This instruction applies to: / Reference:
Providers of Probation Services / PI 28/2014
Issue Date / Effective Date
Implementation Date / Expiry Date
01 May 2014 / 01June2014 / 31 April 2015
Issued on the authority of / NOMS Agency Board
For action by / All staff responsible for the development and publication of policy and instructions
NOMS HQ
National Probation Service (NPS)Directorate
Community Rehabilitation Companies (CRC)
.
Instruction type / Service improvement/legal compliance
For information / All staff providing Probation Services
Provide a summary of the policy aim and the reason for its development / revision / This policy is a revision of PI 06-2011 to comply with the changes required by the Transforming Rehabilitation Programme.
The policy aims to provide Instruction and guidance to the National Probation Service (NPS) in the management of paper and electronic records with particular reference to retention and disposal.
The policy does not apply to Offender Records which can be found in separate PI on the Management of Offender Records, applicable to NPS, CRC and other providers of probation services.
This policy will reinforce roles and responsibilities to support records management policy across NPS Divisions on behalf of the MoJ. It will facilitate compliance with NOMS’ obligations under the Freedom of Information Act 2000 (FOIA), Data Protection Act 1998 (DPA) and Public Records Act 1958 (PRA) by ensuring that retention and disposal of records is carried out in line with a clearlyestablished policy that has been formally adopted by the organisation.
Contact / NOMS Information Policy and Assurance Team,
1st Floor, Clive House,
Petty France,
London, SW1H 9EX
Tel 0300 047 6285
Email:
Associated documents / Must be read in conjunction with IT Security Policy, the Government Security Classification Policy and the Information Assurance Policy
Audit/monitoring: There is a resource requirement on NPS to ensure a LIM is appointed. This role is not a post in itself and has been identified as a responsibility within the Divisional Support hub. The Local Information Manager (LIM) will need to spend time monitoring and reviewing local processes. The review frequency will be determined by the local management plan and detailed in the compliance statement.
Introduces amendments to the following documents: -None.
Notes:All mandatory actions in this Instruction are in Italics and must be strictly adhered to.
Page 1
CONTENTS
Hold down “Ctrl” and click on section titles below to follow link
Section / Subject / For reference by:1 / Executive Summary - Background / All NPS staff
1.7 / Desired Outcomes
1.12 / Application
1.13 / Mandatory Actions
1.16 / Role of the Local Information Manager
1.28 / Resource implication, Audit and Compliance
2 / Review and disposal protocol
3 / Glossary
4 / Where to find more information
AnnexA / Probation records definition
Annex B / Statutory responsibility
Annex C / Key Disposal/Retention Considerations
Annex D / Generic Retention Information
Annex E / Local Information Manager Role Description
Annex F / HR records
Annex G / Probation Estate Management records
Annex H / Project and Programme Management records
Annex I / Guidance on Managing Personal Data
- Executive Summary
Background
1.1Government policy emphasises the importance of having systems in place for the timely and secure disposal of documents and records that are no longer required for business purposes. NOMS is responsible for complying with the Lord Chancellor’s Code of Practice on the management of records issued under s.46 of the FOIA which states that authorities should have in place a records management policy endorsed by senior management and made readily available to staff at all levels. Further information on statutory obligations can be found at Annex B.
1.2NOMS has an overarching responsibility and this policy aims to provide Instruction and guidance to the National Probation Service (NPS), in the management of paper and electronic records with particular reference to retention and disposal. This policy will reinforce roles and responsibilities to support records management policy across NOMS on behalf of the MoJ. It will facilitate compliance with NOMS’ obligations under the Freedom of Information Act 2000 (FOIA), Data Protection Act 1998 (DPA) and Public Records Act 1958 (PRA) by ensuring that retention and disposal of records is carried out in line with a clearly established policy that has been formally adopted by the organisation.
1.3Community Rehabilitation Companies (CRCs) are their own data controllers (and are individually accountable directly to the Information Commissioner) under the provisions of the DPA.
1.4This policy is not applicable to CRCs, aseparate policy on the management of offender records in the community describes the mandatory requirements placed on The National Probation Service (NPS), Community Rehabilitation Companies (CRCs) and other providers of contracted services when dealing with offender records.
1.5Retention of specific documents is necessary to support various business requirements and to comply with legislation. To destroy these records prematurely could have a significant impact on MoJ, NOMS and NPS. Equally to keep these records permanently or longer than is necessary could mean that MoJ, NOMS and/or NPS are acting unlawfully or in breach of their statutory duties, as well as creating unnecessary storage costs
1.6This Instruction covers a variety of functions and business activities undertaken by NPSand contains a number of suggested disposal schedules provided by The National Archives in line with the PRA, DPA and FOIA. Records which are specific to NPS should be managed in line with these schedules in order to ensure consistency between NPS Divisions. These records can be found at Annex Fonwards.
