Social media - Frequently Asked Questions

We are often asked questions about recordkeeping and social media.

How long should social media records be kept?

There is no single retention period for social media records as this is determined by the purpose, content, or result of the communication and not the format.

Agencies should refer to the relevant general and functional retention and disposal authorities to determine retention and disposal actions for their social media records. Retention and disposal authorities identify the many different forms of business that NSW government organisations perform and specify the rules for how long information about each form of government business needs to be kept.These rules are risk dependent in that they differ according to the type of business being performed. They do not normally specifically mention social media records as they are just a particular format.

For low level business, retention rules are generally short – that is, information about this business often only needs to be maintained for one or two years. Information about higher risk, longer term or strategic business generally needs to be kept for longer periods of time. Below are some examples of disposal classes in our retention and disposal authorities that provide coverage for records of social media:

• the General retention and disposal authority: administrative records COMMUNITY RELATIONS - Marketing - (GA28, entry 2.14.2) covers records relating to general promotional or explanatory information about the organisation, its services and activities. This includes background research, draft and final versions of information published on websites, blogs or via social media. These types of social media records are only required to be retained until withdrawn, superseded or when reference use ceases.
• official social media accounts of Ministers are covered by the General retention and disposal authority: records of a Minister's Office, and are required as State archives (GDA13, entry 1.1).
• communications on Twitter and Facebook during a bushfire by the Rural Fire Service are covered as part of the records of the management of the incident (FA326, entries 10.2.1 and 10.2.2) and would be required as State archives or for a minimum of 25 years depending on the incident.
• notifications on a Council’s Facebook about road closures (which have a 2 year retention period under GA39, 28.10.4)

If you are in doubt about where your social media records are covered please contact govrec@staterecords.nsw.gov.au for advice.

What is the legal status of information in social systems?

Social systems, even if they are third party hosted systems like Twitter and Facebook or internal communication tools like Yammer, are government business systems when they are used by a government entity for business purposes.

They are therefore subject to all standard legislative requirements, including defamation, criminal and other legal requirements.

Information-related legislation such as the State Records Act, Privacy and Personal Information Protection Act, Government Information Public Access Act and the Copyright Act all also apply to socially generated information. Social systems are also subject to discovery provisions, like any other business application.

The fact that social tools are often used to have informal conversations does not stop legislative requirements from applying to them.

Current experience is showing that very broad notions of business purposes are being applied to new technologies. For example, personal mobile devices are frequently subpoenaed or subject to discovery orders if those devices have also been used for business communications. Therefore the fact that social tools host informal chat as well business specific conversations do not prevent social systems from being subject to the standard range of legislative requirements affecting any business environment.

Proactive information management strategies for social systems, particularly those supporting high risk business processes, can therefore help in the management of any legal issues that arise.

Does the State Records Act apply to social media?

Yes, social media information is a record under the definitions of the State Records Act.

This does not mean that all social media information must be captured and managed as an official record but it does mean that some high risk and key business value social media information will need to be managed and kept for appropriate periods of time.

Does defamation law apply to social media?

In Australia, the Federal Court has held that a party could be liable as a publisher for defamatory comments posted by members of the public on corporate social media accounts.

This raises information management issues for government organisations running social media sites where people have the ability to post comments.

The advice, Online defamation: what you need to know (May 2013) says it is important to have appropriate policies in place regarding the management of sites, to monitor these sites and any comments posted, to remove posts that are offensive or potentially defamatory, and to appropriately document the action taken by your organisation in case the issue escalates.

The incident should be documented, the post deleted and appropriate senior management and legal staff informed in case the issue escalates.

Back to top

Does the Privacy and Personal Information Protection Act apply to social media?

The PPIP Act requires you to be upfront about what you are doing with personal information.

Social media communications are in the public domain. Care must be taken to not use social media applications in ways that collect or disclose personal information. Privacy protection and management therefore needs to be proactively considered and designed into social strategies.

To manage privacy, you also need to be very clear about how you will be using any personal information provided via social channels, and this includes capturing information and making records of social media activities.

To mitigate any potential privacy risks, consider strategies like:

• providing clear guidance to people, advising them not to provide personal information via social media accounts and advising them of any official uses of the information they may provide
• moderating comments before they are officially published
• monitoring any complaints received via social media and ensuring that if people share their personal information or the personal information of other people, this information can be removed from the public arena and passed through other more appropriate channels
• advising people to contact you through alternative channels if they have personal issues they do not want to raise in a public forum.

