I would recommend that you coordinate these statements with your
Information Security policy. In many cases, the InfoSec policy will address
ownership of the organization's information as well as approved locations
for physical storage of information. Keep in mind that mobile devices and
laptops technically allow someone to remove information from the premises,
so be cautious in how you define this.

If you're trying to avoid a Hillary Clinton email server situation, then
address that very directly -- and it should be reinforced by InfoSec.

You also need to ensure that the statements are inclusive of USB storage
drives, unauthorized cloud storage, personal email, and the "Charlie's
Garage" sort of situation (short pause while the old timers all smile about
that reference). For those unfamiliar with Charlie's Garage, see:
http://www.commonwealthfilms.com/s/1_18_12.asp

As a public agency, you may be able to reference state statutes (FOIA,
Local Records?) or local ordinances that govern these issues as well. Some
organizations have ethics statements that cover these issues. Since you
work for an airport, there may also be certain records that are governed by
Federal law.

Ownership of information can be similarly addressed and can be reinforced
during employee onboarding and exits -- including having employees (and
elected / appointed officials) sign a statement acknowledging that they
understand this policy and (upon exit) that they do not have returned
organization information to the organization. As noted elsewhere, there may
be instances, where certain records or information is technically owned by
another organization or entity, but the point is that the exiting employee
(or official) has no claim on or right to retain any records or information
associated with the organization.

Patrick Cunningham, FAI

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]