|
1. e-mail retention REVIEW
Examen relatif à la conservation des courriels
|
COMMITTEE RECOMMENDATION
That Council receive this report for information.
RECOMMANDATION DU COMITÉ
Que le Conseil prenne connaissance du présent rapport.
Documentation
1. Deputy City Manager’s Report, City Operations, dated 22 August 2011 (ACS2011-COS-ITS-0005).
Report to/Rapport au :
Information Technology Sub-Committee
Sous-comité de la technologie de l’information
and / et
Finance and Economic Development Committee/
Comité des finances et du développement économique
and Council / et au Conseil
22 August 2011 / le 22 août 2011
Submitted by/Soumis par :
Steve Kanellakos, Deputy City Manager/Directeur municipal adjoint,
City Operations/Opérations municipales
Contact Person/Personne-ressource: Guy Michaud, Director/directeur
Information Technology Services Department / Services de technologie de l’information
613‑580‑2424, ext./poste 12880
M. Rick O’Connor, City Clerk and Solicitor / Greffier et chef du contentieux
613-580-2424, ext./poste 21215
|
SUBJECT:
|
|
|
|
|
|
OBJET :
|
Examen relatif à la conservation des courriels |
That the Information Technology Sub Committee recommend that the Finance and Economic Development Committee recommend that Council receive this report for information.
Que le Sous-comité de la technologie de l’information recommande au Comité des finances et du développement économique de recommander à son tour au Conseil de prendre connaissance du présent rapport.
Background
On February 25th, 2009, the Auditor General presented his 2008 Audit Reports to City Council, including the “Audit of Hospitality and Other Ethical Matters”. Briefly, this Audit reviewed “allegations of receipt of hospitality, gifts and/or entertainment by various City management and staff.” Part of that Audit’s methodology was to review staff e-mails and calendars from November 2007 to February 2008. However, the City’s practice of purging “transitory” or “non-business” e-mails older than 90 days was viewed as a limitation on the scope of the Audit. In Motion 61/4, Council issued the following directives with respect to the Audit of Hospitality and Other Ethical Matters:
The issue of reviewing the current e-mail retention has appeared in two other audits issued by the Office of the Auditor General. As part of the 2005 “Audit of Internet Usage and Controls”, the following recommendation was put forward:
Reccommendation 11
That Information Technology Services review the retention periods for e-mail (including deleted e-mail) and compare to use of this data as corporate records and industry best practices.
Management Response
Management agrees with this recommendation.
The retention period for e-mail was reviewed against federal, provincial and municipal legislation prior to approval of the Records Retention and Disposition By-law approved by Council and the Records Management Policy in 2003. Automated retention rules for e-mail were implemented as a part of an upgrade to the Exchange Server product in September 2005, to ensure compliance with this by-law and policy.
In 2008, the “Audit of an Allegation of Blogging on City Time” set out the following, similar recommendation with respect to the 90-day retention period for e-mails:
Recommendation 8
That the City change its ITS retention period of purging all e-mails older than 90 days and change the retention period to two years which represents the statutory limitation period.
Management Response
Management agrees with this recommendation.
In accordance with Councillor McRae’s motion related to the 2008 Hospitality Audit tabled in November 2008, the ITS department had included these changes in its workplan for 2009, with a view to presenting the revised policy to Committee/Council in the early fall of 2009, following review by Executive Committee/Senior Management Committee. However, Legal Services has advised IT Services that as a result of litigation before the Divisional Court, the two-year e-mail archive should not be implemented until the court case has concluded and the decision of the Divisional Court regarding MFIPPA and personal employee e-mails has been rendered. Divisional Court will likely hear this matter either in late 2009 or in 2010, at which time the revised policy will be considered. In the interim, IT Services is proceeding with the costing of technology solutions, which will enable the policy to be implemented.
Therefore, the purpose of this report is to respond to Recommendation No. 2 of Motion 61/4, as well as the two other OAG recommendations with respect to the City’s retention period for e-mails.
Litigation Delay
As noted above, Legal Services recommended that no policy changes be considered in this instance until the outstanding litigation related to employee e-mails at the City was finalized.
