Virginia State Laws on Optical Images

red1

State Archivist and Records Manager:
Conley Edwards, Acting State Archivist

804-225-3889 fax: 804-371-2617

[email protected]

Nolan T. Yelich, State Librarian

The Library of Virginia

11th St. at Capitol Square Richmond, VA 23219

804-786-2332 fax: 804-786-5855

[email protected]

Richard M. Harrington, Information Imaging Branch Mgr.

804-786-3078 fax: 804-371-2617

[email protected]
the direct address is:

[email protected]

red2

THE LIBRARY OF VIRGINIA

GUIDELINES FOR MANAGING ELECTRONIC RECORDS

Introduction

The State Library Board has been given the responsibility of

regulating the creation, preservation, storage, filing,

management and disposition of all records, including

electronic records. These duties are expressly outlined in

Sec. 42.1-82 of the Code of Virginia. Under Sec. 42.1-85,

each agency or locality is required to cooperate with The

Library of Virginia (LVA) in the implementation of

procedures regarding the management of public records.

This document is designed to provide comprehensive guidance

for the management of electronic records. If you have any

questions about these guidelines or any records management

matters, please contact the Records Management Section at

(804) 692-3600.

Other pertinent publications include:

“A Manual for Public Records Management in the

Commonwealth of Virginia”, 1992, The Library of Virginia.

“Maintenance, Retention and Disposition of Electronic

Public Records – Guidelines”, 1991, The Library of Virginia.

“Maintenance, Retention and Disposition of Public

Records on Optical Disk – Guidelines”, 1991, The Library of

Virginia.

“Guidelines for Electronically Filed Data Including

Digital Imaging: Legal Considerations”, 1994, The Library of

Virginia.

COV ITRM Guideline 91-2, “Imaging”, 7/8/91, Council on

Information Management.

COV ITRM Policy 90-1, “Information Security Program”,

Revised 12/9/91, Council on Information Management.

COV ITRM Standard 90-2, “Contingency Management:

Procedures for Development, Implementation, and Review”,

12/14/90, Council on Information Management.

COV ITRM Standard 91-1, “Information Security”,

12/9/91, Council on Information Management.

“Virginia Public Records Act”, Sections 42.1-76

through 42.1-91 of the Code of Virginia.

“Virginia Freedom of Information Act” Sections 2.1-340

through 2.1-346.1 of the Code of Virginia.

“Privacy Protection Act of 1976” Sections 2.1-377

through 2.1-386 of the Code of Virginia.

General Records Retention and Disposition Schedules

published by The Library of Virginia.

Definitions

The following definitions are for words as used in the

context of this publication:

Archival – refers to information having enduring

historical or research value, or designated permanent by

law.

Archives – a facility designed for the maintenance and

preservation of archival records, and for the display and

use of those records.

Archiving or Data Archiving – data processing terms

that refer to the off-line storage of electronic

information. Not the same as “archival” as used in this

publication.

Backup – the process of making duplicate copies of

active electronic records, usually for security storage at

an off-site location.

Conversion – the process of changing electronic

records from the electronic format required by a specific

program, computer, storage type or system to the electronic

format required by another specific program, computer,

storage type or system.

Data Archives – any facility used for either temporary

or long-term off-line storage of electronic records. Not

the same as “archives” as used in this publication.

Deleting – the act of removing electronic information

(data) from a record, file, database or directory. Note:

Most computer programs merely erase the electronic index or

locator for the deleted record and do not physically remove

the record from storage. In many cases deleted records can

be retrieved by special programs and security can be

compromised. See “Wiping”.

Discovery – the legal process of obtaining and

disclosing or disseminating information during legal

proceedings.

Electronic Records – information or records that are

produced, manipulated, stored or retrieved by electronic

means. This includes, but is not limited to, computer

records, audio or visual recordings, and optically scanned

records. Also known as machine-readable records.

Public Records – as identified in Sec. 42.1-77 of the

Code of Virginia, “means, recorded information that

documents a transaction or activity by or with any public

officer, agency or employee of the state government or its

political subdivisions. Regardless of physical form or

characteristic, the recorded information is a public record

if it is produced, collected, received or retained in

pursuance of law or in connection with the transaction of

public business.” “The medium on which such information is

recorded may be, but is not limited to paper, film,

magnetic, optical or solid state devices which can store

electronic signals, tapes, mylar, linen, silk or vellum.