Back to top

How frequently do I need to capture records of our social media engagement?

Like all records and information management issues, this is a risk based decision that you need to make based on an assessment of what your social media channels are designed to do and based on how your community is engaging with them.

For example, if you sporadically tweet marketing messages via a corporate account, there is limited community engagement with your messaging and there is no long term business value in the information you are broadcasting, you do not generally need to worry about capturing this information and can leave it in your social media application.

If however you want comprehensive information about all of your social media communications, you should develop a schedule to build governance and accountability around this approach. There are a variety of tools you can use to export full records of much of your social media engagement but to build a schedule around when you deploy those tools to capture these records, consider your social channels, the frequency of your communications, the extent of community engagement with your communications and the exact nature of your communications and your community engagement.

For example, are you using a very large and relatively stable social media platform like Twitter? The size and ubiquity of Twitter means it is unlikely to disappear tomorrow and this means that for low value or routine business information, you don't need to schedule urgently information capture immediately or every week. Instead you may assess your requirements and decide that you only need to capture comprehensive downloads every 2-3 months or every 6 months for less dynamic accounts.

But, say you are tweeting about a specific project or campaign and getting a lot of community response and your organisation is investing a lot in the success of this project. For this form of business, there is likely to be more need for accountability, information sharing, reporting, business analysis and use of your social media information. For this type of business you are likely to want much more frequent capture, possibly on a daily or weekly schedule, to ensure this high value business information is captured, shared and made available to all staff with a need to know in the organisation.

Again, if you are using social channels to engage on issues that would be regarded as high risk - they impact vulnerable communities, or are about very high value projects or they are seeking community feedback on significant issues or plans or projects etc - you should schedule regular capture. There are real business risks and accountabilities in these areas and you want to be sure your organisation has good, accessible, comprehensive and accountable information about this business whenever it needs it.

There is more discussion of these issues in Strategies for managing social media records.

Back to top

Can we tell clients that we don't want to receive their feedback or complaints via social media?

While it can be legitimate to ask your community to use existing formal channels rather than your social channels for particular types of communications, you should not have statements on your corporate social accounts with messages like: 'complaints received via Facebook are not officially registered' or 'requests for services made via this account will not be logged'.

You could include a statement on your social channels saying ‘If you would like to request a service please use our Customer Service Request form’ and include a link to that form, or saying ‘Please submit all complaints via email’ and provide an email address or a link for people to use.

However even with these statements, people are still likely to use your social accounts to request services or to make complaints or interact in other ways with your organisation. As your organisation is itself using these social channels as official communication channels, you do need to respond to valid business issues submitted via your social channels and, where needed to support your business, make and keep records of these issues.

If business issues are submitted via social media but you prefer to use existing formal channels to handle these issues, you can do this. You could have a process in place to ensure that whoever monitors or manages your social accounts takes a screenshot of the comment or issue, or runs a Facebook Activity report etc and then emails this to the relevant action officer for attention. This business issue which was initiated through social media then becomes part of your normal business channels.

However, if your community prefers to engage through social media, you should consider ways of managing business issues that arise there on social media. To support this, you should consider applying a ‘needs based information strategy’ as described in Strategies for managing social media records. This just means you manage information coming through your social media channels as and when you have a business need to do this.

Back to top

Do I need to keep information about what content the hyperlinks in my social media posts led to?

This depends on the nature of your social media business.

In many instances it may not be significant but, if in particular business areas it is going to be important to know exactly what a tweet or post was referring to, you should develop a means to capture a record of the referenced web page where necessary.

To determine whether you need to do this you should ask questions like:

• in a year’s time, is it going to be important to know what the advice a client was referred to was?
• in the future, will we need to know what webpage a client was pointing to in their comment?
• if our policies or official advice change regularly, will it be important to know what version of our policy or advice a client was directed to at the time of their enquiry?

If these types of issues are likely to be important, then you should develop a process that will enable you to capture information about your web content that will support your high risk social media business.

Capture of this information could be a manual process to capture either the full URL or a screenshot of the page itself. Alternatively it may be possible to develop an automated process and deploy a tool that will automatically take a copy of the web pages referred to in your tweets.

