I don't have the regs in front of me, so I can't say which ones for sure,
but there are requirements in some regulations that say that an organization
must retain copies of destruction reports.
I understand the point about a self perpetuating system, but usually 1
report will contain details regarding the destruction of thousands of
Records.
The processes that I most commonly design include workflow to send a report
listing records that are candidates for destruction to all involved parties.
Each party has XX days to respond to the report with an OK to destroy or to
indicate a hold should be placed on certain Records. Then, the Candidates
for destruction that have not had holds placed on them are destroyed and the
reports with the involved parties' approvals for destruction are kept as
Records to cover the a$$es of the Records Managers.
It is important to record what was destroyed, when it was destroyed, who
approved the destruction and the method of destruction. (this may be an
incomplete list, as it is off the top of my head).
In the case of discovery, all this information is important and could be
relevant to a case. If all you can say to the judge is "The document isn't
there, so it must have been destroyed according to its retention schedule",
you could be facing fines and a prison sentence if you are the responsible
party.
An Audit trail of a particular Record won't be sufficient to indicate who
okayed the destruction. It tells What was done, and Who did it, but it
rarely contains information on who approved the destruction and I have yet
to see an audit trail that includes any kind of signature, digital or
otherwise to indicate approval - which are present in Destruction Reports.
My .02
-----Original Message-----
From: Records Management Program [mailto:[log in to unmask]] On Behalf
Of mwhaider
Sent: Wednesday, August 23, 2006 9:38 AM
To: [log in to unmask]
Subject: Re: documenting destruction of electronic records
Hello Susan,
I agree with you. If electronic systems are configured correctly, the audit
trails should be sufficient. I think we are coping with electronic systems
that were not configured to provide this information - and more importantly
were not configured to activate disposal based on the current records
retention schedule. So unfortunately we are often creating work arounds
until the technology catches up with established Records Management
practices.
In regards to Certificates of Destruction, they generally document that
someone actually completed the disposal; and are generally useless for RIM
purposes unless the list of records destroyed is attached. We do this to
document the final step of the life cycle process.
Thanks Mary
On 8/23/06, DIGEST Susan Vaillant <[log in to unmask]> wrote:
>
> Hello
>
> I may be naive, but I don't understand why you would need to create a new
> record to explain what happened to a destroyed record, in an electronic
> environment.
>
> If document A is scheduled for destruction after five years, and after
> five
> years you can no longer find it, this "absenceness" would indicate that
> the retention schedule had been applied. And the evidence for destruction
> would be in the audit trail of metadata. (That is, in those systems that
> are programmed to retain the audit trail/metadata "forever".) The audit
> trail becomes your de facto destruction certificate - although the absence
> of the record should speak for itself. In a properly designed system,
> the destruction mechanism is controlled only by an authorized records
> manager anyway. (Not just anybody can trigger destruction.)
>
> A second problem with issuing destruction certificates is that I may in
> good faith sign one, unaware of copies elsewhere...that's another topic..
> But the first problem is creating a new record to replace an old record,
> just because it was destroyed properly. A self-perpetuating industry!
>
> Please everyone correct me if I'm way off here. I spent most of my time
> in
> data protection land these days and only reactivated my subscription a few
> weeks ago.
>
> My 2 Euros worth, from Strasbourg, France
> Susan
> *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
> Susan Vaillant
> Director, Quintiles Europe Data Protection Compliance/Records Management
> Correspondante Informatique et Libertés, Quintiles France
> [log in to unmask]
> ****************IMPORTANT--PLEASE READ*******************
> This electronic message, including its attachments, is COMPANY
> CONFIDENTIAL
> and may contain PROPRIETARY or LEGALLY PRIVILEGED information. If you are
> not the intended recipient, you are hereby notified that any use,
> disclosure,
> copying, or distribution of this message or any of the information
> included
> in it is unauthorized and strictly prohibited. If you have received this
> message in error, please immediately notify the sender by reply e-mail and
> permanently delete this message and its attachments, along with any copies
> thereof. If this electronic message contains a zipped attachment and you
> do
> not have a decompression tool, you may download unZIP (free of cost) from:
> http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request
> that the attachment be resent in an uncompressed format. Thank you.
> ************************************************************************
>
> List archives at http://lists.ufl.edu/archives/recmgmt-l.html
> Contact [log in to unmask] for assistance
>
--
Mary W. Haider, CRM
Records & Information Manager
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|
