0:00:00.080,0:00:14.480
I'd like to welcome you to today's Records Managers Online Forum and in doing so acknowledge traditional owners of the lands on which we're severally meeting this morning and pay respects to elders past, present and emerging.
0:00:15.040,0:00:16.160
My name is Martyn Killion.
0:00:16.160,0:00:20.800
I'm the Executive Director of State Records NSW and Executive
0:00:20.840,0:00:27.920
Director of Records, Archives and Collections in Museums of History NSW and I'll be chairing today's session.
0:00:29.120,0:00:46.000
We've had a fairly overwhelming response to today's session with around 450 registrations which is fantastic but also a wonderful reflection of clearly the interesting topics that we have on today's agenda.
0:00:46.000,0:00:49.920
We really do have really quite a full agenda today
0:00:51.040,0:00:56.640
and with some wonderful speakers and wonderful information to impart.
0:00:57.760,0:01:08.720
So before we introduce our first speakers, as always at the end of each session, we will open up the session for any questions.
0:01:09.040,0:01:16.080
Can I ask you please to use the chat function in Teams to ask any questions or make any comments?
0:01:16.640,0:01:20.760
Please don't worry about the Q&A button there, but the chat function
0:01:21.760,0:01:23.240
should be the one that you use.
0:01:23.240,0:01:26.800
So if everyone can use the chat function for any questions or comments.
0:01:29.200,0:01:43.760
All right, I'd like to introduce our first two speakers who are colleagues from NSW GovAI, the new government entity that has been established.
0:01:44.320,0:02:00.400
So first of all, I'd like to introduce Natalie Chehade, who is the Principal Advisor of AI Policy and Adoption, and also Daniel Ward, who is the Principal Advisor of Enterprise AI Risk and Innovation.
0:02:01.280,0:02:11.680
And both Natalie and Daniel will be speaking about Responsible AI in Practice: Implementing the NSW AI Operational Policy and AI Assessment Framework.
0:02:12.320,0:02:13.920
So Natalie and Daniel, welcome.
0:02:14.560,0:02:17.320
And I'll hand over, I think, Nat, to you first.
0:02:17.320,0:02:17.820
Is that right?
0:02:18.240,0:02:18.800
That's right.
0:02:18.800,0:02:19.920
Thanks so much, Martyn.
0:02:19.920,0:02:21.440
And good morning, everyone.
0:02:21.760,0:02:24.240
I'm just going to share my screen before I begin.
0:02:24.240,0:02:27.680
So if you just bear with me for one moment, I'll get that working.
0:02:33.200,0:02:36.240
Just a thumbs up if you can see the presentation slides.
0:02:36.560,0:02:37.200
We're good.
0:02:37.440,0:02:37.940
We're good now.
0:02:38.600,0:02:39.360
Amazing.
0:02:39.360,0:02:39.920
Perfect.
0:02:40.720,0:02:56.880
So today me and my colleague Dan are going to talk about the NSW AI Operational Policy and the AI Assessment Framework and how both the policy and the framework support good governance and recordkeeping when it comes to using and
0:02:58.880,0:03:00.000
implementing AI.
0:03:00.760,0:03:02.800
Are you able to see the slides at all?
0:03:02.800,0:03:04.080
Because they've dropped off for me.
0:03:04.480,0:03:05.280
Yes, we can.
0:03:05.560,0:03:05.960
Yep.
0:03:05.960,0:03:06.720
OK, great.
0:03:07.440,0:03:09.800
So first I'll just introduce you to what our team does.
0:03:09.840,0:03:15.600
So we're in NSW GovAI within Digital New South Wales in the Department of Customer Service.
0:03:15.920,0:03:18.800
So we were formally known as the Office for AI.
0:03:19.760,0:03:26.640
We were set up in September 2025 to lead safe and responsible AI adoption across the NSW government.
0:03:27.040,0:03:37.520
And our focus is really on all of government AI guardrails and capability uplift for the public sector and coordinating reuse and enabling knowledge sharing.
0:03:38.080,0:03:45.440
So as you may have seen, the NSW Government recently announced a new Office of AI within the Cabinet Office.
0:03:45.760,0:03:50.960
So importantly, this has just meant a name change for us to GovAI.
0:03:50.960,0:03:55.760
Our work and our key priorities do remain the same.
0:03:56.720,0:04:13.920
So the new Office of AI, their focus is to strengthen government's response to the broader opportunities and challenges that are presented by AI, including focusing on public policy issues such as AI impacts to the environment, citizens and the economy.
0:04:16.320,0:04:22.720
So our three key programmes this year include the NSW AI
0:04:23.280,0:04:24.400
Operational Policy.
0:04:24.400,0:04:26.640
So I'll be talking a little bit more about that today.
0:04:26.960,0:04:31.360
So the policy sets all of government requirements for responsible AI use.
0:04:32.000,0:04:45.040
We've got our AI literacy learning courses, so they're designed to build the skills and capability that public servants need to use and govern AI in a safe and responsible way.
0:04:45.760,0:04:48.160
And the AI Assessment Framework Platform
0:04:48.480,0:04:56.160
So the platform provides NSW government agencies with a platform to register, assess and manage their AI use cases.
0:04:56.480,0:05:05.680
So it's currently rolled out to select agencies as a pilot, but full agency adoption will be required by the 30th of September this year.
0:05:08.400,0:05:12.960
So the AI Operational Policy was first published on the 30th of July this year.
0:05:13.280,0:05:15.520
So on the Digital NSW website.
0:05:16.080,0:05:18.800
We can drop the link in the chat as well if that's helpful.
0:05:19.520,0:05:25.360
So we developed the policy with stakeholders across the NSW government through a two-round consultation process.
0:05:26.000,0:05:38.960
So we included a broad range of representatives, including from State Records NSW, but also other subject matter experts in governance, legal, cybersecurity, data and privacy.
0:05:39.520,0:05:45.040
During consultation, we received over 60 responses from about 30 agencies across the sector.
0:05:45.440,0:05:48.640
So we had really good engagement through that process.
0:05:49.280,0:05:59.840
So ultimately, the policy aims to enable safe, ethical and lawful AI use and to improve transparency, accountability and public trust in government's use of AI.
0:06:00.240,0:06:14.240
So it sets the requirements for accountability, risk management, acceptable use of AI, and it is also mandatory for all NSW government agencies under Department of Customer Service Circular 2026-02.
0:06:14.640,0:06:17.600
And I can also drop the link in the chat as well.
0:06:19.600,0:06:24.000
So at the heart of the policy are really these seven mandatory agency requirements.
0:06:24.320,0:06:25.760
So this is the full text here.
0:06:25.760,0:06:36.400
It can be a little bit overwhelming, but I will jump to the next slide which shows you a high level visual of the requirements and how agencies might go about to implement them.
0:06:38.480,0:06:47.680
So the first requirement here is really the foundational requirement and that's for all NSW government to adhere to Australia's AI Ethics Principles.
0:06:48.000,0:07:01.280
So the principles were developed by the Australian government to support government and public servants practice the highest ethical standards and really these principles must underpin all of our decision making when it comes to AI.
0:07:02.240,0:07:05.600
So the principles emphasise things like respect for human rights,
0:07:06.080,0:07:12.000
fairness, transparency, accountability and the promotion of wellbeing for individuals, communities and the environment.
0:07:12.480,0:07:25.440
And in NSW, we've adopted these principles to ensure that AI systems are developed and deployed in Australia against one shared set of expectations and that vendors can also build to a single national standard.
0:07:27.040,0:07:31.520
Requirement 2 is that agencies must appoint an accountable official.
0:07:32.080,0:07:42.320
So this is the person that's responsible for overseeing the implementation of the policy, which creates really clear executive accountability for AI governance.
0:07:42.800,0:07:49.840
So agencies must let NSW GovAI know of their designated accountable official by the 1st of November this year.
0:07:50.320,0:07:56.720
So for those on the call who may be subject matter experts in your agencies or responsible for anything related to AI.
0:07:57.840,0:08:03.040
It's really important to know who your accountable official is once they're appointed.
0:08:03.600,0:08:12.640
So those appointments are still coming through to us, but that will be really important because you may be called on to support the implementation of the policy requirements in your agency.
0:08:14.160,0:08:21.600
The remaining requirements on the right of the screen are the practical actions that agencies need to embed into everyday delivery.
0:08:22.640,0:08:26.880
So the first grouping up the top is enabling safe AI use for public servants.
0:08:27.360,0:08:36.320
This focuses on embedding responsible AI practices within an agency's ICT policy and making AI training available to staff.
0:08:36.720,0:08:45.280
So the first requirement there is that agencies must align their ICT Acceptable Use Policies to comply with the Acceptable Use Standards in the policy.
0:08:46.480,0:08:55.920
So the Acceptable Use Standards, they set a consistent framework for every public servant to understand what they're accountable for when it comes to using AI.
0:08:56.640,0:09:04.320
They outline key principles and practices, including that public servants remain responsible and accountable for their AI use.
0:09:04.720,0:09:15.040
So this means that you must be able to explain and justify your AI used, what role it played in your work, and how any decisions informed by AI were reached.
0:09:15.960,0:09:31.920
You must ensure complete and accurate records of AI generated decisions, insights or content are captured and retained as state records, particularly where they're used to make decisions that could affect people's rights, interests or access to services.
0:09:32.640,0:09:35.840
So good recordkeeping is really essential to meeting that requirement.
0:09:36.160,0:09:45.680
Obviously without appropriate records it's really difficult to demonstrate how you made a decision, what information was relied upon and whether AI was used appropriately.
0:09:46.720,0:10:00.800
So in practice, every public servant should be thinking not only about how they're using AI, but about what records need to be kept to provide transparency, support accountability and demonstrate the basis for your decision making.
0:10:02.400,0:10:11.280
The second requirement in that grouping is about making sure that staff have access to basic AI literacy and policy training.
0:10:11.920,0:10:14.640
So the GovAI team has actually developed three
0:10:14.920,0:10:22.880
courses in collaboration with the Institute of Applied Technology Digital in TAFE NSW to build AI capability.
0:10:23.040,0:10:29.600
So the three courses that we have are AI Essentials, Using AI Safely at Work and Effective AI Governance.
0:10:30.080,0:10:37.680
So we've rolled out the first AI Essentials course, so that's really for any public servant using AI in their work.
0:10:38.480,0:10:40.240
to uplift capability.
0:10:40.560,0:10:46.160
So we've made that available to agencies to integrate into their learning management systems.
0:10:46.400,0:10:57.200
So many of you may have those courses available shortly, but we are working with the contacts in your agencies to make sure that you do have access to those.
0:10:57.520,0:11:05.920
The remaining two courses will be made available in the coming months and they focus on public servant accountabilities under the policy.
0:11:07.680,0:11:15.920
So the remaining requirements in this grouping down here really focus on agencies establishing governance and assurance arrangements for AI use.