It may be that you will consider different strategies for different social media accounts. For example, depending on their business purpose, some Twitter accounts will reference external links much more significantly than others. A Twitter account used for marketing or communications may generally point off to many web-based resources, while another that is used to facilitate discussion and debate will primarily host conversations and will not reference as many external resources.

You also need to be aware of issues associated with content that is referenced using short URLs.

Short URLs are likely to be less supported and accessible than regular URLs. They are designed as a short term service, designed to facilitate short online communications and no guarantees are provided about their longevity. Also, a regular URL generally provides information about the location and context of an online resource whereas an auto-generated short URL does not.

In a social media information strategy you may want to look at the short URLs contained in your organisational tweets or other social media sources and determine whether there are any specific circumstances where you need these represented as a complete URL, in the information you capture about your social media communications.

Back to top

Does the information that I make and keep about my social media business need to look exactly like it did online?

No it does not.

First and foremost, your information management has to be achievable and sustainable. If your information is required for accountability, reporting or reuse purposes, it should is presented in an accessible, human readable way. Capturing data exactly as it looked in the system is desirable but, for most business uses, it is not as important as achievability, sustainability and accessibility.

In some cases, social media formats and presentation styles may be too difficult to replicate and keep. AJAX, the format that Facebook pages are presented in, is very complex. It is excellent for presenting dynamic, mixed content but could create a complex legacy problem if you wanted to manage data in this form indefinitely.

If, for specific your business or legal purposes, it is important to keep a record of how your social media site looked at a particular point in time or if you need to capture a record of a specific comment in the context that it appeared, consider capturing screenshots saved as PDF as a way to make and keep this information.

If you are concerned to maintain the accuracy and integrity of your social media information you need to ensure your information management strategy enables you to:

• identify what social media channel the information was received through
• identify the user account names of those involved in the communication/s
• provide a time and date stamp for the communication/s
• ensure the information is well managed within your corporate environment.

See our advice on Strategies for managing social media records for more advice on how to manage the accountability and integrity of your social media information.

Back to top

How do I know if I need a social media information management strategy?

This depends completely on the specific business needs your social media strategy is supporting.

The following questions help to identify the type of business your social media engagement is supporting:

• Is high risk or strategic business in your organisation being performed in social channels?
• Are corporate decisions being made or communicated through social channels?
• Is significant advice communicated to clients through social channels?
• Will your organisation have long term needs for the information generated through social channels?
• Will members of the community base decisions or actions on the advice you are providing through social channels?
• Will business reporting and/or planning and assessment rely on information contained in social systems?
• Will business areas want to reuse content from social systems?
• Does business information generated through social need to be shared through the organisation to inform decision making?

If you answered yes to any of these questions, it is likely that you will need an information management strategy to support your social media operations.

Back to top

Can I use just one tool for managing all my different social media information?

Again, this depends on the social media channels you are using. If you are using lots of different channels, you may need to look at using a variety of tools to work with all your social systems.

This is because social media tools are generally proprietary and commercial technologies. There is often little similarity between them and tools generally need to be configured to work with each specific social applications. Therefore, generally, it is complex for tools to be configured to collect content from all forms of social systems. Social systems are also constantly evolving which means that the tools that support them change regularly as well, making it difficult to use one tool consistently to manage all relevant business information.

See our advice on different tools for capturing social media information for more information about different social media tools and how they can be used.

We are keen to expand our list of tools so if you have any recommendations to add, please contact us.

Back to top

We have a broadcast system to communicate emergency messages via social media when needed - do I need to know the time and date that I broadcast a particular social media message and know when someone receives it?

You definitely need to capture the date and time of broadcast when communicating messages through this system. Emergency broadcasts provide critical information to the community and it can be very important for organisations to be able to account for the information that they broadcast at specific points in time.

However you do not need to capture information about when someone receives your communication as it is often not possible to do this. Geographical coverage issues, volume capacities, specific device issues and their availability can all affect transmission time and capacity. In these circumstances you do need to capture a record of what was communicated from your environment but you cannot control what occurs in other environments.

