Records Management Plan

IMAGE: The Orkney Islands Council crest and logo appear above the document title, “Records Management Plan”.

All our written information can be made available, on request, in a range of different formats and languages. If you would like this document in any other language or format please contact Corporate Services on 01856873535 or email Corporate Services.

Document Control

Status Control

Contents

• Foreword
• Introduction
• Records Management in Orkney Islands Council
• The 15 elements of Orkney Islands Council’s Records Management Plan
• 01: Senior Management Responsibility
• 02: Operational Records Management Responsibility
• 03: Records Management Policy Statement
• 04: Business Classification
• 05: Retention Schedules
• 06: Destruction Arrangements
• 07: Archiving and Transfer Arrangements
• 08: Information Security
• 09: Data Protection
• 10: Business Continuity and Vital Records
• 11: Audit Trail
• 12: Competency Framework for Records Management Staff
• 13: Assessment and Review
• 14: Shared Information
• 15: Working with Contractors

Foreword

This is the Records Management Plan for Orkney Islands Council and Orkney Islands Licencing Board. It has been prepared in compliance with the requirements of the Public Records (Scotland) Act 2011.

Orkney Islands Council takes its responsibilities for records management very seriously. We have been entrusted with the personal data of thousands of people and with information relating to the expenditure of tens of millions of pounds of public money each year. We have the records of the activities of the Council in its various roles as education authority, licensing authority, social work authority, planning authority, roads authority and the many other statutory functions which we perform for the people of Orkney. Our historical records and archives inform the historians of today and will provide a rich supply of material for the historians of the future. This is a heavy responsibility. The Council will protect and manage information like any other asset that we are entrusted with.

The Council expects that this Records Management Plan will provide a firm foundation from which we can make better use of this information. It will help make sure:

• That our officers and elected members have the right information to hand to support their activities and decisions.
• That information is freely available when required or only available to those who need it if that information is personal or sensitive.
• That it is accurate, reliable and up to date.
• That we do not waste valuable resources storing information which is no longer required is superseded or is duplicated elsewhere.

All this must be done against our obligations to safeguard the historical and archival memory of Orkney.

The Plan also recognises that we are on a journey. Many of the elements within the plan describe the future developments which will improve our records management policies and procedures.

I commend this plan to the Keeper of the Records of Scotland and the people of Orkney.

Alistair Buchan.

Chief Executive.

Introduction

The Public Records (Scotland) Act 2011 (hereafter referred to as "the Act"), came fully into force in January 2013. The Act obliges Orkney Islands Council and other public authorities to prepare and implement a records management plan (RMP). The RMP sets out proper arrangements for the management of records within the Council. The plan is agreed with the Keeper of the Records of Scotland (the Keeper) and reviewed by the Council on an annual basis.

The Orkney Islands Council Records Management Plan is based on the Keeper's published Model Records Plan. The model plan has 14 Elements and the Council has added a fifteenth.

The 15 elements of the Council’s Plan are:

1. Senior management responsibility
2. Records manager responsibility
3. Records management policy statement
4. Business classification
5. Retention schedules
6. Destruction arrangements
7. Archiving and transfer arrangements
8. Information security
9. Data protection
10. Business continuity and vital records
11. Audit trail
12. Competency framework for records management staff
13. Assessment and review
14. Shared Information
15. Working with contractors

Orkney Islands Council has provided the Keeper with evidence of policies, procedures, guidance and operational activity on all elements of the plan.

The plan was agreed with the Keeper on 13 June 2016 and will be reviewed in June 2017.

The Orkney Islands Council RMP relates to records throughout their lifecycle, from creation and acquisition to archive and destruction. It encompasses all records across all Council service areas. The plan also incorporates records held by Orkney Islands Licensing Board. The plan excludes the Joint Integration Board for Orkney. In the interests of making the document more readable, the Plan refers throughout to the Council. This includes any reference to Orkney Islands Licensing Board and any other bodies associated with the Council whenever appropriate.

For more information about the Public Records (Scotland) Act 2011, visit the website of the National Records of Scotland.

A copy of the Act can be viewed online via The National Archives website.

Records Management in Orkney Islands Council

The records of Orkney Islands Council constitute an auditable account of the authority's activities, which provides evidence of the business, actions, decisions and resulting policies formed by the Council.

Records represent a vital asset, which support the daily functions of the Council and protect the interests and rights of staff, and members of the public, who have dealings with the Council. Effective record keeping supports efficiency, consistency and continuity of work and enables the Council to deliver a wide range of sustainable services. It ensures that the correct information is captured, stored, maintained, retrieved and destroyed or preserved in accordance with business need, statutory and legislative requirements.

