Social media recordkeeping FAQ

There is no single retention period for social media records as this is determined by the purpose, content, or result of the communication and not the format.

Agencies should refer to the relevant general and functional retention and disposal authorities (RDAs) to determine retention and disposal actions for their social media records. Retention and disposal authorities identify the many different forms of business that NSW government organisations perform and specify the rules for how long information about each form of government business needs to be kept. 

The rules differ according to the type of business being performed. They do not normally specifically mention social media records as rules in RDAs are generally not format-specific.

For low level or routine business retention rules are generally short – that is, information about these types of activities often only needs to be maintained for one or two years. Information about higher risk, longer term or strategic business generally needs to be kept for longer periods of time. 

Below are some examples of disposal classes in our retention and disposal authorities that provide coverage for records of social media:

• the General retention and disposal authority: administrative records (GA28 2.14.2) covers records relating to general promotional or explanatory information about the organisation, its services and activities. This includes background research, draft and final versions of information published on websites, blogs or via social media. These types of social media records are only required to be retained until withdrawn, superseded or when reference use ceases.
• official social media accounts of Ministers are covered by the General retention and disposal authority: records of a Minister's Office (GDA13 1.1) and are required as State archives.
• communications on X/Twitter and Facebook during a bushfire by the Rural Fire Service are covered as part of the records of the management of the incident (FA445 1.6.1 and 1.6.2) and would be required as State archives or for a minimum of 12 years depending on the incident.
• notifications on a Council’s Facebook about road closures (FA450 21.8)

If you are in doubt about where your social media records are covered please contact govrec@staterecords.nsw.gov.au for advice.

Social systems, even if they are third party hosted systems like X/Twitter and Facebook or internal communication tools like Yammer, are government business systems when they are used by a government entity for business purposes.

They are therefore subject to all standard legislative requirements, including defamation, criminal and other legal requirements.

Information-related legislation such as the State Records Act, Privacy and Personal Information Protection Act, Government Information Public Access Act and the Copyright Act all also apply to socially generated information. Social systems are also subject to discovery provisions, like any other business application.

The fact that social tools are often used to have informal conversations does not stop legislative requirements from applying to them. 

For example, personal mobile devices are frequently subpoenaed or subject to discovery orders if those devices have also been used for business communications. The fact that social tools host informal chat as well business specific conversations does not prevent social systems from being subject to the standard range of legislative requirements affecting any business environment.

Proactive information management strategies for social systems, particularly those supporting high risk business processes, can therefore help in the management of any legal issues that arise. 

Yes, social media information is a record under the definitions of the State Records Act.

This does not mean that all social media information must be captured and managed as an official record but it does mean that some high risk and key business value social media information will need to be managed and kept for appropriate periods of time.

In Australia, the Federal Court has held that a party could be liable as a publisher for defamatory comments posted by members of the public on corporate social media accounts.

This raises information management issues for government organisations running social media sites where people have the ability to post comments. 

It is important to have appropriate policies in place regarding the management of sites, to monitor these sites and any comments posted, to remove posts that are offensive or potentially defamatory, and to appropriately document the action taken by your organisation in case the issue escalates. 

Offensive or defamatory posts should be documented and deleted. Inform appropriate senior management and legal staff in case the issue escalates.

The PPIP Act requires you to be upfront about what you are doing with personal information.

Social media communications are in the public domain. Care must be taken to not use social media applications in ways that collect or disclose personal information. Privacy protection and management therefore needs to be proactively considered and designed into social strategies.

Educate staff not to obtain or disclose personal information via social media 

For example, one NSW University instructs its staff that use of social media such as Facebook or X/Twitter is limited to providing information to students on a broadcast basis, as for any other website presence.

It also instructs staff that social media must not be used for responding to any current or prospective student’s question where the response would include personal information or would be giving specific advice regarding candidature.

Tell your clients that you will not obtain personal information through social media.