When using a broadcast system to generate and broadcast social media communications across a variety of channels in emergency situations, you may also want to ensure that your system can generate an exception report, to make sure you are informed if some posts are not successful. This can serve immediate business needs for re-communicating certain messages and can also provide a record of communication transmission.

Back to top

What information management considerations apply to wikis?

With these types of complex systems you need to ask fairly complex questions to try and determine exactly what parts of the system you need to keep as ongoing business information.

Wikis are often used for specific projects where collaboration, clear versioning and tight management controls are required.

If staff performing high risk business or projects wish to use a wiki and it is determined that there are going to be ongoing accountability and business needs for the information contained in this wiki, organisations should:

• ensure that the preferred wiki platform enables information export
• determine the formats in which information can be exported and determine whether these formats are interoperable with your current business systems and processes
• identify whether all content within the wiki should be exported or whether export is limited to certain areas
• communicate to the project team deploying the wiki that the information in it is of ongoing business value and therefore must not be purged at project completion
• communicate to the project team using the wiki that the security rules they apply must not impede any necessary information management practices
• ask the project team to determine whether wiki content should be preserved at intervals or at a specific project completion date
• get the project team to determine whether core wiki content should be exported or whether only certain content has ongoing business value
• determine whether the rules, access and use authorisations or project controls that govern use and update of the wiki also need to be exported out of the wiki as necessary accountability and authentication data
• determine whether it is desirable to capture screenshots to record the look and feel of the wiki.

Back to top

What information management considerations apply to collaborative editing tools like Google Docs?

With collaborative editing tools you need to consider your ongoing business needs for the information generated in these tools. If your business requires ongoing access to this information it should consider issues such as:

• can the information be protected, shared, used and kept in the Google Docs environment for as long as it is required?
• if not, what information should be exported out of Google Docs, who will export it and where should it be kept?
• when will information export be performed – daily, weekly, at key decision points, at project completion etc?
• after immediate collaborative business purposes have concluded, do any accessibility restrictions caused by password controls limit corporate information availability and reuse? If so, should export into more accessible corporate environments considered?
• what technical and administrative controls are required to access information, such as secure log in and does this impede corporate ability to manage necessary information?
• for accountability, traceability or version control purposes, does any revision history need to be captured in some instances?
• is there the capacity to lock down pages when complete or at specific approval points, to prevent their subsequent alteration?
• how is ownership between multiple collaborators to be determined? Are formal agreements around this required?
• who has capacity to purge unnecessary drafts or extraneous information?
• are staff aware of the need for version control and for clear labelling of content so it is clear what the most relevant, useable and definitive business information is?
• if the information on Google Docs needs to be kept for periods of 5+ years, have you determined strategies to ensure ongoing accessibility can be maintained? Can you ensure that the content is not restricted to just one personal login? How will all relevant staff know the content exists and is useable for business purposes?

Back to top

How can I manage information generated in LinkedIn?

LinkedIn has limited capacities for information export.

If high value business discussions are taking place in LinkedIn there may be limited amounts of information you can export from LinkedIn and manage within your organisation.

Certain information about first degree contacts can be exported as a CSV file and some LinkedIn comments or discussion threads be sent via an RSS feed to a nominated email address, but broader information export appears to be limited.

While group owners, moderators or managers have controls to delete content from LinkedIn discussions or comments, it is not possible to export a current list of group members involved in a discussion group, nor to export a discussion.

Therefore, if significant business communications are taking place on LinkedIn and if you have an ongoing business need to refer to and reuse this content, you may determine that LinkedIn is not the most appropriate location for these corporate discussions.

Back to top

Why should I develop a social media information management strategy?

In many organisations there is no coordinated, overarching strategy for social media use. Social media technologies are adopted by different business areas without reference to corporate policies or strategies and without considering the information management requirements for the business they are performing.

This approach can lead to information loss or process duplication, as a lack of corporately available information means staff reproduce effort or operate without all information available to them. It can also mean that important, long term value business information can easily be disappear.

It is therefore important to identify all uses of social media technologies across your organisation and to develop an information management strategy that encompasses all areas of your social media operations.

A social media information strategy will enable you to:

• comprehensively identify what business processes are moving to social media
• determine what information generated via social media is needed to support these business processes
• identify the legal and business information use and retention requirements that apply to your social media operations
• identify the client needs, expectations and public accountabilities that apply to your social media operations
• identify the business areas in your organisation that need to access, reference, respond to, use or reuse the information generated via your social media channels
• identify and manage the information that your organisation needs long term access to
• identify appropriate management strategies for high risk, high value business information
• identify the business records that can stay in their native social media applications.