0:11:16.480,0:11:29.920
So agencies must ensure that the AI governance and assurance functions are accountable for oversight, risk management and decision making relating to AI use, including that decisions are documented and
0:11:32.080,0:11:32.720
auditable.
0:11:33.120,0:11:38.320
So we recommend that agencies use existing governance and assurance functions that may exist.
0:11:38.720,0:11:42.800
For example, your agency may have a governance board that oversees digital projects.
0:11:43.040,0:11:52.400
So rather than creating a bespoke function just for AI, we highly recommend just expanding what you already have to include oversight of AI as well.
0:11:54.080,0:11:57.760
So effective governance depends on good recordkeeping.
0:11:58.000,0:12:08.400
So under the policy, agencies must be able to demonstrate what AI systems are being used, how risks are assessed, who made key decisions and what controls have been applied.
0:12:09.600,0:12:21.120
To support this, agencies must register all AI use cases on the AI Assessment Framework platform and maintain accurate and complete records throughout the AI system life cycle.
0:12:21.600,0:12:28.480
So these records create an authoritative source of information about AI use within the agency.
0:12:29.160,0:12:33.520
So that enables your agency to answer fundamental governance questions like
0:12:34.000,0:12:44.560
what AI systems are we using, where are they deployed, who's accountable for them, what risks have been identified and what mitigations have been put into place.
0:12:46.240,0:12:54.880
So once you register your AI use case on the platform, the platform then determines whether a full AI Assessment Framework assessment is required.
0:12:55.360,0:13:03.760
So that assessment helps you identify risks, document decisions and define your mitigations.
0:13:04.960,0:13:16.720
So it's through that assessment process that as records experts you might be called on in your agency to provide advice to people on what records should be created, captured and retained.
0:13:17.440,0:13:28.160
This includes making sure that there's sufficient documentation to support transparency, accountability, audibility and explainability of AI enabled decisions.
0:13:28.480,0:13:33.680
So Dan will talk a little bit more about the role of subject matter experts through that assessment process.
0:13:34.560,0:13:35.060
in a sec.
0:13:36.080,0:13:44.640
And the last requirement here is that any higher critical risk cases assessed under the AIAF must be referred to the AI Review Committee.
0:13:45.440,0:13:57.520
So this committee consists of experts from industry, government and academia and their focus is to provide advice to agencies and the government on how to manage risk.
0:14:01.280,0:14:04.960
So recordkeeping in the policy is explicitly recognised.
0:14:05.520,0:14:17.120
So agencies are required to apply the policy alongside existing recordkeeping obligations as well as related requirements for data governance, cybersecurity and privacy.
0:14:17.760,0:14:19.920
The policy requires that agencies
0:14:20.720,0:14:26.800
know what AI systems are being used, who's accountable, what risks have been assessed and what decisions have been made.
0:14:27.440,0:14:41.760
So obviously without reliable records of these things, agencies are not going to be able to demonstrate compliance with the policy and that also helps to support oversight activities and provide evidence of responsible AI use.
0:14:43.600,0:14:46.560
The policy introduces clear
0:14:47.040,0:14:48.400
ownership requirements.
0:14:48.640,0:14:53.280
So every AI use case must have a clearly documented accountable owner.
0:14:53.680,0:14:58.800
So the accountable owner is the person that's responsible for the AI use case and its outcomes.
0:14:59.600,0:15:05.840
And every AI use case registered in the platform must have an assigned accountable owner.
0:15:06.400,0:15:14.640
So this makes sure that there's a clear record of who's responsible for decisions, risk management activities and ongoing oversight throughout the AI system lifecycle.
0:15:15.840,0:15:19.520
And it's really the role of the assurance function within an agency.
0:15:20.320,0:15:24.000
They're responsible for making sure that the assessments are accurate and complete.
0:15:24.560,0:15:30.320
Ownership's clearly assigned and that recordkeeping requirements are being met across the AI system life cycle.
0:15:31.360,0:15:36.320
And as I previously mentioned, a key requirement is to maintain accurate and complete records.
0:15:36.560,0:15:45.280
So that's from concept and design of an AI system through to procurement, deployment and operation to review and retirement of a system.
0:15:46.960,0:15:55.520
So the platform really supports this by providing a central place to register your AI use cases and document assessments, ownership and risks.
0:15:56.000,0:16:04.560
And by creating that consistent, reliable record, it makes it easier for agencies to demonstrate transparency, accountability and compliance.
0:16:05.040,0:16:12.320
And finally, all of that matters because the policy introduces compliance and attestation requirements.
0:16:12.560,0:16:20.560
So on an annual basis, agency leaders must be able to demonstrate that their organisation is meeting the policy requirements.
0:16:21.040,0:16:25.120
And all of that can only be achieved if reliable records exist.
0:16:26.720,0:16:31.200
So ultimately, recordkeeping is not an admin requirement in the policy.
0:16:31.200,0:16:42.640
It's really a foundation that enables agencies to govern AI responsibly to demonstrate accountability and maintain trust in AI enabled decision making.
0:16:44.480,0:16:46.320
So that's
0:16:46.640,0:16:50.720
bit of a summary of how recordkeeping and governance is addressed in the policy.
0:16:51.280,0:16:59.360
But I'm going to hand over now to Dan who's going to talk a little bit more about the platform and the role of subject matter experts in the assessment process.
0:17:01.880,0:17:02.380
Thanks.
0:17:02.480,0:17:03.040
Thanks Nat.
0:17:03.440,0:17:04.400
Good morning everyone.
0:17:05.040,0:17:14.640
So yeah, I'll briefly introduce the new AIF platform and explain how it connects with those agency recordkeeping and record management responsibilities.
0:17:15.600,0:17:24.000
So the assessment framework is a self-assessment that helps agencies identify and manage risks throughout the life cycle of an AI system.
0:17:24.720,0:17:31.280
Project teams describe their AI use case and answer questions about its context and expected impacts.
0:17:31.760,0:17:38.960
The assessment uses those responses to identify risk and surface any applicable regulatory or governance requirements.
0:17:39.360,0:17:42.880
It does not require agencies to submit supporting evidence.
0:17:44.000,0:17:47.840
The assessment should be kept current throughout the system life cycle.
0:17:48.080,0:18:01.200
Any material change such as a new purpose, model retraining, different data or how it's deployed or how human oversight is managed should prompt a reassessment.
0:18:02.160,0:18:14.160
So the new platform will provide an authoritative current view of an assessment and it supports that ongoing governance rather than being a one-off form that you complete before you deploy the AI.
0:18:14.800,0:18:15.840
Next slide please, Nat.
0:18:20.880,0:18:21.380
Thank you.
0:18:22.080,0:18:34.080
So the assessment framework remains a self-assessment and it's completed by a project team and the responsible owner where specialist input would help that subject matter experts have an advisory role only.
0:18:34.640,0:18:46.000
SMEs help the project team to understand the risks within their area of expertise and interpret any relevant regulatory or governance requirements that have been surfaced by the assessment.
0:18:46.560,0:18:52.160
They might provide advice on appropriate controls, treatments or other actions that should be considered.
0:18:52.560,0:19:01.520
SME involvement is not an approval of that use case or of the assessment itself and does not transfer any ownership of the risk to those SMEs.
0:19:01.840,0:19:08.720
Their role is to provide that specialist advice so that the project team and the responsible owner can make an informed decision.
0:19:09.440,0:19:18.320
The project team and the responsible owners remain accountable for that assessment and the use case, any decisions made and any follow-up actions that are required.
0:19:18.560,0:19:19.680
Next slide, please, Nat.
0:19:26.640,0:19:33.440
The new Assessment Framework platform is the authoritative source for the current assessment of an active use case.
0:19:33.760,0:19:40.320
So it supports live governance process, including the assessment history and reassessment over time.
0:19:40.640,0:19:49.600
Importantly, the new platform does not replace the agency's record management system, nor does it impose any additional record management requirement.
0:19:50.720,0:19:55.440
The existing record management obligations, policies and processes continue to apply.
0:19:55.720,0:20:04.880
An agency should manage the assessment and related governance records in accordance with their established records management processes.
0:20:06.960,0:20:17.360
The platform complements those processes by providing a consistent and traceable view of how an AI use case has been assessed and governed throughout its life cycle.
0:20:17.920,0:20:18.800
Next slide, please, Nat.
0:20:22.480,0:20:24.880
So the platform is intended to evolve over time.
0:20:24.880,0:20:30.560
So at launch it has the risk assessment which provides that core self-assessment.
0:20:30.720,0:20:44.440
It has a deep dive module which helps users explore the risk areas that are relevant to their use case and a use case discovery tool that helps teams find similar initiatives and experiences across government.
0:20:45.280,0:20:48.560
Future releases will broaden the platform from that risk
0:20:49.040,0:20:53.760
assessment into a full enablement AI enablement framework.
0:20:54.640,0:20:57.280
So the newer modules that will come out sometime next year.
0:20:57.280,0:21:05.680
So we have our data readiness module that will help team consider whether the data they're using and pushing through the AI is suitable and well governed.
0:21:06.200,0:21:14.840
There's a value and benefits module which makes the intended outcomes and measures clearer and a role evolution module which will help
0:21:14.960,0:21:22.320
agencies consider changes to responsibility, decision authority, what skills and works need to be redesigned.
0:21:22.640,0:21:28.640
And then over time, other extension modules will be added as new capabilities and technologies emerge.
0:21:29.360,0:21:30.320
Next slide, please, Nat.
0:21:33.520,0:21:38.400
So the new platform goes live this year, September 30th.
0:21:39.120,0:21:51.680
From launch, agencies must register all AI use cases on the platform, and then the platform will determine whether a full assessment is required and where it is will guide users through that assessment process.
0:21:52.080,0:22:01.040
The registration provides a consistent entry point for AI governance and helps agencies maintain visibility of AI use across their organisation.
0:22:01.920,0:22:11.040
The key message is that the Assessment Framework platform is not intended to replace the existing agency governance or record management processes.
0:22:11.360,0:22:21.040
It just provides a consistent way to identify AI risk and applicable requirements and to bring the right expertise into that process.
0:22:21.680,0:22:23.360
Together, this will provide
0:22:23.840,0:22:33.840
Sorry, the platform maintains the current assessment where agencies remain responsible for their governance decisions, risk ownership and any records that are generated.
0:22:34.400,0:22:42.400
So together this provides a clear and traceable record of how an AI use case has been assessed, governed and managed throughout its life cycle.
0:22:43.760,0:22:45.040
So that's all for me today.
0:22:45.520,0:22:46.560
Thank you for your time.
0:22:46.840,0:22:50.160
If you have any questions, pop them in the chat and I'll respond as we go.
0:22:50.720,0:22:51.220
Thank you.
0:22:53.040,0:22:58.240
Thanks so much, Dan, and thank you to both of you for that presentation.
0:22:58.240,0:23:04.720
I'm conscious that the 30th of September is 8 days away, so I'm sure you've got more things to do with your time.
0:23:04.720,0:23:10.000
So we really appreciate the time that you've taken for us today.