Records management is an essential part of enabling the Council to achieve priority outcomes that reflect what is most important to the people and communities of Orkney, as set out in the Council's Corporate Plan, available on the Council’s website. Orkney Islands Council maintains a Records Management Policy and procedures and practices across all its service areas. These are based upon the requirements of the Public Records (Scotland) Act 2011, records management best practice and the principles detailed below.

Records Management Principles

The following principles will drive activities relating to records management:

• Records are a valuable resource and must be managed as such.
• Records are maintained in accordance with legislation.
• Records are stored within record keeping systems, rather than in personal filing.
• Records are shared and not duplicated.
• Records are stored in a consistent manner that reflects council functions.
• Records are appropriately secured.
• Records are easily accessible for as long as they are required.
• Records that are identified as vital are protected.
• Records that are identified as of historical significance are preserved.
• Records are disposed of in accordance with approved Records Retention Schedules.
• Records management procedures are understood by all staff and staff are appropriately trained.
• Records management is a responsibility of all staff.
• Records management practices adhere to corporate policy, procedures and standards.
• Records keeping systems are compliant with the requirements to manage records throughout their lifecycle.
• Records management practices will support the Council values.

Records covered by this plan

In line with the Act, all records created in the carrying out of the Council's functions (whether directly or by third parties) are public records. Part 1, section 3.1 of the Act states:

"... "public records", in relation to an authority means –

(a) records created by or on behalf of the authority in carrying out its functions,

(b) records created by or on behalf of a contractor in carrying out the authority's functions,

(c) records created by any other person that have come into the possession of the authority or a contractor in carrying out the authority's functions."

Records Management Systems in the Council

Orkney Islands Council uses four main types of records management systems:

• Manual filing systems.
• IT applications and databases (that process records for specific functions e.g. HR, Purchasing, Housing Management etc.).
• Corporate Electronic Documents and Records Management System (EDRMs).
• Electronic documents stored on a shared drive using Windows Folders. The Council plans to phase out this type of records management system.

All records management systems are subject to records management policy, procedures, guidelines and elements of this plan.

The 15 elements of Orkney Islands Council’s Records Management Plan

01: Senior Management Responsibility

Senior Management responsibility for the Council’s Records Management Plan lies with Gavin Mitchel, Head of Legal Services. Senior Management responsibility for the Licensing Board’s records also lies with Gavin Mitchell, Clerk to the Board and the Council’s Head of Legal Services. Responsibility for providing advice on data protection and advising on and monitoring compliance with data protection laws, lies with Gavin Mitchell, the Council and the Board’s Data Protection Officer.

Responsibility for compliance with the Records Management Plan rests with the Information Asset Owners for each service, who are the members of the Council’s Senior Management Team.

For enquiries relating to the Records Management Plan, please contact:

Information Governance Officer

Orkney Islands Council, School Place, Kirkwall, Orkney, KW15 1NY.

Telephone: +44 (0) 1856 873535.

Email: george.vickers@orkney.gov.uk

02: Operational Records Management Responsibility

The point of contact for the operation of records management within the Council is George Vickers, Information Governance Officer, who is responsible for developing, delivering and maintaining a comprehensive information governance and security framework for the Council.

For enquiries relating to Records Management, please contact:

Information Governance Officer

Orkney Islands Council, School Place, Kirkwall, Orkney, KW15 1NY.

Telephone: +44 (0) 1856 873535.

Email: george.vickers@orkney.gov.uk

03: Records Management Policy Statement

Orkney Islands Council's commitment to effective records management is set out in the corporate Records Management Policy on the Council’s website, and is subject to ongoing monitoring and annual review.

Online guidelines and procedures are available to all staff. This is supported by online training and local experts within each service area.

Some records and documents are held in personal drives and personal email accounts and these are outwith the Council’s Records Management Policy. To help manage the amount of information held in shared drives and email accounts, the Council will introduce new procedures, including the automatic deletion of emails for most accounts after a period.

The Council will introduce an Electronic Documents and Records Management System (EDRMs) as a central corporate repository for documents and records currently stored in personal drives, personal email accounts and in other systems, such as the Council’s shared drives, which do not have Records Management functionality.

The Council also uses a series of different systems that manage documents and records, such as Paris for social work files, Iken for Legal Services files and Idox for planning files. All these systems will be reviewed and, where necessary, plans put in place to ensure that the systems apply the Council’s Records Management policies.

04: Business Classification

Orkney Islands Council has adopted the Local Government Classification Scheme (LGCS). This Scheme forms the basis of the Scottish Council on Archives Records Retention Schedule (SCARRS). The LGCS is no longer updated and the Council will now use SCARRS to inform its own Retention and Disposal Schedule.

