Script for 
Public Records (Scotland) Act 2011 
Implementation Surgeries 2012

Introduction

We should start by considering the aims and the background to the Act because it does us no harm to remind ourselves of where this all comes from. 

Improving Record Keeping in Scotland

The aim of the new public records Act is to improve record keeping across Scotland, but to do so by allowing public authorities to address identified weaknesses within current provision. Crucially, it seeks to do this by encouraging continuous improvement and not by seeking instant success or a quick fix. Those of you who have worked in the information and records management profession for any time will know there no such thing as a silver bullet solution to the issues we all face. 

It is important also to remember that we’ve been languishing under a very weak piece of legislation in the shape of the Public Records (Scotland) Act 1937 for over 70 years. We have a history of poor records legislation and direction and this new Act is not about to turn that situation around overnight.  So, we must plan for long term success. 

It is also important to remember that Ministers are very keen that the Act does not place additional unreasonable burdens on authorities, and the Keeper has been charged with implementing the Act with that in mind. 

This further strengthens the case for improvement over time rather than prescribed change or rushed solutions that often don’t get to the heart of the problem and in the end fail to deliver lasting solutions. For all these reasons the Keeper will manage the Act to enable continuous improvement and set us the goal of working towards a culture that better values public records. If over the next years the Keeper discovers he or she increasingly has to force change then the Act is not working. 

The impetuous for the Act, and the imperative for continuous improvement, comes very largely from the Shaw Report. 

Shaw Report 

The Shaw Report (The Historical Abuse Systemic Review of Residential & Children’s Homes in Scotland 1950 – 1995) was an unlikely source for a new Public Records Act.

Shaw was charged with investigating the regulatory framework for looked-after children in light of claims of abuse suffered by children that had been in care. 

He found serious failings in a number of key areas. But crucially for us, he recorded how his own investigations were hampered by poor record keeping across the sector. He identified thousands of records as having been created but then destroyed, or lost, due to inadequate law and poor records management.  

Also, he found that many former residents were unable to access their own vital records, and were therefore denied knowledge of their formative years. 

Those of us who have been sheltered from the experience of being looked after by the state cannot begin to imagine what it’s like not to have a firm understanding of your own past, your family, friends, community, a sense of place. It is one thing to believe that records did not exist; quite another to learn later in life that records did exist that would have illuminated some vital areas of your childhood experience but were lost or destroyed due to a lack of care or concern. 

The inference is that not only were the records considered unimportant, but the lives of the vulnerable children represented in the files were unimportant. 

Former residents, and particularly those who have suffered abuse at the hands of their carers, consider the records, like them, were abandoned to their fate.  

It’s also important to note that Shaw’s focus was not aimed at records, yet records were at the core of his findings. In the published report at the end of Shaw’s review he devotes one chapter and a 55 page appendix to the problems of record keeping. 

Tom Shaw’s key recommendation: government should review its public records legislation.  

We wouldn’t have an Act if it were not for Shaw, but the Keeper’s review of public records legislation in Scotland, which followed Shaw, provided Ministers with evidence that record failings in the public sector went beyond the looked after children sector.  

The Keeper’s Review of Public Records Legislation 

The impact Shaw had in government circles is reflected in the statement made by the Minister for Children and Early Years (Adam Ingram MSP) to the Scottish Parliament in Feb 2008.  

It began a process of review of the legislation driven by Government and backed by cross-party recognition of a need for change. The review was to be wide ranging and not restricted to the child-care sector.

The Keeper’s review was conducted over 18 months and published in Oct 2009. 

Evidence was gathered from a variety of sectors, including child-care, information governance, social work, police, records managers and archive professionals, and scrutiny bodies.  

Consultants ran focus groups, structured interviews, online and telephone surveys. Also an expert advisory body was established and consultation meetings were arranged, including with former residents and survivors of abuse. 

The review looked at other public records legislation, both at home and overseas, in particular the New Zealand Public Records Act dated from 2005.

The conclusion was that change was required. The existing legislation was not fit for purpose, which the sector probably knew anyway! It was considered by all to be seriously out of date, too narrow in scope and simply no longer relevant. More significantly, however was the view that the 1937 Act was not just failing to help with progress; it was actually contributing to the record losses identified by Shaw. 

Scottish Ministers introduced a Public Records Bill to Parliament in October 2010 and the new Act was passed with the unanimous support of Parliament on 16 March 2011. 