0:23:10.080,0:23:11.680
Really appreciate it.
0:23:11.680,0:23:16.560
There have in fact been a few questions, so I might just go through those.
0:23:16.720,0:23:17.840
These are in the chat.
0:23:18.480,0:23:22.360
So first of all, there was a question around whether the AI courses are
0:23:22.360,0:23:24.240
available for local government agencies?
0:23:26.800,0:23:37.520
So I believe that at the moment they're just being rolled out to NSW government agencies, but we may be able to share some of the learning content with you.
0:23:37.520,0:23:49.520
I think it's probably best what I'll do is I'll put our team e-mail in the chat and if you want to reach out to us directly about that, I can get some further advice to let you know what would be available.
0:23:50.840,0:23:51.360
Great.
0:23:51.440,0:23:53.040
Thank you very much, Nat.
0:23:53.840,0:24:17.520
Christine has asked, which I think is sort of a question around sort of the sort of clusters and how they're functioning, is around in terms of communications about what happens when your head agency hasn't rolled sort of down comms and requirements to small agencies in respect of policy requirements and so on.
0:24:20.240,0:24:25.320
might be answered by also putting the team e-mail in the chat, but any other advice there?
0:24:26.240,0:24:30.800
Yeah, so that's really the role of the accountable official.
0:24:31.120,0:24:45.280
So our team is currently working with all the 11 departments to understand within their departmental arrangements which agencies will kind of come under their governance and assurance and which will be separate.
0:24:45.760,0:24:46.720
And so we'll
0:24:47.760,0:25:05.360
I guess go through a process of working that through with departments, but we also have a list and can identify those independent agencies that may not have previously, you know, been a part of their departmental arrangements.
0:25:05.360,0:25:14.720
And so over the coming months, we will reach out to have those targeted discussions around what's required under the policy.
0:25:16.240,0:25:24.120
Yeah.
So the first attestation period to NSW GovAI is not until the 31st of October next year.
0:25:24.120,0:25:31.040
So departments and agencies do have a 12 month period to transition to meeting the policy requirements.
0:25:31.760,0:25:39.360
So obviously that first step is to have the accountable official that is nominated by November and
0:25:39.760,0:25:52.000
as mentioned, we'll work with departments and independent agencies to understand who the most appropriate person is and to support policy implementation through that transitional period.
0:25:52.480,0:25:54.080
Yeah, okay, great.
0:25:55.520,0:26:02.480
We've had a combination of AI related and AI Framework questions and recordkeeping questions.
0:26:02.920,0:26:06.080
We'll just try and work our way through those in the next couple of minutes.
0:26:07.040,0:26:15.520
But particular thanks to both of you for your presentations this morning in terms of the direct relevance
0:26:16.480,0:26:23.040
of the platform and the policy framework to this audience as recordkeeping professionals.
0:26:23.480,0:26:33.320
It was really appreciated that you were able to target it in such a way, given the breadth of the field that we're all dealing with.
0:26:34.000,0:26:44.800
So David has asked whether prompts in CoPilot are classed as a record, and you'll see the response in there from us here at State Records.
0:26:44.800,0:26:45.680
Yes, they are.
0:26:45.920,0:26:55.440
but many of them can be disposed under the normal administrative practice guidelines that are articulated in the State Records regulation.
0:26:55.680,0:27:03.120
We'll be providing greater advice around these types of issues ourselves
0:27:03.760,0:27:05.280
in the coming months.
0:27:05.360,0:27:21.680
And so that also will answer Anita's question about retention classes for AI solutions and whether there will be separate retention classes or whether it's all just part of disposal action under GA28.
0:27:23.040,0:27:28.560
Again, we'll provide some advice and assistance around that, Anita.
0:27:31.440,0:27:37.200
And Dan, return to sort of coverage and so on, if you don't mind, just to reiterate that message.
0:27:37.920,0:27:43.040
Brendan's asked whether the platform and adopting the policy is mandated for state-owned corporations.
0:27:44.720,0:27:52.320
So under the circular and the policy scope, it's not mandatory for state-owned corporations.
0:27:52.920,0:27:54.160
Okay, wonderful.
0:27:55.280,0:27:56.560
And similarly,
0:27:58.560,0:28:04.640
is compliance required by the 30th of September by local government, just to reiterate that message.
0:28:05.040,0:28:10.560
Local government is also not included as a mandatory entity.
0:28:11.560,0:28:12.720
Great, thank you.
0:28:13.680,0:28:22.160
Angela's asked whether there's a mechanism for agencies to monitor assessments completed to ensure appropriate records have been captured by the agency.
0:28:22.800,0:28:27.480
I think that's possibly more a question for us rather than you.
0:28:28.800,0:28:35.600
The system does have like an agency administrator role that can see across all assessments.
0:28:36.000,0:28:40.400
So there's a mechanism there, but it's not specifically for that purpose.
0:28:41.040,0:28:41.540
Yeah.
0:28:42.000,0:28:42.400
Great.
0:28:42.400,0:28:43.200
Thank you.
0:28:45.520,0:28:48.880
And look, we are right on time.
0:28:50.080,0:28:56.160
But maybe if I could just turn to one of the couple of the last questions.
0:28:57.120,0:29:02.080
What about coverage of universities in terms of compliance requirements?
0:29:03.600,0:29:06.200
No, so it's just NSW government agency.
0:29:07.840,0:29:14.320
I know we've answered this question a number of times, but just to reiterate that for people in their different circumstances.
0:29:15.280,0:29:20.720
And Robert's asked about whether the AI register will become a publicly available record or not.
0:29:22.320,0:29:25.360
A part of it will likely become public.
0:29:25.360,0:29:33.200
So there will be a public view of what government is doing across with AI across the different portfolios.
0:29:33.720,0:29:36.040
We're just trying to land on what that looks like.
0:29:36.040,0:29:37.920
It hasn't been determined yet.
0:29:39.120,0:29:39.620
Great.
0:29:39.920,0:29:40.420
All right.
0:29:40.640,0:29:41.680
Thank you very much.
0:29:42.320,0:29:46.640
Look, we are right on time and have run out of time.
0:29:46.640,0:29:52.640
So I'm conscious that there's a number of other questions and comments in the chat.
0:29:53.360,0:29:56.720
We will field those offline in some way.
0:29:56.720,0:30:04.880
That might involve us, Nat and Dan, having more of a chat with you to provide a bit of guidance or indeed provide guidance ourselves.
0:30:05.760,0:30:12.400
But it really just remains for me now to thank you both again very much for your time this morning.
0:30:14.320,0:30:21.920
I know that many of our participants, if not all of our participants, will have really benefited from outlining those requirements.
0:30:22.640,0:30:26.640
and as well as those sorts of tools and the framework.
0:30:27.360,0:30:31.840
I think that you were going to put the team's e-mail in the chat.
0:30:32.560,0:30:36.960
If you could do that so that people can contact you, that would be fantastic.
0:30:37.520,0:30:38.240
No problems.
0:30:38.280,0:30:39.760
Thanks, Martyn, and thanks everyone.
0:30:40.240,0:30:41.040
Thank you.
Thanks very much.
0:30:41.520,0:30:42.400
All right, wonderful.
0:30:42.480,0:30:43.360
Thank you very much.
0:30:43.960,0:30:44.460
Bye.
0:30:45.600,0:30:50.400
All right, if we can stop the sharing of that screen.
0:30:50.880,0:30:59.600
And it's my great pleasure to introduce our next speaker, who is Emeritus Professor Rosalind Croucher.
0:31:00.320,0:31:02.160
Ros, of course, is well
0:31:03.120,0:31:08.080
known to this group, having presented to us previously.
0:31:08.080,0:31:20.880
But for those of you who have joined us for the first time, Rosalind is the Information Commissioner for NSW and also the Chief Executive Officer of the Information and Privacy Commission.
0:31:21.360,0:31:32.440
And I'm also delighted to let this group know that Rosalind has also very recently joined the State Records NSW Board in her role as Information Commissioner.
0:31:32.560,0:31:39.680
So a wonderful expertise to add to our retinue of skills around the State Records NSW Board.
0:31:40.480,0:31:55.200
We've asked Ros today to speak about the forthcoming Right to Know Week, which is next week, which has the theme of the role of access to information in addressing information disorder
0:31:56.000,0:32:00.560
and along the lines of upholding information integrity in the digital age.
0:32:00.880,0:32:05.280
So, Ros, I will hand over to you and a very warm welcome.
0:32:07.040,0:32:08.400
Thanks, thanks Martyn.
0:32:08.560,0:32:10.480
I'm delighted to be back.
0:32:11.240,0:32:14.560
Obviously, I didn't put you all off at the forum in March, so
0:32:15.520,0:32:17.120
Thanks for the return visit.
0:32:18.240,0:32:25.920
And thanks, Laura is going to drive the slides for me so I don't have a major catastrophe in the online environment.
0:32:25.920,0:32:28.880
I always find the online environment quite a challenge.
0:32:29.600,0:32:36.160
I was very much a classroom teacher in the university environment for the first chapters in my life.
0:32:36.160,0:32:42.400
So I find it somewhat discombobulating that I'm speaking into the ether, but I'm sure you'll put up with that.
0:32:44.240,0:33:08.920
Martyn, in thinking about what I could speak on today, and yes, we've got Right to Know Week next week, but I thought for today I would do a bit of a reverse engineering reflection, working back from some of the issues that arise through the external review function of the Information Commissioner and the administrative review function of NCAT.
0:33:08.920,0:33:12.080
And I'll finish with a bit of a wrap about next week.
0:33:13.280,0:33:18.880
So I'm going to start with some data and then move out to some of the reflections.
0:33:20.000,0:33:31.520
And I will speak about the Information Commissioner in the generic sense and not insert the first person pronouns, me and I, for the purpose of presenting this information.
0:33:31.600,0:33:36.800
Occasionally I'll use a we, but for the most part I'll be talking in that generic sense.
0:33:37.360,0:33:37.860
So
0:33:38.400,0:33:53.920
Looking at last year's report on the operation of the GIPA Act for 24-25, which is the Section 37 report as Information Commissioner, which gets tabled around April each year, the data is quite instructive.
0:33:54.880,0:34:06.720
So in that year, there were 400 external reviews finalised by the Information Commissioner and 148 by NCAT.
0:34:07.560,0:34:29.600
And using internal data, the number of external reviews received significantly increased in 2024-25 with 379 as compared with the 297 the year before, which represents a 28% increase in that year on year.
0:34:30.240,0:34:34.720
Administrative reviews by NCAT have remained pretty stable in that time.
0:34:36.560,0:34:49.600
But what I'm observing and what is a shared challenge, shall we say, is that the increase in the numbers of external reviews is continuing and somewhat exponentially.
0:34:50.800,0:34:56.400
So during 25-26, we received 668 applicants,
0:34:56.800,0:35:11.760
applications for external review, which from the previous year, which is already a 28% increase on the previous year, was a 76% increase from 24-25 to the recently concluded financial year.