Orkney Islands Council recognises the importance and benefits of organising its information in such a way that facilitates customer service, business efficiency and information management and has developed a business classification scheme covering all functions of the Council. The Information Governance Group has adopted the LGCS/SCARRS model, developed by the Scottish Council on Archives with the Information & Records Management Society and the Archives and Records Association, as a basis for its business classification scheme (BCS) and will adapt it to fully meet the requirements of the Council.

The agreed business classification scheme will encompass all the Council's activities. The SCARRS Scheme is based on the functions set out below and will need some adaption for it to apply to Orkney (e.g. add a section for airports).

1. Adult Care Services
2. Children & Family Services
3. Community Safety
4. Consumer Affairs
5. Council Property
6. Cemeteries & Crematoria
7. Criminal Justice
8. Democracy
9. Economic Development
10. Education & Skills
11. Environmental Protection
12. Finance
13. Health & Safety
14. Housing
15. Human Resources
16. ICT
17. Information Management
18. Legal Services
19. Leisure & Culture
20. Management
21. Planning & Building Standards
22. Procurement
23. Registrars
24. Risk Management
25. Transport Infrastructure
26. Waste Management

The LGCS is developed in a structure that supports the business activities of the authority. The LGCS hierarchy is structured in three tiers:

• Level 1: functions.
• Level 2: activities.
• Level 3: transactions.

The Council has combined its Business Classification Scheme and Records Retention and Disposal Schedule. This Schedule will need to be reviewed and amended following an audit carried out of the Council’s use of personal information in preparation for the General Data Protection Regulation coming into force on 25 May 2018.

The deployment of EDRMs in the Council will require that file plans are developed to accommodate strict security models, whilst facilitating information sharing, and the application of retention scheduling.

"Information Asset Administrators" are defined roles that manage and maintain local files plans for their service areas.

05: Retention Schedules

Orkney Islands Council has developed a Retention and Disposal Schedule with records organised according to the Business Classification Scheme (element 04).

The Schedule also lists those essential records that would be required for ensuring that the different services can implement their Business Continuity Plans.

The Retention and Disposal Schedule covers all the Council's records series and draws together into a single reference document all existing statutory, regulatory and best practice retention and disposal arrangements. Orkney Islands Council has adapted the Scottish Council for Archives records retention schedule model (SCARRS) as the basis for its Retention and Disposal Schedule and has mapped their schedule to their Business Classification Scheme. These retention and disposal schedules are endorsed by each Head of Service (as appropriate) and apply to both electronic records and paper records.

Requests for changes to the Schedule are only accepted through the Information Governance Group representatives. The Schedule is maintained by the Information Governance Officer.

The Schedule is located on the Records Management Policy page of the Council’s website.

Orkney Islands Council provides a centralised resource for long-term storage of operational records (non-current) and Orkney Library and Archives service, part of the Council, provides a service for the preservation of historical records. This resource manages the retention and disposal of these records and works with services to identify records for archival, preservation or destruction.

Standards for records retention are built into any contracts and agreements with third parties who share or process information on the Council's behalf.

06: Destruction Arrangements

The Council recognises that a disposal policy secures the position of the Council and helps every member of staff in their day-to-day work.

The Council has procedures for the disposal of records. The procedures require disposals to be:

• Authorised.
• Appropriate.
• Secure and confidential.
• Timely.
• Documented.

Destruction of highly sensitive hard-copy records will be supervised by an appropriate officer, normally from the relevant service.

Disposals of hard drives will be disposed of securely by the IT Service in accordance with the Information Security Policy.

Data in other electronic business systems will be deleted in such a way that prevents reconstruction.

07: Archiving and Transfer Arrangements

Orkney Islands Council operates Orkney Library and Archive, which provides facilities for the preservation of historical records.

The official records of Orkney Islands Council and predecessor authorities form a large and significant part of Orkney Archive. Archiving and transfer arrangements are detailed within policies, procedures and guidelines and within approved records retention schedules.

The Senior Archivist is responsible for deciding which records are to be kept permanently after liaising with the appropriate service areas. There are clear principles approved to help ensure that records which document the principal actions of the Council and its officials, the rights of the islanders and the community experience are identified and preserved.

Records identified in the Retention and Disposal Schedule as being suitable for permanent preservation are transferred from the Council Records Store, or directly from the respective Services to Orkney Archive. Transfer is undertaken using Council employees and Council vehicles.

Records received in Orkney Archive are documented on an Accession Receipt Form prior to entry in the Archive catalogue.