Assessing and understanding each of these will help you to determine how your organisation’s social media information can best be captured and managed.

It is important to keep a watching brief on your social media systems and consequently your social media strategy. These systems are very dynamic and how your organisation uses them can change quite rapidly. These changes can be driven by the community who might start to use your systems in different ways or they can be driven by staff who want to maximise the potential of social media.

If use of your social media systems start to change, you need to look at your current social media information management strategies and determine whether these also need to change.

Things to look out for include:

• Are members of the community starting to ask specific questions about policy or services on social media?
• Are you receiving compliments or complaints via social media?
• Are staff members providing advice about new policies or programs via social media?

If these changes start occurring then your organisation’s information needs might change too. This is because you may now need the information from your social media system:

• as input into policy or program development
• as evidence of how a question or complaint was handled
• to give to business areas as part of workflow processes
• to enable effective client management.

As information in social media systems is not stable, if your business use of social media is changing, you may decide to start to schedule regular exports of your social media transactions to ensure your organisation is able to continue to access and use the business information it is generating and receiving via social media.

Back to top

My IT manager says social media applications are not official business systems and therefore we don’t need to keep records of corporate social media activities. What should I say to her?

Your IT manager may be focussed on the blurry line between some of the more informal communications on your social media channels and the more substantial business that may be occurring there.

This however should not distract from the fact that organisational decisions and programs may be being publicly questioned on your social media accounts, that your organisation may be publicly promoting its programs and operations on social media and that you may be using social media for other legitimate business purposes, such as public consultation on policy or regulatory proposals.

If you are using social media for business purposes then the information being made available or the information received via social media is official government business information and you do need to assess whether you need a social media information management strategy.

A social media information management strategy will enable you to:

• account for your business operations that are moving to social media environments
• assist clients who choose to engage with the organisation through social media
• ensure that the business intelligence generated in social media is fed back into business operations and is maintained and accessible for business purposes for as long as it is required
• determine what business records in your social media channels need to be exported out of their native environment and into corporate business frameworks
• evaluate, monitor, improve and assess your social media strategies and the business processes you are moving to social environments.

The very public nature of social media-based operations brings with it a public expectation of openness and accountability. If government is engaging in social spaces, people expect that fit and proper processes will apply to the social media communications as much as they apply to traditional, more formal communications. Good management of your social media information is a key way to meet this expectation.

Back to top

Is Facebook a government business system? My IT section says that it is not.

Yes. If you are using it for government business purposes, then it is a government business system and you need to make arrangements to manage the information you are producing and receiving.

Facebook however is not a business and information management system – it is owned by an external commercial third party and it is located in the cloud.

If you need the business information in Facebook to account for your actions, to incorporate in business processes, to track decisions you have made, to provide input into policy development etc, then you need to actively export this information out of Facebook because there are no guarantees that it is going to stay accessible in your Facebook account for as long as you are going to need it.

This however does need to be a risk-based decision. For example, if a Facebook account is used by a library just to promote new acquisitions and (for example) library promotional material only needs to be kept for business and legal purposes for 2 years, then you may decide that leaving this information on Facebook is an adequate information management approach.

If however officers are providing development advice on Facebook or answering questions about high level business plans, then this is more contentious and trusting Facebook to keep this information for the much longer retention periods that apply to this type of information is not appropriate.

The standard process at this stage for managing information in Facebook and other social media environments is to do a regular export of your data from these systems, often using tools like Facebook Activity Logs.

All organisations need to understand that Facebook is a business system and that genuine and risky government business is already taking place there. So the export you do and the information you need to capture from Facebook needs to be an accurate representation of the business that is being performed. You need date and time representation of transactions, of comments, of posts, possibly of likes. It is important to sit down with business and determine exactly what they are going to need to account for the actions and transactions that are starting to take place in Facebook. And the business moving to social media and mobile environments is only going to increase, and so it’s important to put in place strategies now that are going to enable you to have good and meaningful information both now and in the future.

Published April 2014 | Updated December 2016/ July 2017

Back to top