At that time, the City was in the process of seeking a judicial review in Divisional Court of an order from the Information and Privacy Commissioner of Ontario (IPC). In that instance, the IPC found that personal employee e-mails housed on the City’s server were subject to the Municipal Freedom of Information and Protection of Privacy Act (“MFIPPA”) and, therefore, could be the subject of access to information requests by third parties. The City has previously decided that such personal e-mails, which did not pertain to City business and did not engage any City interests, were not within the custody or control of the City and, thus, were not within the scope of MFIPPA. This pending judicial review in Divisional Court was likely to clarify what legal obligations, if any, the City has with respect to managing employee personal e-mails on the City system in the context of access requests, as well as have implications on the management of information stored on the City network. For this reason, Legal Services recommended that the 2-year e-mail archive should be held in abeyance until the court case concluded and the decision of the Divisional Court had been rendered. Thus, any subsequent corporate decisions concerning the e-mail archiving system would be in line with the Court’s decision.
In December 2010, the Divisional Court of Ontario at Toronto ruled that personal employee e-mails housed on the City’s system that did not pertain to City business could not be the subject of an access to information request under MFIPPA. The Divisional Court found that the goals of the MFIPPA legislation were to enhance the democratic process and ensure public participation in government decision-making. The Court went on to observe that it was never the intent of the access to information legislation to allow third-party access to personal e-mails of employees, unrelated to City business. This type of communication was not within the scope of the Act. Consequently, however, the IPC, whose initial decision was overturned by the Divisional Court, sought leave to appeal the Divisional Court’s decision to the Court of Appeal of Ontario. In March 2011, the Court of Appeal of Ontario dismissed the motion by the IPC seeking leave to appeal of the Divisional Court’s decision. Therefore, the Divisional Court’s decision of December 2010 stands as the law in Ontario.
DISCUSSION
Part two of the motion stems from a business requirement articulated by the Office of the Auditor General to have access to email messages and calendar appointments beyond the current 90-day retention period for the purpose of audits and investigations. Any changes to the current e-mail retention periods would impact both staff and City Council, since there is a single e-mail management solution for the entire City of Ottawa.
Staff from Information Technology Services and City Clerk and Solicitor Departments reviewed the technical and policy issues associated with changes to the current e-mail management practices. The creation of a 2-year email archiving system would engage the City’s corporate responsibilities under the MFIPPA, both with respect to managing access to information requests for such e-mails and the protection of privacy obligations that the City has in respect to the e-mails in the archives, including employee’s e-mails of a non-business, personal nature.
While the City waited for the decision of the Divisional Court case, the Information Technology Services department proceeded with issuing a Request for Information (RFI) in Q1 of 2010 in order to gain an understanding of the potential costs of procuring a 2-year email archive solution. The ITS department received 17 responses to the RFI, with high-level cost estimates ranging from $250K to over $1 million dollars to implement such a solution. Further investigations of the possible solutions was put on-hold pending the decision of the Divisional Court.
In June 2011, the City Clerk and Solicitor, the Office of the Auditor General and the Director of Information Technology Services & Chief Information Officer met to discuss the requirements for a 2-year e-mail archive. At that time, it was confirmed that there was no Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), labour relations or other legal or corporate requirements for extending the e-mail archiving period from 90-days to two years. Therefore, given the consensus that there is no corporate requirement, as well as the cost to implement a two year archive (estimated at between $250 K and $1M), no changes to the current e-mail management practices and associated policies are proposed.
There are no rural implications associated with this report.
Consultation has taken place between the City Clerk and Solicitor, the Office of the Auditor General and the Director of Information Technology Services & Chief Information Officer.
LEGAL IMPLICATIONS
There are no legal impediments to implementing the recommendation of this Report. The City’s present Records Retention and Disposition By-law, By-law No. 2003-527 (as amended) already requires that all Official Business Records (including e-mails) of the City be retained for the requisite retention period noted in the By-law. This requirement effectively ensures the retention of any records, regardless of format and including e-mails, that commit the City to an action, document the City’s obligations or responsibilities, relate to the accountable business of the City, have legal status for purposes of establishing a fact or providing conclusive information, or are registered in the City’s records management system. Retention periods prescribed in the By-law take into account legal limitation periods as well as other legislative or operations requirements for records retention, thereby ensuring that important records of the City are available for any uses that are reasonably foreseeable. Given these retention obligations in this By-law, it does not appear that a two-year e-mail archiving initiative is required at the City for either legal, corporate or MFIPPA reasons.
There are no financial implications associated with this report.
Technology Implications
There are no changes to the current configuration of the City of Ottawa’s email system proposed in this report.
The City Operations Department will action any direction received as part of consideration of this report.