08: Information Security

Orkney Islands Council's Information Security Policy is a high-level document which sets out the Council’s strategic direction regarding information security.

The Policy is based on the 7 principles of information security listed below:

1. Data Protection - Ensuring data is protected.
2. Relevance and Consistency - Ensuring the controls in place to ensure information security are relevant to the risk, proportionate and applied consistently across the organisation.
3. Security is an Enabler - Viewing information security as a means of assisting rather than hindering the business strategy.
4. The Right Access - Employees require the right access to effectively do their job coupled with the principle of least privilege, but how can we share information securely to improve efficiencies and effectiveness.
5. Plan for the Unexpected - Regardless of vigilance vulnerabilities will emerge as new attacks occur, and malware mutate. Orkney Islands Council must anticipate this and be prepared.
6. Security for the Whole Lifecycle - Security should be considered from the start of a project and not bolted on later.
7. Accountability - It must be possible to hold authorised users of information accountable for their actions.

To ensure effective implementation in practice, this policy is underpinned by guidelines. The Corporate Information Security Staff Guidance booklet gives basic advice on basic information security, use of the internet at work, email and mobile devices. It also provides guidance on taking information out of the workplace, using IT equipment at home and what to do if something goes wrong. It also explains how ICT facilities may be used and the conditions in place relating to individual use.

Governance

The Head of IT and Facilities champions information security provides strategic leadership and reports to the Senior Management Team (SMT). Professional advice and guidance is provided by the Information Security Officer.

The Senior Management Team (SMT) sets the strategic direction in relation to information security and ensures resources for implementation. The fact that Information Security is represented at board level demonstrates its level of importance to Orkney Islands Council.

Orkney Islands Council has engaged the services of a CLAS consultant to advise on matters of infrastructure and operational security. A CESG CHECK compliant organisation is used to provide independent IT Health Checks to ensure that systems are compliant.

Orkney Islands Council's Communications Team has been engaged to ensure that all staff are kept up to date with changes and new systems of working.

09: Data Protection

To deliver services to the various communities in Orkney, Orkney Islands Council gathers and processes personal data about residents, staff and other individuals.

The Data Protection legislation regulates the processing of personal data by Orkney Islands Council. From May 2018, the Data Protection Act 1998 is replaced by the General Data Protection Regulation (the ‘Regulation’) and the Data Protection Act 2018. The Regulation gives individuals rights which are either new or enhance those set out in the Data Protection Act 1998. These rights are:

• The right to be informed about how their information will be used.
• The right of access to their personal information.
• The right to rectification, which is the right to require the Council to correct any inaccuracies.
• The right to request the erasure of any personal information held by the Council where the Council no longer has a basis to hold the information.
• The right to request that the processing of their information is restricted.
• The right to data portability.
• The right to object to the Council processing their personal information.
• Rights in relation to automated decision making and profiling.

The Council’s guidance for members of the public will be revised and published on its website.

Data Protection legislation is enforced and promoted by the Information Commissioner, who provides guidance and advice on complying with the terms of Data Protection legislation and investigates complaints regarding possible breaches of the obligations contained within this legislation.

The Information Commissioner maintains a register of Notifications listing all Data Controllers in the UK. Data Controllers are required to register the types of personal data processed by them, the purposes of that processing and the third parties with whom the personal data may be shared. The registrations for Orkney Islands Council can be viewed on the Information Commissioner's website. The Registration number is Z534547X.

The General Data Protection Regulation sets out 6 data protection principles which must be complied with when the Council is processing personal data. The 6 principles require that personal data is:

1. Processed lawfully, fairly and in a transparent manner in relation to individuals;
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. Accurate and, where necessary, kept up to date;
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

The Council’s Data Protection Policy and Data Protection Procedures sets out the responsibilities of officers and Elected Members.

The Head of Legal Services is the Council’s Data Protection Officer and has responsibility for Data Protection monitoring and compliance throughout the Council. Assistance is provided by the Information Governance Officer, who reports to the Head of Legal Services.

Each Information Asset Owner has nominated an Information Asset Administrator who is responsible for providing routine advice on Data Protection to the staff in that service. The Information Asset Administrators, with the Council’s FOI Officer, co-ordinate responses to Subject Access Requests made to that Service. Each Information Asset Administrator will also act as their Service representative on the Council's Information Governance Group, which is chaired by the Information Governance Officer. The Information Administration Administrators will receive training in Data Protection and Records Management.

The Council has a Data Protection Policy to ensure that the Council complies with the requirements of the Data Protection legislation. The Policy will be regularly reviewed. In addition, the Council has developed Data Protection Procedures and Guidance for officers to ensure compliance with the responsibilities of the Council when processing personal data. This includes policies and procedures for the use of mobile electronic devices, the use of Council email and internet systems, the application of passwords to electronic information, the disposal of IT hardware and a general records management policy.

