received by a public officer in the course of their duties are evidence of government business. They document the actions taken by public officers and should be managed as a record for reasons of accountability and transparency. 

Types of social media posts include:
•    original posts on a social media site
•    responses, if any are received, to the original post
•    relevant posts identified when monitoring social media sites
•    content republished by the agency when the content has come from elsewhere.

Please note:
•    This applies whether the account used is one for the agency or the personal account of a public officer when being used for government business. 
•    Copyright should always be considered before republishing non-agency messages.

Social media posts are not records when…

If there is no intersection with their duties, private use of social media by a public officer is not considered to result in a public record and therefore does not need to be captured.

Setting social media guidelines

Agencies are responsible for developing and issuing social media guidelines and ensuring the guidelines:
•    account for PROV recordkeeping requirements
•    clearly state who may authorise or publish social media messages on behalf of the agency
•    outline how, when and where posts should be captured
•    provide advice on the responsibilities of government employees when using social media in a private capacity
•    are provided to all staff, including contractors and volunteers.

Agencies should refer to PROS 19/05 Create, Capture and Control Standard and then conduct a risk assessment to determine:
•    which social media posts will need to be captured to meet legislative, regulatory and business requirements 
•    the risk to their organisation and to the community if the social media posts are not captured.

Examples of social media content required to be captured may include:
•    emergency warnings
•    communications activities
•    volunteer recruitment
•    complaints and feedback
•    crowd-sourced policy development

It is important when capturing social media records that both the content and the context of the post are captured. 

Capturing content

When capturing the content, the information that is sent or received as well as a representation of the format (text, visual, sound or video) of the original content should be captured (if appropriate, a text log of entries may be kept).

Capturing context

The context will assist with the understanding of the message when it is viewed by a third party or at a later date and should include:
•    Date and time it was sent or received.
•    The name of the public officer that sent the message, who authorised the social media message, and to whom it was sent (at a minimum a group address).
•    The public officer and account name that received the message, the person to whom it was sent, and the name used by the person who posted the message (no need to determine the sender’s actual identity)
•    The purpose of the message.
•    The name of the social media application that the message was published on.

See PROS 19/05 S2 Minimum Metadata Requirements Specification for more information.

Linking the message to the context is vital to creating a narrative in which the record may be properly understood. A person viewing the social media record must be able to follow the story of why the social media was used and how it links into the work of the organisation.

Capturing conversation threads is a good way of retaining the context of a social media message. However, privacy should be considered when capturing threads of conversation. Agencies should seek only to capture personal information when it is relevant to the business and de-identify information that does not hold any relevance to the conduct of the business.

Capturing evidence of social media monitoring

As well as capturing social media posts, records relating to the monitoring of social media (such as working documents relating to the social media accessed and relevant posts) may also need to be captured when:
•    an employee is monitoring social media sources in the course of their work
•    action is initiated through monitoring social media
•    social media is used to conduct an investigation
•    an investigation has been based on content of social media.

Agencies should:
•    determine their own standards for logging social media monitoring (that does not result in an action)
•    contact their records management unit or contact us to seek advice on setting standards for logging or disposal.

After establishing which social media records should be captured, a method for how to capture the posts will need to be chosen. 

Methods of capture include:
•    manually saving a screen shot of the post along with information regarding its context as a Word or PDF document
•    using an automated application to capture posts.

PROV does not recommend any specific capture technology for social media because:
•    different capture technology is required for different types of social media.
•    government needs vary widely and agencies should independently investigate the options available to identify the capture technology solution that is best-suited to them.
•    social media capture technology is a rapidly changing area and specific recommendations will quickly become redundant.

Any automated process for capturing social media records should be able to store the metadata required to contextualise the message appropriately. 

The metadata should communicate: 
•    the relationship the social media record has with other records
•    the context that the social media was used in (for example, a statement or a reply)
•    any other related documents that help make the social media usage understandable.

Agencies should thoroughly investigate the specifications and Terms of Service for any commercially available product before commencing its use to ensure the product meets their capture, privacy and security needs. Many services for backing up social media records require the data to be stored on a cloud computing system. 

Agencies should investigate whether the service is cloud based, and be aware of the legal and privacy implications of storing data in a cloud computing system before subscribing to any back-up service. 

Social media posts should be captured as soon as possible after posting as there is no guarantee how long they will remain online.

Timely record capture may be required for performance review, Ombudsman or Royal Commission purposes and may support decisions made in critical situations.

Capture frequency may occur at the end of each day or week, as deemed appropriate by the agency. Your risk assessment will help you to determine how frequently posts should be captured.

Agencies should:
•    set guidelines outlining when a record should be captured
•    always be conscious of the fact that externally hosted social media sites have no guarantee of long-term access to the post or message once it is sent. 
 

The retention period for any record is set based on the purpose, content, or result of the communication and not by the format of the record. Therefore, there is no ‘one-size-fits-all’ answer with regard to how long social media records should be kept.

Agencies should refer to relevant Retention and Disposal Authorities (RDAs) issued by PROV to determine retention and disposal actions for their social media records.

Records of irrelevant, ephemeral and off-topic responses can be culled under Normal Administrative Practice (NAP).

All public officers are bound by the Information Privacy Principles in the Privacy and Data Protection Act 2014, regardless of the format of the records they create.

See Office of the Victorian Information Commissioner for further information.

Copyright restrictions may vary between social media sites. Agencies need to be aware of the Terms of Service of all social media outlets utilised to ensure appropriate copyright measures are taken.