0:35:12.320,0:35:19.600
So I was thinking about what's driving that exponential increase in numbers.
0:35:20.240,0:35:25.200
And here I think the answer may lie to some extent
0:35:25.760,0:35:35.120
in the use of generative AI tools to frame and make GIPA applications and complaints about agencies in handling them.
0:35:35.920,0:35:44.400
Now, I mean, it was really interesting to see that presentation on AI and essentially lawful AI use in government.
0:35:44.800,0:35:50.720
So AI tools can be a real boon in certain aspects of the information landscape.
0:35:51.600,0:35:54.160
But when it comes to framing complaints,
0:35:55.600,0:36:04.160
by members of the general public, AI can significantly muddy the waters of expectations without any nuance.
0:36:04.720,0:36:15.680
For example, pointing to offence provisions without any real understanding of the elements required, presenting conclusions without evidence.
0:36:16.480,0:36:21.360
AI in that context can add fuel to a fire of disquiet.
0:36:22.720,0:36:24.400
And I note in,
0:36:25.440,0:36:45.040
in this respect, an article that I found in the conversation written by doctoral students in information scientists about an AI system being unable to distinguish between a blueberry muffin and a chihuahua and between sheepdogs and mops.
0:36:45.600,0:36:49.520
Now, it's a somewhat silly and flippant example, but
0:36:50.160,0:36:59.840
it shows that sort of unnuanced understanding that if you apply that to the language of a statute like the GIPA Act.
0:37:00.480,0:37:06.320
The blueberry muffin in this instance may well be an offence provision, not a Chihuahua.
0:37:07.280,0:37:27.960
Sorry, that is muddling my metaphors seriously, but I think the point is made, and particularly for members of the public who have this evidence produced by AI that an offence is being done, that there is a real problem here.
0:37:28.760,0:37:38.400
And such increases have an impact on the IPC as a small agency and other agencies and record managers alike.
0:37:39.600,0:37:49.120
And from the IPC perspective, as a very small agency, the flood coming in the door, so to speak, is an ongoing challenge.
0:37:49.120,0:37:53.680
I've referred to that 76% increase just in one year.
0:37:54.600,0:38:08.880
And as an agency, we and I as CEO, so I put the first person in there, we have to manage the increasing inbox of matters, but we also have to chip away at the backlog.
0:38:10.160,0:38:16.720
We manage it on the basis of attending to matters in the order received on the basis of fairness to all.
0:38:17.760,0:38:22.880
But timeliness is a key concern for external stakeholders.
0:38:24.480,0:38:29.120
This is an area which takes considerable expectation management.
0:38:29.920,0:38:41.440
Under the GIPA Act for an external review by the Information Commissioner, so that's in our bailiwick, there is a time frame of 40 working days for the review period.
0:38:42.000,0:38:44.480
But, and this is a big but,
0:38:45.120,0:38:55.520
That deadline in section 92A does not start to run until after we have received all the information considered necessary to complete the review.
0:38:56.000,0:39:00.560
So this is a choke point for us and creates the backlog.
0:39:01.440,0:39:12.960
At the moment, I have to confess, it can take four to six months to allocate a matter to a case officer after preliminary inquiries
0:39:13.520,0:39:25.040
and then the 40 days won't start to run until the officer has all the information needed to conduct the review both from the applicant and from the agency.
0:39:26.880,0:39:39.040
We have improved our website messaging and in the correspondence to applicants but we still have a way to go when it comes to people understanding that 40 days
0:39:39.600,0:39:45.120
Thanks, Laura, that 40 days is not necessarily what they think it is.
0:39:47.440,0:39:54.560
Being able to respond to people in a timely way is hardwired into the GIPA Act with the inclusion of time frames.
0:39:55.200,0:40:02.640
But there is nuance, as is clear, as to when the time starts to run for information commissioner reviews.
0:40:03.400,0:40:08.080
And we as the IPC, we're not alone in having to grapple with these challenges.
0:40:08.720,0:40:12.080
I'm all for people exercising their rights.
0:40:12.640,0:40:18.240
Agencies like the IPC, however, have to manage that exercise.
0:40:19.720,0:40:33.200
And workload and burnout are also key concerns among staff, our staff and as reflected across the public sector through the annual People Matter Employee Surveys, the PMESs.
0:40:34.080,0:40:34.580
However,
0:40:34.960,0:40:49.840
If the additional staff we have brought on only enable us to keep up with the new higher caseload normal, then further staffing, both permanent and additional surge staff will need to be considered.
0:40:51.440,0:40:54.160
Well, what was the result of these reviews?
0:40:54.200,0:40:55.840
Let's have a look at some of them.
0:40:56.720,0:40:59.440
Internal reviews by the agencies
0:40:59.680,0:41:07.120
this is your side of it, were equally balanced between upholding and overturning the original decisions.
0:41:08.200,0:41:28.320
When it comes to the external reviews by the Information Commissioner, 40%, so that's our reviews in the IPC, 40% recommended that agencies reconsider their decisions under our section 93 jurisdiction, which was similar to the previous year,
0:41:29.080,0:41:30.160
And what happened then?
0:41:32.080,0:41:38.480
35% of the agency reconsiderations of their original decisions landed in the same place.
0:41:38.960,0:41:50.680
That is, they arrived at the same decision as the original decision, which was a moderate decrease from the previous year, which was at 42%.
0:41:50.720,0:41:54.440
When it comes to the Information Commissioner jurisdiction here,
0:41:55.280,0:41:59.920
we do not have a power of determination to remake a decision.
0:42:00.160,0:42:07.040
So some of our fellow information commissioners and indeed federally has a power of determination.
0:42:07.040,0:42:07.760
We don't.
0:42:08.560,0:42:21.520
In New South Wales, only NCAT can do that on an external administrative review and make a decision as to what should be the correct and preferable decision on a GIPA application.
0:42:22.240,0:42:38.160
So when we recommend, the Information Commissioner, that the agency reconsider its decision, we're not necessarily saying that the decision was wrong, but the agency has not sufficiently justified the reasons for its decision.
0:42:38.960,0:42:42.560
So that's the point, that's the issue I want to explore today.
0:42:43.840,0:42:51.920
Namely the justification of the decision by the agency and in the context of today's audience,
0:42:52.320,0:43:01.040
I thought I could focus on responses to GIPA applications that records do not exist or are not held.
0:43:01.680,0:43:06.720
The relevant provision being section 58 1B of our lovely GIPA Act.
0:43:07.840,0:43:11.360
Well, here, this do not exist / are not held.
0:43:12.000,0:43:14.720
I have observed certain
0:43:14.920,0:43:20.880
suspicions among members of the public that may arise in relation to such responses.
0:43:22.280,0:43:38.000
An underlying conviction that records must exist or have been destroyed or hidden with perhaps malevolent intent to the applicant or to hide the issue.
0:43:38.960,0:43:44.640
Indeed, even urging and stating as a fact
0:43:45.200,0:44:03.280
that the agency is guilty of an offence under section 120 of concealing or destroying government information, or that some senior person has sought to improperly influence the decision on the access application under section 118.
0:44:05.040,0:44:14.400
As I observed before, AI may be driving this as well, leaping to an unnuanced conclusion that offences have been committed.
0:44:16.960,0:44:29.760
Looking at internal data on this topic in the context of external reviews by the Information Commissioner, the picture we get over the last five years is this.
0:44:31.200,0:44:34.200
We can see in the,
0:44:35.760,0:44:40.880
so it's a third column, number of reviews where information not held searches was an issue.
0:44:41.200,0:44:44.720
You can see the numbers where this was raised.
0:44:44.720,0:45:00.560
So for instance, last year, the 24-25 year, of those 400 that we finalised, 29% of those involved this information not held searches was an issue.
0:45:00.720,0:45:02.800
So these are the issues that
0:45:03.920,0:45:07.520
external review applicants are raising with us.
0:45:08.240,0:45:23.080
And this year, the 19% figure for 25-26 is likely to be understated as we're still processing review requests from that year.
0:45:24.320,0:45:30.960
So the figure is probably pretty stable overall at around 30% year on year.
0:45:31.760,0:45:38.880
where the issue was the adequacy of searches in the context of an agency decision that information was not held.
0:45:41.280,0:45:53.440
When an applicant raises that issue with us, what they're concerned about usually is about the quality and extent of searches undertaken by the agency.
0:45:55.120,0:46:00.880
We keep an eye on information like this through our compliance committee
0:46:01.360,0:46:03.760
and the analysis of data trends.
0:46:04.480,0:46:19.600
We only have data for the current year for a short period, but already it is 4th on the list of top 10 issues that were raised, while for the previous year it was the commonest issue raised.
0:46:23.120,0:46:28.080
A decision by an agency that information is not held
0:46:28.640,0:46:33.280
is a conclusion based on trying to find it in response to the GIPA request.
0:46:33.920,0:46:42.800
This in turn takes us to the issue of searching and the obligations under the GIPA Act in relation to searches.
0:46:45.120,0:46:55.200
One of the key issues that we look at is how can we improve decisions made by agencies and reduce the need for an external review.
0:46:56.480,0:47:03.280
This is where your roles as records managers or right to information officers come in.
0:47:04.080,0:47:14.560
And an issue I'd like to explore a little now, namely the justification of the decision by an agency when records are not held.
0:47:15.120,0:47:22.720
And in the context of today's audience, I thought I could focus on responses that records do not exist or are not held.
0:47:24.480,0:47:26.960
Which takes us to the reasonable searches point.
0:47:28.640,0:47:51.440
For those of you who attended my presentation in March, I referred to my long-term project of refreshing all of the information access resources, that pile of Lego blocks that I used in a graphic, not just updating them, but re-voicing them and restructuring them in accordance with current best practice communications.
0:47:52.480,0:48:03.360
One key shift in the voicing is the fact sheet when it comes to agencies will speak to you, not agencies must, but you must.
0:48:04.400,0:48:13.280
One of these I've recently been working on concerns the topic of reasonable searches, particularly the obligations under section 53.
0:48:13.680,0:48:17.360
This will be familiar territory to you all, I'm sure.
0:48:18.480,0:48:22.080
Certainly for those who have GIPA right to information functions,
0:48:22.640,0:48:24.640
as part of your job descriptions.
0:48:26.800,0:48:40.080
Once the applicant has given you a GIPA application you can work with, including such information as is reasonably necessary to enable you to identify the government information applied for,
0:48:40.880,0:48:57.280
you are then required to undertake, I quote, such reasonable searches as may be necessary to locate the information held by your agency and to determine whether or not the information is held at the time the application is received.
0:48:59.920,0:49:10.480
Because the GIPA Act definition of government information is very wide, which is information contained in a record held by an agency,
0:49:11.120,0:49:17.600
your searches will need to be broadly conducted across both paper-based and electronic records.
0:49:19.520,0:49:26.560
If you conclude that the information sort is not held, you need to demonstrate that you have searched properly.