Desired outcomes
1.7The purpose of this policy is to provide a corporate policy framework to govern management decisions regarding whether a particular record (or set of records) should be either:
- Retained – and if so in what format, and for what period
- Disposed of - as indefinite retention of personal data IS unlawful IN CERTAIN CIRCUMSTANCES
1.8Records, for the purposes of this PI, are documents , data or information of corporate importance. This policy does not apply to Offender Records. Further information as to what constitutes a record can be found at Annex A.
1.9This policy is not concerned with the disposal/retention of unused materials (e.g. stocks of paper and unused forms). Similarly, print outs of material stored in electronic systems can be destroyed after use if the electronic record is retained for future reference (for example when used in referral and Court purposes). However, staff should note that the exception would be documents that are printed solely to be signed that have to be retained .
1.10Duplicated records (e.g. photocopies of documents), are classed as records and therefore the same archiving and retention policy applies.
1.11Note, records are also Information Assets. For further information, please review the NOMS Information Assurance Policy.
Application
1.12All National Probation Service staff, contractors and third party suppliers with responsibilities for the Archiving, Retention and Disposal of non-offender information and records.
Mandatory actions
National Probation Service
1.13.Each National Probation Service (NPS) Division & Wales must assign a Local Information Manager (LIM) to assist in the operation of the policy described in this Instruction. This role is not a post in itself and has been identified as a responsibility within the Divisional Support hub. A description of the responsibilities of a LIM can be found at Annex E.
1.14In addition to the LIM, there must be a named deputy to the LIM to provide cover when the LIM is absent. The LIM function is required during normal working hours – 24/7 cover is not required. For staff with job share arrangements, steps should be taken to make arrangements for suitable sharing to ensure the LIM role is fulfilled.
1.15In order to confirm that these requirements have been met a compliance statement must be completed and returned to the NOMS Information Policy and Assurance team. Further information and a template document will be provided to LIMs.
The compliance statement must contain the following details:
i)Name and contact details of LIM and deputy
ii)In respect of paper records – for each entry in the Information Asset register:
- details of registered files held; and
- how these are managed in accordance with this instruction.
iii)In respect of electronic records – for each entry in the Information Asset register:
- details of the main types of document held; and
- where they are held. If any process of archiving or destruction is in place, this should be specified.
Local Information Managers
1.16The role of a LIM is to ensure effective archiving and retention of records. The LIM must ensure that regular reviews of files/records take place. During this review the LIM must adhere to the prescribed retention schedules as detailed from Annex D onwards. Any records no longer required must be disposed of and the destruction log completed.
1.17The LIM can act as the overall co-ordinator by developing a network of supporting LIMs at offices within the NPS divisionto whom they can delegate the operational aspects of this function. However in doing so they must ensure that any such member of staff is fully conversant with this Policy and is also familiar with the operational requirements of the Service in relation to document retention/disposal.
1.18Any LIM or person involved with the review and disposal and destruction of records must complete the destruction log (detailed at Section 3.3 of this document). If designing an electronic destruction log, the LIM must ensure the log is designed to the standards detailed at Section 3.3 below.
1.19The Information Asset Registers now include retention schedules. LIMs are required to liaise with the local Information Asset Owners) to complete the appropriate retention schedule for any assets that are not identified in this PI. Guidance and support will be provided to LIMs and IAOs in the completion of this task.
1.20The LIM is responsible for determining (in accordance with the Retention/Disposal protocol) whether to retain or dispose of specific documents that properly fall within the remit or control of his/her function. Each LIM should be conversant with the types of documents received, generated and stored in his/her business function in order to carry this out.
1.21Because of the clear benefits resulting from the disposal of unnecessary documentation, the LIM is expected to be proactive in carrying out audits of existing documentation that may be suitable for disposal.
Completing the Destruction Log
1.22It is the responsibility of the LIM (or designated member of staff) to complete a destruction log.
The log should detail:
- The date and method of disposal
- The officer who authorised disposal
- The justification for disposal, with reference to the policy document and relevant schedule
1.23In the case of personal data, the destruction log must include the individual’s name or employee/NI number and Date of Birth and marked accordingly as to the level of security that the records are marked at.
1.24The destruction log must be retained for 20 years from the date of the first entry on the log
1.25The destruction log must be kept locally by the LIM in a secure place, and must be produced when requested by Audit or other regulatory body.
1.26The log can be held in a paper registered file or can be held electronically. If the log is to be held electronically and designed locally, the LIM must ensure that the destruction log and procedures for its management are designed as set out below.
- The appropriate access levels are allocated
- The log provides the audit trail of the destruction
- The procedures ensures the integrity and security of the destruction log
- The log maintains an accurate representation of the destruction
- The log is secured from alteration once the destruction is declared
- Adherence to the procedures must be able to be demonstrated
- The LIM must ensure that steps are taken to ensure that the media format does not become obsolete. The National Archives provides guidance on digital preservation.
- Consideration should be given to including destruction logs in the business continuity plan.
1.27Further information in this respect is provided by The National Archives in their guidance: Management, appraisal and preservation of electronic records.
As far as possible, procedures should be adopted that conform to BS 10008:2008
Evidential weight and legal admissibility of electronic information.