Key Priorities

The moral argument for change was powerful, but ultimately the new Act is about good governance and improving efficiency across public services. Information management is crucial to all organisations and reliable information depends on good records.  While the new Act cannot put right what went wrong in the past, it can help avoid the same problems in the future.  

The Public Records (Scotland) Act goes some way to meeting the aspirations of former residents and survivors. And it will address many of the issues raised during the Keeper’s review with regard to weak legislation and poor direction.

Importantly, whilst Ministers agree that the Act is about changing the culture of record keeping in the public sector, we need to find a way to do this while remaining mindful of the difficult financial situation we all find ourselves in.  

It would therefore be fair to say that the Act will best achieve its goals through collaborative working; by pointing to current guidance and by building upon existing best practice, and advocating improvement over time. 

There is a body of good practice that currently exist across the public sector in Scotland.  The challenge for us is to ensure that we draw on this good practice where it exists to advise and guide others to improve their situation without ‘reinventing wheels’ and thereby help protect valuable resources. 

So what does the Act demand of us?

What must we all do?

We should all know by now that the Act requires named public authorities to submit a records management plan for the agreement of the Keeper. Authorities are required to have regard to the Keeper’s model records management plan and guidance which was published on 10 August this year. 

The Model Plan and Guidance was developed in collaboration with a stakeholder forum set up by the Keeper to consider all the issues. 

The Forum consisted of over 40 bodies from the public and private sector and it spawned smaller working groups to consider issues of particular concern or interest, like contracting out of public functions to private or voluntary bodies. The Forum also had an online presence and encouraged stakeholders to air views this way and in so doing inform the broader debate. We also took lots of suggestions over the phone or by email. 

The result was the recently published model plan consisting of 14 elements and relying on a guidance document that seeks to explain the elements and point to relevant advice on what’s required. 

Tom Shaw Statement

The Keeper recognises that we are all at different stages of compliance and he does not expect all named authorities to be completely in compliance with the Act by January 2013. Real improvement over time is the goal. 

In this respect it is important to remember that the Keeper is free under the Act to agree a reasonable improvement programme if it is submitted as part of an RMP. 

We would encourage colleagues to engage with a self assessment mechanism, like the SCA ARMS model. The Keeper has endorsed the SCA ARMS model, because it is a Scottish solution, developed by professional colleagues from across Scotland, to fit our Scottish RM context. It is aimed primarily at Local Authorities, but has wider application. There are other models that can be followed and the Keeper will view any robust model favourably, if it helps an authority determine where it is now in the matter of records management provision and where it aspires to be. The honest acknowledgement of this gap and a determination to close it will be good for the business of the authority and as such will be considered ‘good records management practice’ by the Keeper.  

If the Act is to be successful in installing an ethos that appreciates the value of records in Scottish public authorities, then we must take a long term approach. Honest, up-front assessment followed by continuous improvement is the answer, in our view.

Tom Shaw said in his report that trust is essential to democracy, more so where vulnerable people are concerned. As a society we assume that, when we need to, we can access the records which provide evidence of how government actions impact upon us as individuals and contribute to our protection and community well-being. When record keeping fails, that trust is broken, sometime irretrievably so. This Act marks a new beginning for us in Scotland and a chance to build trust. 

Practicalities

Now: What happens next?

The Keeper will invite public authorities to submit their records management plans for agreement.  He can do this anytime after January 2013 when the Act comes fully in to force.

Timetable

The Keeper has no intention of inviting all 200 plus separate public authorities to submit their plans at once!

Although an invite will be coming to all scheduled authorities, there is no need to panic; you will not have to have a complete plan ready to go in 3 months time.

We have already gone on record saying that the first public authority to be invited in this way will be The Keeper of the Records of Scotland and the Registrar General. 

After that one, the order of submissions and the timetable is still fluid. One of the reasons for this is that there have been intimations that some public authorities will be ready to submit in spring of next year and would like to go sooner rather than later. We are entirely sympathetic to that idea. In fact it would be faintly ridiculous for the Keeper to refuse to take records management plans when they are available and insist on bringing them in a certain order. The point that has been made repeatedly through this process is that the Keeper is not trying to catch authorities out. He wants this process to work. To this end, if an authority wants to volunteer, this would potentially give the others more time to work on theirs and we are all in favour of this idea. 