0:49:27.280,0:49:39.520
And this information, this is the kind of reverse engineering problem, this information about proper searches will be crucially important if the applicant,
0:49:40.040,0:49:53.840
unhappy, seeks external review by the Information Commissioner or administrative review by NCAT of your agency's decision because the onus is on the agency to explain the decision.
0:49:54.640,0:50:05.840
We added this particular emphasis in the updated fact sheet we're working on to bring home the consequences of what if I don't at this early point.
0:50:08.240,0:50:10.240
So what is a reasonable search?
0:50:12.480,0:50:18.080
Section 53 sets out your obligations in relation to searching.
0:50:18.880,0:50:22.640
It talks about what you must do and what you don't have to do.
0:50:24.800,0:50:37.200
You must use the most efficient means reasonably available and any resources reasonably available to facilitate the retrieval of information stored electronically.
0:50:37.880,0:50:43.840
On this point, this is where I see the potential of well-crafted AI search tools coming into their own.
0:50:44.400,0:51:05.360
And indeed, the earlier presentation by NSW GovAI, I made sure I wrote that down, will be helpful, I think, both to identify the appropriate tools and to have the relevant quality assurance framework around them.
0:51:07.120,0:51:29.360
What you don't have to do is search for information after the date of the application or in electronic backup systems unless, and this is the link to the State Records Act, unless they were destroyed or lost improperly or in contravention of the State Records Act or indeed established records management procedures.
0:51:32.160,0:51:44.960
You, of course, are generally in the best position to assess whether the information requested exists and is held by your agency because you are familiar with your agency's own records management systems.
0:51:46.240,0:51:56.000
As noted by the NCAT appeal panel in a decision in 2020 which has set key benchmarks in the searching domain.
0:51:56.240,0:52:01.600
It's the decision in Wojciechowska and Commissioner of Police.
0:52:02.560,0:52:14.960
It may be pronounced in various ways, but having had a Polish colleague at Sydney Law School many, many years ago, I believe Wojciechowska is the correct pronunciation.
0:52:16.720,0:52:32.400
The appeal panel in that matter also observed this issue about reasonable searches and said the question of whether there are reasonable grounds to believe that the information, the subject of the access application exists
0:52:32.720,0:52:34.560
and is helped by an agency.
0:52:34.880,0:52:47.120
So it's the question of whether there are reasonable grounds to believe is plainly relevant to the nature and extent of the searches required to be undertaken to discharge the obligation under Section 53.
0:52:47.440,0:52:52.480
And they gave this example where, for example, the agent
0:52:53.320,0:53:05.360
where, for example, the likelihood of the requested information existing and being held by the agency is far-fetched or fanciful, and they give this example.
0:53:05.920,0:53:15.680
New South Wales Health holding information about US President Donald Trump's Twitter account or evidence of alien life in Wagga Wagga,
0:53:16.920,0:53:27.920
Arguably, no search could properly be characterised as being a reasonable search as may be necessary to find any of the government information applied for, and no obligation to search arises.
0:53:28.000,0:53:30.960
As I said, it was a little bit far-fetched, but it was amusing.
0:53:32.240,0:53:38.400
Conversely, where it is reasonably likely that the requested information exists and is held,
0:53:38.880,0:53:48.240
a cursory search said to be unable to find the requested information is unlikely to satisfy the obligation imposed.
0:53:48.240,0:53:54.720
So cursory search is out in relation to being able to justify that decision.
0:53:56.720,0:54:05.440
Obviously, digital archives becomes an issue increasingly and agency recordkeeping systems
0:54:05.760,0:54:14.560
should not adversely affect applicants and electronic recordkeeping should promote ease of access to those records.
0:54:15.120,0:54:20.880
The shift in search tools over the past decade or so should have improved searchability.
0:54:22.640,0:54:38.000
When it comes to the issues we see, the IPC, from dissatisfied GIPA applications, it usually concerns the search terms used as being insufficiently broad and the places searched.
0:54:38.240,0:54:44.320
Indeed, some of that was played out in the Wojciechowska decision that I just mentioned.
0:54:45.440,0:55:04.400
For example, did the searches include records management systems like EDRMS and TRIM, which we use, CRMs, we use Resolve, as do a number of other agencies, collaborative tools like SharePoint and Teams, emails, WhatsApp and similar group messaging.
0:55:04.880,0:55:11.920
The landscape is increasingly complex, but they're all records possibly within the purview of such searches.
0:55:14.000,0:55:37.440
When it comes to your notice of decision, tips to avoid a disgruntled GIPA applicant in circumstances in which information is not held would be to provide as much detailed information as possible about searches for records that were conducted and to give careful consideration of what those searches should be in each case.
0:55:38.960,0:55:49.920
And the key point is this, if applicants are satisfied that fulsome searches have been conducted, they are more likely to accept the outcome.
0:55:50.400,0:56:06.800
Having said that, and as an aside, we all know and have experienced certain applicants that no matter how much you explain, will never shift in their underlying beliefs about what's going on.
0:56:09.120,0:56:24.560
As I'm sure you appreciate, your agency should explain clearly the search processes you conducted and what information was located in response, as well as an explanation if no records were located.
0:56:24.880,0:56:32.240
So best practice for your notice of decision is to include these sorts of things.
0:56:33.480,0:56:37.600
an explanation of what you understand the applicant's request to be.
0:56:37.840,0:56:41.760
And some of this, of course, you can nuance in conversations initially.
0:56:42.880,0:56:49.200
How your agency's recordkeeping system is organised, how information is retrieved.
0:56:50.160,0:57:02.320
Then if the information is electronic, the search terms used to identify information relevant to the request and if the system is paper-based,
0:57:02.800,0:57:15.280
how the information is stored and how you were able to ascertain what information was relevant to the applicant's request and the steps you took to retrieve any documents that are subject to it.
0:57:16.400,0:57:26.080
So details of searches may include where and how you searched, a list of any records, the keywords and a description of the paper records used.
0:57:27.080,0:57:31.440
Now connecting the dots between proper record management
0:57:31.840,0:57:35.440
including lawful record destruction and the GIPA response.
0:57:36.880,0:57:43.680
I wondered how closely do your record managers work with your right to information officers?
0:57:45.040,0:57:58.880
Behind a notice of decision in relation to a GIPA request that information is not held may lie a perfectly sensible and lawful process of sentencing of records or destruction of records
0:57:59.200,0:58:02.640
as normal administrative practice under the State Records Act.
0:58:03.920,0:58:19.120
Many people believe ardently that government information must be held forever and that to destroy government records must somehow be wrong, particularly if it's the very kind of information an applicant may be seeking.
0:58:19.840,0:58:23.840
So how regularly do you, as an RTI officer,
0:58:24.400,0:58:33.680
indicate that a record was held but is no longer because of lawful record destruction and for which you have a record of its destruction.
0:58:35.200,0:58:49.040
If this is the case, and you can say that in your notice of decision in support of a conclusion that information is not held, this could potentially head off or at least act to counteract suspicions.
0:58:49.600,0:58:52.720
I say that with a little caution given my
0:58:53.240,0:58:57.040
observation just a minute ago that some people will never be convinced.
0:58:57.520,0:59:07.280
However, at the very least, it would provide a really solid answer on administrative review in NCAT if it comes to that.
0:59:07.680,0:59:14.000
And all of you in the room who've been involved in those administrative review processes
0:59:14.400,0:59:22.640
know how hard, how much, and with the onus on you, how much work goes into that?
0:59:22.800,0:59:28.800
How much better would it be that all of it is considered at that early stage?
0:59:28.800,0:59:32.080
So that joining of the dots in functions.
0:59:33.520,0:59:43.840
And I say that with the deepest respect to all of you because I have never, I have not held either a records manager function or an RTI officer function.
0:59:43.840,0:59:48.560
So my virtual hat tips to all of you who do have those functions.
0:59:49.920,1:00:00.080
So coming to that review point, this is the dissatisfied applicant who is not happy with the decision that information is not held.
1:00:01.120,1:00:11.000
They can seek an internal review through your agency and they can also seek external review by the Information Commissioner and NCAT.
1:00:11.120,1:00:16.440
Sometimes they even they skip the Information Commissioner part and go directly to NCAT.
1:00:17.840,1:00:24.000
However, as I explained before, we're still getting a lot of them, 668 last year.
1:00:25.600,1:00:26.640
So when,
1:00:27.040,1:00:40.880
we, the IPC Information Commissioner, when we're conducting an external review, what we look at is whether and how you have shown that you've taken reasonable steps.
1:00:41.360,1:00:51.920
We'll look at things like the terms of the access application to see whether there may be further information with a scope, and we might recommend search terms to be used.
1:00:53.280,1:00:55.920
When it comes to NCAT proceedings,
1:00:57.520,1:01:17.280
in an administrative review of proceedings in NCAT, there was the Wojciechowska decision that I've mentioned set out a five-step process that I'm sure is familiar territory to you now, that what NCAT will do in reviewing a decision.
1:01:17.640,1:01:24.440
What's important about that five-step process is that at the time, so this was back in 2020,
1:01:25.440,1:01:43.600
There was a previous line of decisions which had put a practical onus, that was the language used, on the applicant to show reasonable grounds for the information existing and then a shifting onus to the agency.
1:01:43.600,1:01:49.600
But what this decision made quite clear was that the burden, the statutory burden
1:01:50.080,1:02:00.640
of inducing evidence, the burden lies on the government agency, so that's all of you in the room, to establish that its decision, that information is not held is justified.
1:02:00.640,1:02:04.160
So that five-step process, familiar, I imagine.
1:02:04.560,1:02:10.960
So coming to final thoughts, this is my quick wrap up, Martyn, and then I'll be able to hand back to you.
1:02:12.400,1:02:18.880
Records managers and right to information officers play a crucial role
1:02:19.120,1:02:20.880
in our system of open government.
1:02:22.560,1:02:32.080
The IPC and me as Information Commissioner have our own role to play with distinct statutory responsibilities.
1:02:33.440,1:02:42.880
As I observed at the conclusion of my presentation in March, I look forward to your thoughts, guidance and insights
1:02:43.440,1:02:57.840
in helping to make our work more effective, yours as record managers and me as the regulator, in meeting the aspirations set out as the objects and expectations of the GIPA Act.
1:02:59.120,1:03:05.840
And next week is Right to Know Week, an important event in the calendar for all of us.
1:03:06.480,1:03:13.040
If you haven't signed up already, there is an excellent panel event at Parliament House on Tuesday morning.
1:03:13.600,1:03:23.920
The theme of the week is Upholding Information Integrity in the Digital Age: The Role of Access to Information in Addressing Information Disorder..
1:03:25.360,1:03:28.960
I will be chairing a panel comprising Dr.
1:03:28.960,1:03:39.280
Lorraine Finlay, the Human Rights Commissioner, who will also give a short keynote, and Kate Boyd, PSM, the fabulous Secretary of the Cabinet Office,
1:03:39.840,1:03:46.000
and Associate Professor Ellen Rock of the Faculty of Law and Justice at UNSW.