For example, a version of the following notice can be published on your organisation’s website:

We will never ask you for personal information through social media. If we need personal information to answer your question or help you, we will ask you to use a more private channel, such as emailing or calling us.

To manage privacy, you also need to be very clear about how you will be using any personal information provided via social channels, and this includes capturing information and making records of social media activities. 

Tell people about your intended official uses of their information

The Privacy Statement on the NSW government’s ‘Have your say’ page https://www.nsw.gov.au/nsw-government/privacy-statement makes it clear that they will collect and securely transfer information to NSW Government agencies to provide correspondents with a service, personalised information or to gather your feedback. 

The types of information collected varies depending on the service which is being accessed, and may include personal, health or other sensitive information.

Tell people if you are going to be capturing information about your social media operations

This organisation notes that some publicly available personal information posted to this organisation’s blogs may be captured and kept as a record in this organisation’s internal business systems.

This organisation only captures and keeps the information it needs to support its business operations and any publicly available personal information that it captures, such as personally identified comments, responses and questions posted to its blogs, will be managed in accordance with the Privacy and Personal Information Protection Act 1998.

To mitigate any potential privacy risks, consider strategies like:

• providing clear guidance to people, advising them not to provide personal information via social media accounts and advising them of any official uses of the information they may provide
• moderating comments before they are officially published
• monitoring any complaints received via social media and ensuring that if people share their personal information or the personal information of other people, this information can be removed from the public arena and passed through other more appropriate channels
• advising people to contact you through alternative channels if they have personal issues they do not want to raise in a public forum. 

Like all records and information management issues, this is a risk- based decision that you need to make based on an assessment of what your social media channels are designed to do and based on how your community is engaging with them.

For example, if you sporadically tweet marketing messages via a corporate account, there is limited community engagement with your messaging and there is no long term business value in the information you are broadcasting, you do not generally need to worry about capturing this information and can leave it in your social media application. 

However, if you want comprehensive information about all of your social media communications, you should develop a schedule to build governance and accountability around this approach. There are a variety of tools you can use to export full records of much of your social media engagement but to build a schedule around when you deploy those tools to capture these records, consider your social channels, the frequency of your communications, the extent of community engagement with your communications and the exact nature of your communications and your community engagement.

For example, are you using a very large and relatively stable social media platform like X/Twitter? The size and ubiquity of X/Twitter means it is unlikely to disappear tomorrow and this means that for low value or routine business information, you don't need to schedule urgently information capture immediately or every week. Instead you may assess your requirements and decide that you only need to capture comprehensive downloads every 2-3 months or every 6 months for less dynamic accounts. 

But if you are tweeting about a specific important project or campaign and getting a lot of community response , there is likely to be more need for accountability, information sharing, reporting, business analysis and use of your social media information. 

For this type of activity you are likely to want much more frequent capture, possibly on a daily or weekly basis, to ensure this information is captured, shared and made available to all relevant staff in the organisation.

If you are using social channels to engage on issues that are regarded as high risk - for example, ones that impact vulnerable communities, relate to important or contentious projects, or solicit significant community feedback - you should schedule regular capture. There are real business risks and accountabilities in these areas and you need to be sure your organisation has good, accessible, comprehensive and accountable information about this business whenever it needs it.

There is more discussion of these issues in Strategies for managing social media records. 

This depends on the nature of your social media business.

In many instances it may not be significant but, if in particular business areas it is going to be important to know exactly what a tweet or post was referring to, you should develop a means to capture a record of the referenced web page where necessary.

To determine whether you need to do this you should ask questions like:

• in a year’s time, is it going to be important to know what the advice a client was referred to was?
• in the future, will we need to know what webpage a client was pointing to in their comment?
• if our policies or official advice change regularly, will it be important to know what version of our policy or advice a client was directed to at the time of their enquiry?

If these types of issues are likely to be important, then you should develop a process that will enable you to capture information about your web content that will support your high risk social media records.