Of course, because the Keeper has no idea how many ‘volunteers’ he is going to get, or how long it will take him to assess and agree their plans, it is not possible for the implementation team to give an indication when they will be getting to each authority.  Only that they will be getting to them and that if you can get the resources to put a records management plan in place as soon as possible you should do so. Remember that, putting the requirements of the Public Records Act to one side, implementing a robust records management plan is a good thing in itself (that’s the point of this whole process) and should be done as soon as its is ready.

So how does a Scottish Public Authority create a records management plan?

On 10th August this year the Keeper published his model plan. This is not a template to be filled in. Rather it is an annotated list of the fundamental ingredients that the Keeper thinks should appear in a robust records management plan.

14 Elements

There are 14 of these elements and I would like to go through them now.

Management, policy and classification

1. Senior management responsibility

The single most important part of a records management plan is that it can be implemented.

To ensure this can happen we need to see that the CEO has authorised it to be rolled out through the organisation. This is probably best done by a covering letter submitted with the plan.

2.  Records manager responsibility

We need to know that the authority has somebody responsible for implementing the plan. This is the person that the Keeper could call with records management queries or who the staff of the organisation knows is their records management ‘expert’. This does not have to be a full time records manager.  This does not have to be someone with a formal RM qualification, and of course some authorities may have more than one person, in post, but the Keeper does need a name.

3. Records management policy statement

This refers to an authority’s formal records management policy document that should be available to all staff and possibly publicly published. Imagine a public authority wanted to include information about it’s stance on the importance of accurate and appropriate record keeping in an information pack for a new employee.  The records management policy statement would be that document.  It must carry the authority of the CEO or a similar senior accountable officer.

4. Business classification

We need to see that a public authority has a sense of the departments that are actually creating records. We know is complicated by a multitude of corporate re-organisations and spin-off companies. We do not need to know, in a business classification, the details of every record created, how much space they take on servers, who has access, which officer has ownership etc etc. We do need the business classification to be wide.  That is to say it needs to cover the whole of the organisation.

Of course, if you have a full information asset register, containing very detailed information, the Keeper would be delighted to see it. However, the business classification required would not have to be this complex. It should, however, show all the functions of the authority and the records generated by each function, either as a hierarchal departmental model 

Hierarchical

or a functional spreadsheet 

Functional

or possibly as a series of separate folders.

Separate

At this point in the development of a records management plan many will be considering what functions the authority contracts out and the provisions in place to safeguard records being created on the authority’s behalf. This is specifically mentioned in the Act. It will be necessary for an authority to satisfy itself that its contractors operate appropriate records management systems. 

The evidence for this, from the Keeper’s point of view, will be the contractual arrangements under which a function is supplied by a contractor. The Scottish Council on Archives (SCA) has agreed to host a model contract clause on its website. This clause refers to responsible record keeping and could be inserted in an invitation to tender document.

The Keeper does not need to see every such contract the authority is part of; just a sample to show the provisions insisted upon. For future contracts the Keeper would expect explicit mention to be made of records management provision, but he can not insist on this retrospectively.

For example the business classification of the SG might include the following statement.

Contracting out

Under Childcare we have a function of operating a panel of persons to safeguard the interests of children, commonly known as the Safeguarders Panel. This function is operated by Children 1st on behalf of the Scottish Government.* 

SG is satisfied that the records management provision of the charitable organisation Children 1st is suitable for the demands of security, 

*Copy of contract between SG and Children 1st (redacted) attached.

Retention and security issues

5. Retention schedules

This obviously ties into the business classification. For each type or records created in element 4, there should be a retention or review period. Again the Keeper does not need a list of every type of record and an authority could create a retention schedule that is quite high level. In a very basic example the Finance Department of a public authority creates financial records in its two branches and holds contracts in one.

The retention schedule can state that financial records type 1 are held for 6 years then destroyed financial records type 2 are held for 75 years and contracts are held for length of contract +10.

The above example is a very basic retention schedule.  The Keeper can, of course, agree a more complex one.

6. Destruction arrangements

The key here is the word ‘arrangements’. This element is not about what records an authority destroys, but about how it does it.  

This is a compulsory element mentioned specifically in the legislation. Public authorities must have some record destruction system in place.

To prove this to the Keeper, you should submit contracts, destruction certificates, receipts or any other relevant paperwork that shows the appropriate destruction of records is taken place.  For electronic records we would need to see the instructions issued to staff that make sure digital material is permanently deleted from the system. This may include ensuring that the IT department undertakes a purge of any quarantine areas or other hidden storage where ‘deleted’ files are kept. 