1:03:46.320,1:03:48.080
Come one, come all.
1:03:48.480,1:03:53.440
Public sector staff can attend in person or online.
1:03:53.840,1:04:04.120
The recording will also be made available to the general public after the event, but it's only those in person, sadly, who get the fabulous scones that Parliament House can offer.
1:04:04.720,1:04:09.680
So thank you very much, Martyn, for inviting me back this morning and
1:04:09.840,1:04:16.960
providing a little angle of insight into one aspect of the work of the Information and Privacy Commission.
1:04:17.360,1:04:28.640
And me, I will use me now as the Information Commissioner with a terrific team of staff doing our best against that increasing challenge of a flood coming in the door.
1:04:30.080,1:04:30.960
Thank you, everyone.
1:04:30.960,1:04:33.360
And Martyn, may I hand over to you?
1:04:33.840,1:04:37.520
Thank you very much, Ros, and thank you for that wonderful presentation.
1:04:37.520,1:04:42.640
I think that has absolutely articulated, certainly
1:04:43.200,1:05:04.560
my feeling in terms of the inquiries, complaints and other correspondence that we get both in my role at State Records NSW but also at Museums of History NSW about the impact of today's society and that includes today's society's tools such as AI is having on
1:05:06.400,1:05:14.840
shall we say correspondence submissions and applications by stakeholders and members of the public to us as government agencies and government
1:05:15.080,1:05:22.560
entities and that was a wonderful representation of those emerging issues.
1:05:24.160,1:05:44.480
I was particularly thrilled to see the reinforcement of the messages that we try to make at State Records NSW that when agencies are dealing with GIPA applications in their responses that an information not held response without going into further detail
1:05:44.960,1:05:50.240
really does just create an enormous amount of work for everyone.
1:05:50.960,1:05:59.120
And that includes us at State Records when we often subsequently have to deal with complaints around those sorts of responses.
1:05:59.120,1:06:09.440
So I think that sort of comment is but a sign of the increasingly close working relationship that our two agencies have.
1:06:09.440,1:06:13.760
So thank you so much for your time today.
1:06:16.480,1:06:21.680
All right, let's move on to our next presentation this morning.
1:06:21.920,1:06:29.680
And this is by Nerida Lithgow, who is the manager of records governance at the University of Newcastle.
1:06:30.240,1:06:38.640
And Nerida is going to speak about the university's Microsoft 365 Tactical Data Remediation Project.
1:06:38.640,1:06:43.120
So Nerida, over to you and thank you again very much for your time.
1:06:44.040,1:06:44.540
Morning.
1:06:45.840,1:06:46.880
Thank you, Martyn.
1:06:46.880,1:06:47.760
Thanks, colleagues.
1:06:47.760,1:06:50.720
I'm just going to take a moment to get myself operating.
1:06:57.700,1:07:08.340
So now I will go here and keep my fingers crossed.
1:07:13.680,1:07:16.400
So you should be able to see my slide deck now, Martyn.
1:07:16.480,1:07:17.280
We can indeed.
1:07:17.280,1:07:18.000
So thank you.
1:07:18.200,1:07:18.720
Fabulous.
1:07:18.720,1:07:19.280
Thank you.
1:07:19.760,1:07:20.960
So good morning, everyone.
1:07:20.960,1:07:25.440
My name is Nerida Lithgow and I'm the Senior Manager of Records at the University of Newcastle.
1:07:25.920,1:07:31.040
Today I wanted to share a project that the records team and I have been working on for over 2 years.
1:07:31.360,1:07:39.680
It represents a genuinely different approach to how we think about managing legacy records at scale in the Microsoft 365 environment.
1:07:41.040,1:07:44.000
The challenge we faced in 2024 was straightforward.
1:07:44.000,1:07:55.760
We had 65,000 ex-staff accounts sitting in our M365 estate containing nearly 5 million e-mail records and 216 terabytes of OneDrive data.
1:07:56.400,1:08:05.040
That's a lot of legacy content, but rather than the traditional question of what is the most sensitive and high value records we need to protect, we inverted it.
1:08:05.720,1:08:09.520
And we asked, where's our redundant, obsolete and trivial records?
1:08:09.520,1:08:13.760
That's the low value, low risk content that we're needlessly holding on to.
1:08:14.200,1:08:15.800
And what is it costing us to keep?
1:08:16.400,1:08:19.760
That inversion is the heart of what I want to talk through today.
1:08:21.680,1:08:24.320
Let me start with the risk position we were facing.
1:08:24.400,1:08:33.200
Legacy content sitting in individual OneDrive accounts and Outlook mailboxes was creating a compliance and cyber risk that we couldn't possibly quantify.
1:08:33.760,1:08:37.760
Potentially we had sensitive data that was inappropriately protected.
1:08:38.040,1:08:47.520
We had personal information that could be targeted by cyber criminals and we had a backlog of M365 artefacts growing at approximately 30% every year.
1:08:48.160,1:08:51.360
This meant our over-retention problem was getting worse, not better.
1:08:52.320,1:08:55.280
that over-retention was driving 2 material costs.
1:08:55.440,1:09:03.840
First, increasing expenditure on storage and licensing, and second, and more urgently, increasing cyber and privacy breach potential.
1:09:04.480,1:09:11.120
Every unmanaged account and stale mailbox item is an attack surface with no offsetting business value.
1:09:11.920,1:09:16.480
So rather than chase the high value, high risk records first, we asked a different question.
1:09:17.320,1:09:25.840
What's the low value, low risk content we can defensively destroy because reducing the haystack is often the fastest way to reduce the risk.
1:09:26.640,1:09:36.480
To address this, we worked through 4 phases and we applied records management principles and automation tools to identify ex-staff for destruction within a risk paradigm.
1:09:37.360,1:09:44.480
With executive support, we have implemented a defensible and repeatable destruction process for managing unstructured data
1:09:44.880,1:09:48.880
and securing high value records for long term retention.
1:09:49.760,1:09:56.880
We updated our policies and practices for M365 recordkeeping and on and off boarding processes.
1:09:57.200,1:10:02.080
And that's the structure of the talk and we'll dig into more details over the next 20 minutes or so.
1:10:04.560,1:10:10.080
The project was initiated after a major cyber incident at another university in New South Wales.
1:10:10.400,1:10:12.880
The phone calls and emails after the news hit
1:10:14.160,1:10:18.640
provided us with an opportunity to lean in and collaborate across our silos.
1:10:19.280,1:10:25.400
A report was prepared for the executive by the Chief Cyber Security Officer.
1:10:25.520,1:10:27.120
Its title says a lot.
1:10:27.440,1:10:33.360
Addressing the risk of data breaches due to over-retention of data in Microsoft Cloud applications.
1:10:34.240,1:10:45.920
The university's M365 challenge required genuine collaboration from the records team, IT, cybersecurity, risk, HR and privacy with strong backing from our leadership team.
1:10:46.800,1:10:53.120
In summary, we created the A-team where the records brought the appraisal methodology and defensible disposals.
1:10:53.440,1:10:58.880
We needed to be able to justify that every destruction decision was documented against a particular criteria.
1:10:59.520,1:11:02.720
The IT brought the M365 platform knowledge,
1:11:03.120,1:11:10.560
Excel spreadsheet, data manipulation skills, and managed the digital disposals through a managed disposal service.
1:11:11.360,1:11:17.680
The cybersecurity team understood the attack surface problem and the urgency of reducing unmanaged content.
1:11:18.640,1:11:23.600
The risk team bought a risk lens and a methodology that helped us navigate the massive data set.
1:11:24.080,1:11:32.160
And the leadership provided the governance authority and the executive sponsorship that made it safe to implement this strategy for a large-scale destruction.
1:11:33.720,1:11:41.680
Because this project centred on destruction rather than protection, leadership support carried the extra weight to give us confidence to proceed.
1:11:42.640,1:11:51.040
The scope was clear, legacy OneDrive accounts and mailboxes assessed against criteria based on data volumes and HR roles.
1:11:51.680,1:11:54.560
The deliverables we achieved were substantial.
1:11:54.960,1:11:55.840
We approved
1:11:58.160,1:12:01.520
over 22,000 ex-staff accounts for disposal.
1:12:01.800,1:12:13.440
We identified 16 terabytes of data for destruction and we achieved $60,000 annual savings in data residency costs, which is meaningful.
1:12:13.680,1:12:19.440
But honestly, for me personally too, it's the cyber risk reduction that was the bigger win in this.
1:12:20.400,1:12:25.760
To quote the feedback from my boss, "moving forward, we are looking forward to a more automated
1:12:26.400,1:12:34.160
life cycle management of accounts in conjunction with the M365 archiving solution that's currently in project scope.
1:12:34.640,1:12:40.000
I'd like to thank Nerida and her team working through what was the new approach for the university."
1:12:40.400,1:12:45.600
That endorsement tells you that the methodology landed well and the outcomes were well received.
1:12:47.600,1:12:51.920
So let me frame the methodology by naming the two risks we were trying to address.
1:12:52.240,1:13:00.640
First, we had a high risk of loss of Outlook and OneDrive artefacts as records of institutional activities, service delivery and decision making.
1:13:00.880,1:13:06.000
If we didn't act swiftly, those records could be lost in time and system churn.
1:13:06.720,1:13:19.440
The second was we had a high risk that over-retention of Outlook and OneDrive artefacts would continue to grow at 30% each year, increasing our expenditure, increasing our risk for cyber security and privacy breaches.
1:13:19.680,1:13:22.720
The problem was accelerating, not stabilising.
1:13:23.840,1:13:29.920
Due to these two risks and the volume of legacy records, it necessitated a macro appraisal approach.
1:13:30.400,1:13:43.120
We simply couldn't review every item individually and we needed to spend more effort on actively managing the highest priority records now and in the future while the low value, low risk content could be defensibly destroyed.
1:13:43.680,1:13:50.320
This means that every step, every disposal decision had to be traced back to a documented criteria and an audit trail.
1:13:50.720,1:13:55.840
This rigorous documentation has made destruction safe to do at scale.
1:13:57.200,1:14:03.440
So the strategy, we had five key elements in our strategy and they all centred on the inversion that I mentioned at the first.
1:14:04.080,1:14:15.840
Firstly, macro appraisal, a pragmatic approach for high value unstructured data to minimise the cost, minimise the loss of valuable records whilst reducing costs and cyber and privacy breach risks.
1:14:16.240,1:14:20.800
Instead of trying to protect everything, we focused on identifying what was safe to remove.
1:14:21.760,1:14:23.520
Second, finding our diamonds.
1:14:23.520,1:14:34.640
We focused on reducing scale and complexity by leveraging the US capstone methodology to protect Outlook emails and OneDrive's belonging to chancellors and vice chancellors.
1:14:35.040,1:14:48.800
And then we mapped the M365 account data with historic HR employment records, cross-referencing across account holders against their employment classification, separation dates and role history.