The Council will enter into a Data Processing Agreement where a third party needs to be provided with personal data to allow it to deliver a service on behalf of the Council. The Council will also ensure that Information Sharing Protocols are entered into when the Council is proposing to share personal data in circumstances which are permitted in terms of data protection principles.

All Council officers are required to undertake information security training and those with access to Council information systems must complete data protection training to ensure that personal data is processed in accordance with the data protection principles. This training will be refreshed annually and is reinforced through the year with ongoing guidance available through the Council's intranet, and directly from the Information Governance Officer and Head of Legal Services.

10: Business Continuity and Vital Records

Orkney Islands Council has identified its vital records in the Retention and Disposal Schedule.

Each service team has its own Business Continuity Plan along with a nominated officer tasked with its ownership and maintenance. Each Plan is based on several scenarios which will include:

• Loss of access to premises.
• Loss of communications.
• Loss of systems.

The Vital Records are those records which the services will need to implement their Business Continuity Plans. As part of the Business Continuity Plans, each service will make contingency plans to ensure they have access to their Vital Records.

11: Audit Trail

It is recognised that at present, the Council does not have adequate procedures in place in relation to audit trails covering all transactions undertaken. Control sheets are now attached to new Council policies and procedures. Procedures and guidance will be investigated to ensure a corporate approach is developed and established which will cover all records.

IT systems, databases and case management systems provide audit logs that record usage and updates to records.

The Council will be introducing an EDRMS (Electronic Documents and Records Management System) which, once implemented will provides electronic audit trails as evidence of viewing, modifying and deletion of records. Users will be able to adopt this for new files and move existing files into this structure within an agreed timeframe. The Council plans to fully implement this for all electronic records not already held in case management systems and data bases.

In addition, the Council will investigate ways in which we can implement audit trails in relation to paper records. At present, paper records of an operational nature are maintained on site and identified within the paper records inventories. Archiving procedures ensure that paper records are tracked from local storage to long term archive/preservation.

12: Competency Framework for Records Management Staff

Orkney Islands Council employs staff who have specific responsibilities for Information Management and Records Management.

Role descriptions are available for the Information Governance Officer and the Senior Archivist.

All staff within Orkney Islands Council must complete mandatory online training in Information Security Awareness and all staff with access to the Council’s information systems must complete Data Protection training. Access to Council systems is revoked for staff that do not complete this training.

Local training modules have been put in place for service areas who routinely deal with more sensitive personal and/or confidential information.

An internal e-bulletin, published approximately 10 times a year, ensures that staff remain aware of records management and information governance requirements and best practice.

13: Assessment and Review

The Records Management Plan, Records Management Strategy and Records Management Policy are subject to the Council's standard governance, monitoring and review process.

This Plan and the Council’s compliance with this Plan, are formally audited and reviewed on an annual basis. This takes place at a special meeting of the Information Governance Group at which the Council’s Executive Director of Corporate Services and Data Protection Officer participate. Any significant amendments will be taken to the Corporate Management Team for approval.

Formal governance over this plan is set out in the table below.

All service areas are required to monitor, self-audit and report on performance on an ongoing basis. Service level plans are put in place for the continued development and improvement of records management practice in each area.

The plan is subject to audit by the Council's internal audit unit which adopts a risk-based approach.

All the policies, procedures and documents that support the Plan are reviewed regularly according to the dates entered the control sheet contained in each document.

14: Shared Information

Many of the services delivered by Orkney Islands Council require the Council to share information with other agencies and for the agencies to share information with the Council. This includes, but not is limited to many services delivered jointly with other agencies, including many services that are commissioned by Orkney Health and Care.

Orkney Islands Council will identify instances where information is shared with or processed by a third party.

The Council has signed the Scottish Accord on Sharing Personal Information (SASPI) and has developed guidance for staff to ensure that procedures are in place for sharing of information to best provide services to resident in Orkney and that the sharing of information complies with current Data Protection legislation.

The Council is working with its partners to develop Information Sharing Protocols to ensure that the SASPI principles and the Information Commissioner’s Office Data Sharing Code of Practice are implemented.

15: Working with Contractors

The Council will identify scenarios where contractors will create or manage public records at an early stage.

Where a substantial element of the work will involve the management of the Council’s records, an assessment of the tenderers’ records management capability will be included as part of the procurement process.

Clauses on data protection, confidentiality and transfer of Council records once the contract has ended are included in the Council’s standard contracts for all goods and services.