Capture of this information could be a manual process to capture either the full URL or a screenshot of the page itself. Alternatively it may be possible to develop an automated process and deploy a tool that will automatically take a copy of the web pages referred to in your tweets. 

Additional information about the capture of social media records in official recordkeeping systems can be found in Strategies for managing social media records. 

It may be that you will consider different strategies for different social media accounts. For example, depending on their business purpose, some X/Twitter accounts will reference external links much more significantly than others. A X/Twitter account used for marketing or communications may point to many web-based resources, while another that is used to facilitate discussion and debate might not reference as many external resources.

You also need to be aware of issues associated with content that is referenced using short URLs.

Short URLs are likely to be less supported and accessible than regular URLs. They are designed as a short term service, designed to facilitate short online communications and no guarantees are provided about their longevity. Also, a regular URL generally provides information about the location and context of an online resource whereas an auto-generated short URL does not.

You may want to look at the short URLs contained in your organisational tweets or other social media sources and determine whether there are any specific circumstances where you need these represented as a complete URL. This should be included in your information management strategy.

No, it does not.

First and foremost, your information management practices have to be achievable and sustainable. If your information is required for accountability, reporting or reuse purposes, it should be presented in an accessible, human-readable way. Capturing data exactly as it looked in the system is desirable but, for most business uses, it is not as important as achievability, sustainability and accessibility.

In some cases, social media formats and presentation styles may be too difficult to replicate and keep. AJAX, the format that Facebook pages are presented in, is very complex. It is excellent for presenting dynamic, mixed content but could create a complex legacy problem if you wanted to manage data in this form indefinitely.

If, for specific your business or legal purposes, it is important to keep a record of how your social media site looked at a particular point in time or if you need to capture a record of a specific comment in the context that it appeared, consider capturing screenshots saved as PDF as a way to make and keep this information.

If you are concerned to maintain the accuracy and integrity of your social media information you need to ensure your information management strategy enables you to:

• identify what social media channel the information was received through
• identify the user account names of those involved in the communication/s
• provide a time and date stamp for the communication/s
• ensure the information is well managed within your corporate environment.

See our advice on Strategies for managing social media records for more advice on how to manage the accountability and integrity of your social media information

This depends completely on the specific business needs your social media strategy is supporting.

The following questions help to identify the type of business your social media engagement is supporting:

• Is high risk or strategic business in your organisation being performed in social channels?
• Are corporate decisions being made or communicated through social channels?
• Is significant advice communicated to clients through social channels?
• Will your organisation have long term needs for the information generated through social channels?
• Will members of the community base decisions or actions on the advice you are providing through social channels?
• Will business reporting, planning and assessment rely on information contained in social systems?
• Will business areas want to reuse content from social systems?
• Does business information generated through social need to be shared throughout the organisation to inform decision making?

If you answered yes to any of these questions, it is likely that you will need an information management strategy to support your social media operations.

Again, this depends on the social media channels you are using. If you are using lots of different channels, you may need to look at using a variety of tools to work with all your social systems.

This is because social media tools are generally proprietary and commercial technologies. There is often little similarity between them and tools generally need to be configured to work with each specific social applications. Generally tools cannot be configured to collect content from all forms of social systems. Social systems are also constantly evolving which means that the tools that support them change regularly making it difficult to use one tool to manage all relevant business information.

See our advice on different tools for capturing social media information for more information about different social media tools and how they can be used.

We are keen to expand our list of tools so if you have any recommendations to add, please contact us.

You definitely need to capture the date and time of broadcast when communicating messages through this system. Emergency broadcasts provide critical information to the community and it can be very important for organisations to be able to account for the information that they broadcast at specific points in time.

However, it is generally not possible to capture information about when someone receives your communication. Geographical coverage issues, volume capacities, specific device issues and their availability can all affect transmission time and capacity.

When using a broadcast system to generate and broadcast social media communications across a variety of channels in emergency situations, you may also want to ensure that your system can generate an exception report, to make sure you are informed if some posts are not successful. This can serve immediate business needs for re-communicating certain messages and can also provide a record of communication transmission. 