1:14:49.280,1:14:56.640
This allowed us to identify decision makers and creators of the university's high value records based on their employment classification.
1:14:57.600,1:15:07.600
If we could identify the accounts belonging to our leadership team, researchers and teachers, then we could better protect their records and identify accounts that were safer to remove.
1:15:08.240,1:15:14.800
The US capstone methodology is a system of managing e-mail by role.
1:15:15.520,1:15:19.600
permanently retaining senior official accounts while scheduling others for disposal.
1:15:20.640,1:15:22.400
Third, we took a tranche approach.
1:15:22.400,1:15:32.560
We broke down accounts into manageable batches based on low-risk and low-value criteria and high-risk records based on HR roles and volumes of data created.
1:15:33.040,1:15:35.920
This made the work repeatable and auditable.
1:15:36.560,1:15:47.920
In the reporting period, we created approximately 50 tranches for destruction and these were supplied to the IT team for disposal in five consolidated batches over a 12 month period.
1:15:48.800,1:15:52.000
The 4th piece was the risk management.
1:15:52.000,1:15:54.480
It was the ease versus complexity matrix.
1:15:54.480,1:16:01.120
This was fundamental to finding a place to start to identify low value, low risk records for quick wins.
1:16:01.520,1:16:07.840
So rather than scoring content up towards protect this, we scored content down towards safe to remove.
1:16:08.720,1:16:14.840
And the 5th was a repeatable process, ensuring the methodology could be repeated for future automation and system
1:16:14.960,1:16:41.120
enhancements. We wanted to do this job once and then to be able to scale. So before the records team got their data on that their hands on the data IT did some work for us and built some rules. The first two rules are retention based, is the person a former executive, delegation-holder, academic or research higher degree student where a 15 year notional retention
1:16:41.680,1:16:42.640
was still active?
1:16:42.960,1:16:50.720
Or are they professional staff, members of the controlled entity or other affiliates of the university where a two-year retention is still active?
1:16:51.040,1:16:54.080
If yes to either of these questions, then do not destroy.
1:16:54.080,1:16:55.840
So it carved out of the project.
1:16:56.400,1:17:06.080
The remaining rules catch edge cases, multiple occupancies where any role triggers a hold, shared OneDrive account still being accessed, ongoing mail,
1:17:06.480,1:17:12.400
forwarding and a final check that the account isn't still active in the Active Directory.
1:17:13.280,1:17:15.040
The key takeaway is this.
1:17:15.040,1:17:27.120
When we apply these rules to our 65,000 ex staff accounts, we were left with about 22,000 accounts, which became the record team's focus.
1:17:29.760,1:17:34.160
This slide shows the retention periods that notionally applied,
1:17:34.400,1:17:38.000
that notionally underpinned the record team's macro appraisal logic.
1:17:38.240,1:17:41.760
For senior professional staff, we allocated a 15-year retention.
1:17:41.760,1:17:44.000
For all others, it was notionally 2 years.
1:17:44.640,1:17:47.520
The macro appraisal logic was this.
1:17:47.520,1:18:01.120
Once the designated period had elapsed and there was no legal hold and no active business need, the account and its content became a possible candidate for disposal and consideration by the records team.
1:18:01.840,1:18:06.320
We weren't making individual judgment calls about whether each e-mail or file was valuable.
1:18:06.480,1:18:12.800
We were applying a relatively consistent documented rule that reflected the university's risk tolerance.
1:18:15.280,1:18:26.720
The process centred on the ease complexity risk matrix, which I'll walk through in the next couple of slides, but let me give you a sense of the operational flow across the records team's activities.
1:18:27.360,1:18:34.720
In the record team, we were focused on reducing volumes to reduce costs and risk by identifying low risk and low value records.
1:18:35.040,1:18:37.760
Importantly, this wasn't just about destruction.
1:18:38.000,1:18:41.840
The approach also surfaced high value records for active management.
1:18:42.400,1:18:49.120
The process included reconstruction of outlook drives when necessary and a validation step at each phase.
1:18:49.680,1:18:52.960
In practice, the process was hard slog for us all.
1:18:53.440,1:18:56.880
Indeed, we encountered friction, think system crashes,
1:18:57.280,1:19:07.600
sorting access to legacy accounts, discussion about criteria, the occasional disputed classification requiring complete rework, and there was always resourcing constraints.
1:19:08.240,1:19:13.440
At the end of the day, those frictions didn't undermine the methodology.
1:19:13.600,1:19:17.440
It gave us a reason to keep going and keep improving.
1:19:19.360,1:19:21.360
So this slide and the content
1:19:22.240,1:19:25.680
was provided by the university's audit and risk team.
1:19:25.880,1:19:36.400
And without my colleague from the risk team giving me the ease versus complexity matrix, it would have been very difficult to manage the complexity and scale of the data set we were looking at.
1:19:37.200,1:19:39.240
We were dealing with very large volumes of data.
1:19:39.240,1:19:42.640
As I mentioned, it was nearly 500 million e-mail records.
1:19:43.040,1:19:46.240
We simply can't give every item the same level of attention.
1:19:46.640,1:19:53.680
So rather than trying to review everything equally, the matrix gave us a structured way to determine where our efforts should go first.
1:19:54.480,1:19:59.520
The first step is risk scoring, assessing the information against defined criteria.
1:20:00.240,1:20:09.040
Under the guidance of our risk experts, we chose data consumption and staffing level as a consistent basis for comparing one account and content with another.
1:20:09.920,1:20:12.320
From there, we prioritised according to risk.
1:20:12.640,1:20:16.240
The intent is not to suggest that lower risk information has no importance.
1:20:16.440,1:20:23.360
It's about making sure our limited resources are directed first toward the area where exposure risk is greatest.
1:20:24.320,1:20:30.400
In our case, that meant identifying the accounts and content where the risk of over retention was highest.
1:20:32.080,1:20:35.760
But risk alone doesn't necessarily tell us what we should do first.
1:20:36.080,1:20:39.840
This is where the ease versus complexity assessment has come in.
1:20:40.480,1:20:51.040
It helps us in the very practical question, how difficult is it to actually determine what to do with the account member belonging to a particular ex staff member?
1:20:52.640,1:20:58.240
Is it a straightforward destruction or does it require investigation, escalation or further consultation?
1:20:58.800,1:21:00.880
That gives us the matrix shown here.
1:21:01.120,1:21:04.240
Some accounts represent relatively straightforward quick wins,
1:21:04.560,1:21:10.960
where we have sufficient confidence to take action without significant additional investigation.
1:21:11.200,1:21:20.400
For example, information that can clearly and defensibly be destroyed, thought low volumes created by an administrative assistant who last worked with us in 2010.
1:21:21.040,1:21:28.160
At the other end of the spectrum, we have high risk complex accounts that warrant much more detailed investigation before making a decision.
1:21:28.400,1:21:34.960
For example, high volumes of data created by an infrastructure project officer who last worked with us in 2016.
1:21:35.520,1:21:39.360
And there were naturally hundreds of variations in between these two extremes.
1:21:40.080,1:21:47.360
The important point about the matrix is that it supported us to look beyond the massive data set and the question, where do we start?
1:21:48.080,1:21:52.400
The matrix gave us a transparent and repeatable way of answering that question.
1:21:52.560,1:22:00.480
We could score the risk, prioritise the account and consider the complexity of taking action and then allocate effort accordingly.
1:22:01.040,1:22:09.760
Also, it means that even when we're dealing with a very large information holdings, we can demonstrate a rational basis for why one area was targeted before another.
1:22:10.640,1:22:14.720
So yes, we started with the easy low risk disposal opportunities first.
1:22:15.320,1:22:19.200
And then as we grew in confidence, we were able to tackle more complex accounts.
1:22:19.840,1:22:28.800
At the end of the project, there were about 178 accounts that we agreed we would hold pending investigation or the passage of time.
1:22:30.560,1:22:31.840
And this is what it looks like.
1:22:33.600,1:22:37.440
So at this point, it leads to a broader question.
1:22:37.440,1:22:44.480
Is prioritising records and information management in this way simply a compromise or does it represent good risk management?
1:22:45.200,1:22:46.560
I'd argue it's the latter.
1:22:47.360,1:22:52.800
In a large organisation, we're never going to have enough people to manually assess every record individually.
1:22:52.800,1:22:58.000
The real choice isn't between a risk-based review and a perfect exhaustive review.
1:22:58.560,1:23:05.440
It's between a structured approach and attempting to review everything, becoming overwhelmed and making very little progress.
1:23:06.080,1:23:12.000
This mature risk approach recognises that resources are finite and risks are not equal.
1:23:12.480,1:23:25.920
We established a defined criteria and used the best information reasonably available and tried to apply the methodology as consistently as possible and document everything so that another person can understand how we arrived at our decisions.
1:23:27.120,1:23:29.680
That gives us a level of defensible disposal.
1:23:29.920,1:23:34.000
We can show the criteria, the risk assessment and the rationale for every action.
1:23:35.680,1:23:36.800
So is it perfect?
1:23:37.040,1:23:37.540
No.
1:23:37.840,1:23:44.000
There will always be judgment in a risk score and criteria needs the periodic recalibration.
1:23:44.640,1:23:50.560
For the records team, we use the risk scoring not because it gives us a perfect answer.
1:23:50.800,1:24:00.400
We used it to find a logical and consistent way to bundle similar records together at scale and overcome the challenge that would otherwise be unmanageable.
1:24:03.600,1:24:11.600
So the outcomes of this project extend well beyond the 16 terabytes we destroyed and the $60,000 savings in annual costs.
1:24:11.840,1:24:16.560
We've developed 3 strategic shifts that will drive data minimisation going forward.
1:24:16.960,1:24:19.680
Firstly, a new policy and procedures.
1:24:19.680,1:24:23.440
We've updated our policy to reflect a contemporary recordkeeping practice.
1:24:23.840,1:24:28.720
With the support of HR, we've developed new processes for onboarding and offboarding staff.
1:24:29.280,1:24:44.720
We've renewed our focus on high value records, key roles and information owners so that when someone leaves the organisation, the records team can support leavers to have a deeper knowledge of which of their records need to be retained and what can be safely destroyed.
1:24:45.840,1:24:56.960
We're implementing pre-approvals for regular automated disposal of digital records so that future legacy content doesn't accumulate in the way it historically has done.
1:24:58.160,1:25:01.920
Second, embedding records and information management into system design.
1:25:02.240,1:25:12.000
We're encouraging a principle of recordkeeping by design for new systems and upgrades aligned to retention schedules with metadata and control disposal authorities.
1:25:12.400,1:25:17.040
We're seeking to engage in conversations early in procurement and system upgrades.
1:25:17.520,1:25:25.120
We're performing tactical data remediation annually and conducting a regular cycle of cleanup data campaigns across the organisation.
1:25:25.600,1:25:30.400
We're updating our processes to minimise data retention in the M365 products.