For the Public Records Act, and to properly respond to Freedom of Information requests and for Data Protection subject access enquiries, it is vital that an authority has firm proof that all copies of information have been destroyed in an irretrievable way.  

7. Archiving and transfer arrangements

All public authorities will be required to have appropriate archiving arrangements in place to properly expect the agreement of the Keeper. Proof of this may be contracts, memoranda of understanding, deposit receipts or similar documentation. 

Again, the Keeper does not want a list of everything that an authority has chosen keep for permanent preservation, just that arrangements are in place. Newer authorities may not have made any such deposit as yet, but the Keeper would expect a system to have been considered that will operate when and if such a deposit is deemed suitable.

Security of records in transit should be part of formal archiving arrangements.

8. Information security 

How are your electronic systems protected from public access miss-use? Your IT department may have to provide you with their policy on this.  Is there evidence that the security aspects of ‘cloud’ computing have been properly assessed by authorities who are embarking in one of these, increasingly popular, projects.   

How are paper files stored safely?

What policies are in place regarding the way that the staff of your authority uses records?  Are there access controls on certain document types (please do not provide specifics that might compromise business security). Again these controls would probably be supported by policy documents.

The Keeper would be expecting to see these policy documents and IT specifications.

9. Data protection 

This is another policy document one. Here the Keeper is looking for proof that an authority understands the importance of data protection legislation. This may be in the form of a data protection or privacy policy statement or something as simple as proof that the authority has registered with the Information Commissioner. Registration with the ICO indicates that your organisation is familiar with the principles of data protection. 

DP Sample

When the National Records of Scotland (NRS) hands out a new readers’ ticket in the search room we also hand out a two page document about responsibilities under the Data Protection Act. This document could be submitted as evidence that NRS considers data protection requirements as part of its everyday business.

Continuity, Audit, Competencies, Assessment and Record Sharing

10. Business continuity and vital records

The Keeper considers that authorities that hold public records should have in place systems to deal with an unexpected interruption in their business and expects to see policies that support this system. 

This recovery strategy should include the early identification of ‘vital’ records, those without which the business could not practically or legally operate. 

Apart from the PRSA expectation, a vital records policy and business continuation plan is encouraged as sound business sense. 

11. Audit trail

Once records are created and stored it is clearly vital that they can be found!

This element is for you to tell the Keeper how you locate a document particularly if it has been moved from one server to another or has been withdrawn by a member of staff. 

If there are policies in place that restrict the movement of records around a system, the Keeper would expect to have sight of these policies.

12. Competency framework for records management staff 

The Keeper needs assurance that an authority understands that records management is a separate and specialist office function and should not just be lumped in with ‘general admin’.

That doesn’t mean that every authority needs to appoint an individual who only performs a records manager role. Nor does it mean that all staff entrusted with the task of implementing a records management plan should undertake formal post-graduate training, although the Keeper is in favour training!

The Keeper would need to see that records management is a separate objective for the member of staff in element 2. Or that the authority has recruited, or is in the process of recruiting, a member of staff whose ‘competencies’ include those relevant to the job of implementing and maintaining a records management system.

The Keeper will look favourably on a records management plan that shows that training and development for the records management role has been properly considered.

13. Assessment and review 

A records management plan should allow for periodic review of that plan and state how its effectiveness can be assessed. The Act itself allows the Keeper to revisit agreed public authority records management plans after 5 years, but it would be healthier for an authority to schedule such reviews in-house. The Keeper need not be involved in these in-house reviews, but he has pointed to several self-assessment tools in his Guidance Document that might help.

If your records management plan review results in changes we would expect to be informed in order to keep the authority’s details up to date.

14. Shared information 

The Scottish Government positively encourages information sharing across the public sector when it benefits society in general. If your authority is not currently sharing information then it is very likely that you will be doing this in the future. An authority’s records management plan must indicate what safeguards are in place to ensure that information will be shared lawfully and securely. It will for example include reference to Information Sharing Protocols (ISPs).  Policy documents, protocols, agreements and other information sharing documentation should be submitted as evidence that this aspect of records management is being handled appropriately. These documents should include an exit strategy from the outset that takes account of records governance.

Contact Details

These are the 14 elements that the Keeper will be looking for when he assesses a records management plan. If you have any further questions, please do not hesitate to contact us. Our contact details are as follows:

Tel: 0131 535 1418
e-mail: publicrecords@nas.gov.uk