With these types of complex systems you need to ask fairly complex questions to try and determine exactly what parts of the system you need to keep as ongoing business information.

Wikis are often used for specific projects where collaboration, clear versioning and tight management controls are required.

If staff performing high risk business or projects wish to use a wiki and it is determined that there are going to be ongoing accountability and business needs for the information contained in this wiki, organisations should:

• ensure that the preferred wiki platform enables information export
• determine the formats in which information can be exported and determine whether these formats are interoperable with your current business systems and processes
• identify whether all content within the wiki should be exported or whether export is limited to certain areas
• communicate to the project team deploying the wiki that the information in it is of ongoing business value and therefore must not be purged at project completion
• communicate to the project team using the wiki that the security rules they apply must not impede any necessary information management practices
• ask the project team to determine whether wiki content should be preserved at intervals or at a specific project completion date
• get the project team to determine whether core wiki content should be exported or whether only certain content has ongoing business value
• determine whether the rules, access and use authorisations or project controls that govern use and update of the wiki also need to be exported out of the wiki as necessary accountability and authentication data
• determine whether it is desirable to capture screenshots to record the look and feel of the wiki. 

With collaborative editing tools you need to consider your ongoing business needs for the information generated in these tools. If your business requires ongoing access to this information it should consider issues such as:

• can the information be protected, shared, used and kept in the Google Docs environment for as long as it is required?
• if not, what information should be exported out of Google Docs, who will export it and where should it be kept?
• when will information export be performed – daily, weekly, at key decision points, or at project completion etc?
• after immediate collaborative business purposes have concluded, do any accessibility restrictions caused by password controls limit corporate information availability and reuse? If so, should export into more accessible corporate environments considered?
• what technical and administrative controls are required to access information, such as secure log in and does this impede corporate ability to manage necessary information?
• for accountability, traceability or version control purposes, does any revision history need to be captured in some instances?
• is there the capacity to lock down pages when complete or at specific approval points, to prevent their subsequent alteration?
• how is ownership between multiple collaborators to be determined? Are formal agreements around this required?
• who has capacity to purge unnecessary drafts or extraneous information?
• are staff aware of the need for version control and for clear labelling of content so it is clear what the most relevant, useable and definitive business information is?
• if the information on Google Docs needs to be kept for periods of 5+ years, have you determined strategies to ensure ongoing accessibility can be maintained? Can you ensure that the content is not restricted to just one personal login? How will all relevant staff know the content exists and is useable for business purposes? 

LinkedIn has limited capacities for information export.

If high value business discussions are taking place in LinkedIn there may be limited amounts of information you can export from LinkedIn and manage within your organisation.

Certain information about first degree contacts can be exported as a CSV file and some LinkedIn comments or discussion threads be sent via an RSS feed to a nominated email address, but broader information export appears to be limited.

While group owners, moderators or managers have controls to delete content from LinkedIn discussions or comments, it is not possible to export a current list of group members involved in a discussion group, nor to export a discussion.

Therefore, if significant business communications are taking place on LinkedIn and if you have an ongoing business need to refer to and reuse this content, you may determine that LinkedIn is not the most appropriate location for these corporate discussions. 

In many organisations there is no coordinated, overarching strategy for social media use. Social media technologies are adopted by different business areas without reference to corporate policies or strategies and without considering the information management requirements for the business they are performing.

This approach can lead to information loss or process duplication, as a lack of corporately available information means staff reproduce effort or operate without all information available to them. It can also mean that important, long term value business information can easily be disappear.

It is therefore important to identify all uses of social media technologies across your organisation and to develop an information management strategy that encompasses all areas of your social media operations.