1:25:31.040,1:25:34.720
All of this activity is about preventing the problem from reoccurring.
1:25:36.080,1:25:38.320
And third, technology and automation.
1:25:38.400,1:25:45.520
We're leveraging Purview in recordkeeping templates in SharePoint for low value, low risk content to be managed in place.
1:25:46.480,1:25:52.880
Our EDRMS is our premium repository for high value and long term retentions.
1:25:53.360,1:26:00.560
We're exploring gen AI capability for classifications, retrieval and disposal at scale and across the organisation.
1:26:02.160,1:26:06.640
So storage cost reduction is real and we've quantified it through this process.
1:26:07.120,1:26:11.760
So we'll continue to reduce our legacy M365 data collection over time.
1:26:12.000,1:26:15.760
But for the university, the cyber risk reduction is the bigger win.
1:26:16.400,1:26:22.720
Fewer records mean a smaller breach and less unmanaged sensitive content sitting in inactive personal stores.
1:26:23.200,1:26:28.880
It means a reduced discovery burden for future audits, GIPA requests or e-discovery.
1:26:29.280,1:26:35.760
And it means we've genuinely reduced our tax surface, not just moved the problem around.
1:26:37.920,1:26:44.560
To wrap up, I'd like to reiterate the objective of our project at Newcastle University was not to review and sentence everything.
1:26:44.720,1:26:50.720
Rather it was to drive down our data breach risk due to over retention of M365 data.
1:26:51.440,1:27:07.440
To do this, we had to be able to demonstrate that we have identified the records that matter most for the university and acted on the challenges in a logical order and developed a regime for defensible disposal of our legacy records that we could deliver at scale.
1:27:08.480,1:27:14.840
So thank you for your time today and special thank you to my colleagues at the University of Newcastle who helped with this
1:27:14.920,1:27:23.600
project and thanks to Angela and the State Records for their support in this project and everyday - it's been a big task.
1:27:24.080,1:27:39.120
So if you have questions about the methodology, the risk framework, the governance approach or how to apply this to your own organisation, I'm happy to put you to discuss or put you in touch with other colleagues who collaborated with the records team on this project.
1:27:42.160,1:27:50.640
Nerida, thank you very much for such a wonderful presentation on an issue that I know occupies the minds of us all on this call.
1:27:51.240,1:28:04.000
There's been a couple of questions around the involvement of formal disposal authorities in the process and I note that your consultation and liaison with us at State Records
1:28:04.440,1:28:08.000
around ensuring the lawful nature of that disposal.
1:28:08.000,1:28:13.040
But thank you so much for your time this morning.
1:28:14.800,1:28:17.760
All right, we are right on time everyone.
1:28:18.320,1:28:25.760
For those of you who need to leave the forum, please feel free to do so.
1:28:26.080,1:28:29.040
We, however, will continue on with the forum
1:28:29.920,1:28:31.480
with our two updates.
1:28:31.480,1:28:39.360
And in that way, those updates will be captured by the recording of the forum that you're then able to look at afterwards.
1:28:39.680,1:28:43.720
So with that, I'll hand over now to
1:28:45.040,1:28:54.160
my colleague at State Records, Jade Reid, who's our Senior Project Officer of Local Government on secondment to us from Hunters Hill Council.
1:28:54.800,1:29:05.400
And Jade is leading our targeted work to assist and support local government over the next 12 months or so.
1:29:05.600,1:29:06.800
Jade, over to you.
1:29:07.040,1:29:07.540
Thank you.
1:29:07.920,1:29:08.800
Thank you, Martyn.
1:29:12.320,1:29:19.200
So today I'm going to give you a brief update on our records management exercise uplift program for 2026.
1:29:19.520,1:29:21.840
So all of the scorecards are out.
1:29:22.080,1:29:28.720
Everyone should have seen their results and the State of Recordkeeping Report highlights the results across the industry.
1:29:29.920,1:29:32.400
For us at State Records NSW, it doesn't stop there.
1:29:32.400,1:29:36.240
We're now in the uplift cycle and we encourage you to do the same.
1:29:36.240,1:29:45.680
So we want to see you reviewing your results, identifying your priorities and start planning the improvements that you can implement before the next RME in 2028.
1:29:47.120,1:29:57.360
Our goal through the uplift program is to strengthen compliance with the State Records Act by seeing the number of public offices that meet the baseline compliance levels increasing.
1:29:58.480,1:30:05.440
So we want to you should be working towards a level 3 or higher in all 19 of those capability areas.
1:30:05.840,1:30:15.040
So we're focusing on providing practical tools and support that can help you make genuine improvements within your organisation, not just get a higher score.
1:30:17.120,1:30:21.120
So we're starting off with the local government uplift program, which I'm leading.
1:30:21.760,1:30:24.400
You'll also see other targeted programs that will follow.
1:30:25.320,1:30:29.640
As part of those programmes, we will be engaging directly with public officers.
1:30:29.640,1:30:34.520
So with a focus on low scoring councils and non respondents.
1:30:34.520,1:30:41.360
So if you have received an overall score of less than three, please expect to hear from someone from State Records.
1:30:42.160,1:30:46.480
We're also developing updated guidance templates and more practical resources.
1:30:46.480,1:30:53.440
So on our website you will now see we have updated guidance for information asset registers and a new template.
1:30:54.080,1:31:01.520
We've developed a records and information policy template and our records and information strategy template for local government.
1:31:01.520,1:31:06.640
So those are designed that you can go and take them and adapt those to suit your organisation.
1:31:08.000,1:31:14.720
We also know that retention and disposal and transfer are two of the areas that we need to strengthen.
1:31:14.960,1:31:23.760
So we're going to be doing a bit of a focus on developing more practical guidance to help people get started in identifying the best places to start with those.
1:31:24.400,1:31:29.320
You'll also see more webinars, forums and other practical support over the next few months.
1:31:32.480,1:31:34.880
The next part I'm excited about this one.
1:31:34.880,1:31:37.040
So we are running a Local Government Roadshow.
1:31:38.080,1:31:45.840
So this roadshow is designed for local government, but all public offices are welcome to attend if they think it will be useful for them.
1:31:46.400,1:31:50.080
It's focused again on practical improvement and capability building.
1:31:50.320,1:31:55.920
So it's an opportunity for councils to learn from one another and share their experiences.
1:31:57.040,1:32:13.200
Anyone, as I said, anyone with a score of lower than three, any councils in that area, we highly encourage you to attend and we hope to see all of our senior responsible officers there, records and information management staff, roles that work alongside us.
1:32:13.200,1:32:21.760
So governance roles and IT roles and any chief information officers, managers or directors who have records management within their portfolio.
1:32:23.080,1:32:35.320
Our first roadshow is in Wagga Wagga on the 17th of November, followed by Dubbo the week later on the 24th of November, and then Tamworth on Wednesday, the 2nd of December.
1:32:35.920,1:32:38.720
We are hoping to do some more roadshows.
1:32:38.720,1:32:45.960
So following the hopeful success of these roadshows this year, we will be running some more in 2027 in different locations.
1:32:45.960,1:32:47.520
So that's all from me.
1:32:47.520,1:32:48.020
Thank you.
1:32:49.400,1:32:50.120
Wonderful, Jade.
1:32:50.120,1:32:51.200
Thank you very much.
1:32:52.880,1:32:56.160
A wonderful introduction of you to this forum.
1:32:57.120,1:33:07.280
Since you've been with us, of course, we've been very appreciative of all of the work that you've done and spearheaded in respect of our local government stakeholders.
1:33:07.280,1:33:08.960
So thank you and thank you for today.
1:33:10.240,1:33:10.740
All right.
1:33:10.800,1:33:18.080
And finally, updates from Museums of History NSW with Kate Musgrave, who's our Manager of Collection Services.
1:33:18.160,1:33:19.200
Kate, over to you.
1:33:20.040,1:33:20.720
Morning everyone.
1:33:20.720,1:33:22.160
This is going to be very brief.
1:33:22.160,1:33:24.880
So brief, there is not even another slide.
1:33:25.280,1:33:28.840
It's just an overview of the performance from last financial year.
1:33:28.840,1:33:36.000
So just in summary, we received 519 consignments across 404 series into the collection.
1:33:37.120,1:33:44.720
In addition to the physical material that we received, there were 156 consignments of born digital material transferred.
1:33:45.360,1:33:49.920
That represents 294 gigabytes of digital material ingested.
1:33:51.200,1:34:01.680
Last financial year, the digital transfers represented 22% of overall transfers, which is already a 10% increase on the year before.
1:34:02.800,1:34:08.360
Based on the current trends this year, we are expecting it to maybe hit 25%.
1:34:08.400,1:34:13.760
So 25% of all transfers will have been born digital, which is fantastic.
1:34:15.200,1:34:28.640
The physical transfers added 1,060 linear metres to the collection, bringing the total of what we hold here and in our regional areas to 94.985 kilometres.
1:34:29.920,1:34:34.560
Thank you also to everyone that submitted a transfer plan in 2025.
1:34:34.560,1:34:47.200
We are currently contacting those agencies that said that they would be transferring in 25-26 and we have not received anything just to see what's happening, if there's anything we can do to assist in a transfer.
1:34:48.080,1:34:52.960
We are also progressively contacting those agencies that did not submit a plan.
1:34:53.520,1:34:57.040
So far we have contacted 40 offices and
1:34:57.920,1:35:02.520
with many going back into their plans, updating them, asking questions.
1:35:02.520,1:35:06.080
So it's been really great for our engagement with offices.
1:35:06.720,1:35:13.000
Also, just a reminder that in mid 2027, we'll start sending out comms about access directions.
1:35:13.000,1:35:14.240
It's come around again.
1:35:14.240,1:35:16.960
It's time to renew in line with the five year cycle.
1:35:17.600,1:35:18.160
And that's it.
1:35:18.400,1:35:18.900
Thank you.
1:35:19.920,1:35:20.640
Wonderful, Kate.
1:35:21.040,1:35:22.640
Thank you very much.
1:35:23.440,1:35:35.200
I just wanted to return to Nerida's presentation for a moment and just reassure everyone that records retention and disposal authorities were used as part of that project.
1:35:35.200,1:35:40.080
So just to answer the question that an attendee asked.
1:35:41.520,1:35:46.160
All right, we have reached right on time today.
1:35:46.400,1:35:48.960
Thank you all for your attendance today.
1:35:49.840,1:36:02.880
It's been a wonderful session, really dealing, I think, with a number of hard-hitting issues when it comes to records management and recordkeeping throughout public offices covered by the State Records Act.
1:36:02.880,1:36:07.760
So my appreciation and thanks to all of our speakers today.
1:36:08.240,1:36:09.680
And thank you all.
1:36:09.760,1:36:10.960
We will be
1:36:12.000,1:36:17.640
planning our next Records Managers Forum and hope to squeak in another one before the end of the year.
1:36:18.000,1:36:19.680
Thank you all and bye for now.