Resource Implication, Audit and Compliance
1.28There is a resource requirement on NPS to ensure a LIM is appointed . This role is not a post in itself and has been identified as a responsibility within the Divisional Support hub. The LIM will need to spend time monitoring and reviewing local processes. The review frequency will be determined by the local management plan and detailed in the compliance statement.
1.29Exemplar compliance statements will be developed and made available to LIMs.
1.30 The return of compliance statements will be monitored and reports provided to NOMS
Senior Management.
1.31The NOMS Information Policy and Assurance Team is considering ways in which greater support can be provided for the filing and management of records. Further information will be provided in due course.
(Approved for publication)
Ben Booth
Director of Information & Communications Technology, NOMS
2Review and Disposal Protocol
Review
2.1In Records Management terms, ‘Review’ is the appraisal of documentation to establish what action should be applied to that record, for example whether the record should be destroyed, retained for a further period or transferred to an archival service.
2.2The review of all types of record must be carried out on a regular basis. The purpose of the review is to ensure that the records are being retained in line with the appropriate schedule and that they are disposed of at the correct time in line with our legal obligations.
2.3Where a retention period has expired in relation to a particular record a brief review should be carried out before a final decision is made to dispose of the record. This PI is intended to keep resource commitment to a minimum.
2.4If records are reviewed following correct retention schedules, where the LIM (or designated staff member) is familiar with the contents or where the contents are straightforward then such an exercise may only take a few minutes.
2.5Any review to decide whether to retain or dispose of a paper document or file (as defined by annex A) should be taken in accordance with the retention/disposal protocol. This protocol consists of:
- The key disposal/retention considerations criteria checklist set out in Key Considerations (Annex C). Essentially no document should be disposed of unless all these have been considered in relation to the document.
- The Retention Schedules are contained in Annex D (and subsequent Annexes). These schedules provide guidance on recommended and mandatory retention periods for specific classes of records. This includes The National Archives guidance on retention schedules for Projects and Programmes, of which an extract can be found at Annex H.
2.6LIMs are requested also to refer to the IT Security Policy and the Government Security Classification Policy when considering disposal and destruction and also retention of records to ensure issues such as security markings and data handling are considered.
2.7Disposal and Destruction
2.8Disposal in Records Management is the follow on action from ‘Review’. It is the direct result of a review that concludes a record has reached its expiry date.
2.9Destruction in Records Management terms means the irretrievable destruction of records.
2.10Destruction of records can be achieved by a range of processes:
- Restricted waste – i.e. making available for collection by a government approved supplier
- Physical destruction on site (paper records - shredding)
- Permanent deletion (in a way that is not recoverable)– where electronic records are concerned
2.11LIMs should take into account the following considerations when selecting a method of disposal and/or destruction:
- Under no circumstances must paper documents containing personal data or confidential information be simply binned or deposited in refuse tips. To do so could result in the unauthorised disclosure of such information to third parties and render NPSliable to prosecution or other enforcement action under the Data Protection Act. Such documents must be destroyed on site (e.g. by shredding) or placed in the specially marked “Restricted Waste” containers/bags.
- Deletion – the Information Commissioner has advised that if steps are taken to make data virtually impossible to retrieve, then this will be regarded as equivalent to deletion. In the case of all electronic systems such as Probation Case Management Systems, OASys, IAPS, HR Data Warehouse and local systems, to meet the business requirement only specific users (system administrators) will be able to 'hard delete' information. Information regarding hard deletion of electronic records can be found in the IT Security Policy and the Government Security Classification Policy
- Recycling – wherever practicable disposal should support recycling in-line with MoJ’s commitment to sustainable development and alternative waste disposal strategy.
- A corporate pro-forma for documenting disposal can be found on the Information Assurance team webpage or can be obtained from the NOMS IPA Team.
2.12Any Authority Information/record held in paper form that is selected for destruction must be removed in Restricted Waste containers/bagsand be disposed of by a competent SEAP security cleared operator or appropriate device e.g. cross cut shredder compliant with the Government Security Policy Framework (SPF).
2.13Documenting the disposal of records is a statutory requirement under various pieces of legislation, such as FOI, DPA and PRA.
2.14Disposal and destruction of electronic records
2.15Record Retention and Disposition Schedules (RRDS) apply to records in whatever format they are created/held. Therefore electronic records need to comply with the same legislation and retention schedules as paper records. Generic guidance is provided below. More detailed guidance on electronic record handling will be provided in due course.
2.16For national computer systems such as National Delius, OASys, and IAPS, automatic archiving and prompting for review of material is planned. User action will be required to confirm deletion. NOMS is responsible for developing these archiving solutions and relevant retention schedules will be published in an update to this Instruction.
2.17For any other system such as OMNI, SharePoint datamay be held which is not part of the national set and can be held in lotus notes and databases (for example HR, Finance, and procurement information). Users therefore will be required to follow appropriate retention schedules as detailed in the subsequent Annexes of this Instruction.