A social media information strategy will enable you to:

• comprehensively identify what business processes are moving to social media
• determine what information generated via social media is needed to support these business processes
• identify the legal and business information use and retention requirements that apply to your social media operations
• identify the client needs, expectations and public accountabilities that apply to your social media operations
• identify the business areas in your organisation that need to access, reference, respond to, use or reuse the information generated via your social media channels
• identify and manage the information that your organisation needs long term access to
• identify appropriate management strategies for high risk, high value business information
• identify the business records that can stay in their native social media applications.

Assessing and understanding each of these will help you to determine how your organisation’s social media information can best be captured and managed.

It is important to keep a watching brief on your social media systems and consequently your social media strategy. These systems are very dynamic and how your organisation uses them can change quite rapidly. These changes can be driven by the community who might start to use your systems in different ways or they can be driven by staff who want to maximise the potential of social media.

If use of your social media systems start to change, you need to look at your current social media information management strategies and determine whether these also need to change.

Things to look out for include:

• Are members of the community starting to ask specific questions about policy or services on social media?
• Are you receiving compliments or complaints via social media?
• Are staff members providing advice about new policies or programs via social media?

If these changes start occurring then your organisation’s information needs might change too. This is because you may now need the information from your social media system:

• as input into policy or program development
• as evidence of how a question or complaint was handled
• to give to business areas as part of workflow processes
• to enable effective client management. 

As information in social media systems is not stable, you may decide to schedule regular exports of your social media transactions so that your organisation is able to continue to access and use the business information it is generating and receiving via social media.

If you are using social media for any type of business purpose, then the information being made available or the information received via social media is official government information.

If any of the following are occurring, your organisation is using social media for official business, and you may need to develop and implement a social media information strategy:

• describing and promoting organisational decisions and programs
• soliciting or receiving feedback on services or programs
• soliciting or receiving public comments on policy or regulatory proposals
• generating public discussion on organisational decisions, programs or services
• answering questions from the community about the organisation or its programs and services

A social media information management strategy will enable you to:

• account for your business operations that are moving to social media environments
• assist clients who choose to engage with the organisation through social media
• ensure that the business intelligence generated in social media is fed back into business operations and is maintained and accessible for business purposes for as long as it is required
• determine what business records in your social media channels need to be exported out of their native environment and into corporate business frameworks
• evaluate, monitor, improve and assess your social media strategies and the business processes you are moving to social environments.

The very public nature of social media-based operations brings with it a public expectation of openness and accountability. If government is engaging in social spaces, people expect that fit and proper processes will apply to the social media communications as much as they apply to traditional, more formal communications. Good management of your social media information is an important way to meet this expectation. 

Yes. If you are using it for government business purposes, then it is a government business system and you need to make arrangements to manage the information you are producing and receiving.

Facebook however is not an information management system – it is owned by an external commercial third party and it is located in the cloud.

If you need to retain the business information in Facebook to account for your actions, to incorporate in business processes, to track decisions you have made, or to provide input into policy development, then you need to actively export this information out of Facebook.

There are no guarantees that it is going to stay accessible in your Facebook account for as long as you are going to need it.

This however does need to be a risk-based decision. For example, if a Facebook account is used by a library just to promote new acquisitions, as library promotional material only needs to be kept for business and legal purposes for 2 years you may decide that leaving this information on Facebook is an adequate information management approach.

However, officers providing development advice on Facebook or answering questions about high level business plans is much more important. Trusting Facebook to keep this information for the much longer retention periods that apply to this type of information is not appropriate.

The standard process at this stage for managing information in Facebook and other social media environments is to do a regular export of your data from these systems, often using tools like Facebook Activity Logs.

Government business is already taking place on Facebook. The information that needs to be captured from Facebook must be an accurate representation of the business that is being performed.

This could include the date and time representation of transactions, of comments, of posts, possibly of likes. It is important to determine exactly what your organisation will need to account for the actions and transactions that are happening on Facebook.

As business moving to social media and mobile environments is only going to increase, it’s important to put in place strategies that are will enable you to retain good and meaningful information both now and in the future.