The general types of records may be, but are not limited to

books, papers, letters, documents, printouts, photographs,

films, tapes, microfiche, microfilm, photostats, sound

recordings, maps, drawings, and any representations held in

computer memory.”

Purging – the act of removing records or parts of

records from a file or database for the purpose of reducing

file size, creating new records, or removing and separately

storing or destroying outdated, obsolete or superseded

material.

Reformatting – the process of changing the physical

format of records, i.e., microfilming paper records,

printing electronic records, or optically scanning

photographs.

Records Retention and Disposition Schedule – an

approved timetable listing types of records and regulating

their minimum retention periods and eventual dispositions.

Also called schedule or retention schedule. There are two

types of retention schedules, general schedules which apply

to common functions found in most agencies or localities and

specific schedules which apply to unique functions of an

agency or locality. Forms for ordering general schedules

are located at Appendices A & B.

Sunset Provision – the automatic removal of

confidentiality, privacy protection or other restrictions to

the access of records after a specified time period has

elapsed.

Vital Records – records absolutely needed to conduct

business the next day or to preserve the rights of the

state, its employees or its citizens. These may also be

deemed archival.

Wiping – the physical removal of electronic

information from a storage medium. Wiped records can not be

recovered by any means at all. See “Deleting.”

Storage and Preservation of Electronic Records

Electronic records present complex problems in matters of

storage and preservation. The costliest and most perplexing

problem with electronic records is preserving the ability to

access the information. An almost equally important problem is

the relatively short lifespan of electronic storage media.

Other considerations for the storage and preservation of

electronic records are:

1. Agencies and localities must either maintain the

hardware and software needed to retrieve electronic

records until the expiration of the records retention

period, or electronic records must be converted to

work on newer electronic formats, standard electronic

formats and/or another format.

2. Each agency and locality is responsible for

maintaining an inventory list of “archived” or stored

records which includes, at a minimum, a description of

records, operating requirements including

system/software documentation, media types, locations

and date due for recopying, refreshing or disposal.

3. Each agency and locality must ensure that backup

copies of vital records are made and stored off-site.

General Recommendations

In general, The Library of Virginia recommends that the

disposition of records is the same whatever the format, whether

paper, film, or electronic. If electronic records are not

already listed in paper format on general schedules or other

schedules, they must be included in a records retention and

disposition schedule written for the agency or locality

(agency/locality specific schedule). Management of electronic

records is considered as a functional part of the management of

all records.

Each agency is responsible for recopying or “refreshing”

electronic recordings scheduled for long-term retention in

accordance with the expected life of the storage medium. See

appendices C and D for specific details . Each agency or

locality also is responsible for maintaining the hardware and

software necessary to access the data until expiration of all

retention periods or converting the data into currently

available programs or other types of formats.

Each agency and locality is responsible for the performance of

routine backups of any vital electronic records. Disposal

reporting of the destruction of backup records is not required.

Each agency and locality is also responsible for including

electronic records in its disaster planning and recovery

procedures.

Since there are no national standards for permanency of the

medium on which electronic records are maintained (the medium is

not considered permanent), records in electronic formats are not

acceptable for archival storage. If or when standards for

permanence of electronic media become a reality, this policy

will be revised accordingly. Until that time, electronic

records appraised as archival must be maintained in the agency

or locality or converted to paper, microfilm or another

acceptable medium that meets national standards for permanent

archival retention before being transferred to the Archives.

Eventually, as standardization increases, technical capability

improves and fiscal constraints allow, records may be taken into

the Archives in electronic format.

Some electronic mail, is official correspondence and is subject

to the same retention requirements as all (paper)

correspondence.

Each agency or locality is responsible for thoroughly

documenting how each system producing electronic records is

operated and used. Documentation should include identifying

hardware and software, formalizing operating procedures

including file naming, updating and security

procedures,identifying sources and uses of information, and

outlining quality control procedures, audit procedures, storage

requirements and backup procedures.

When designing an electronic records system, the possible

research use and historical implications of the records must be

considered, not just the operational purpose(s).

Legal Requirements

All electronic records are subject to the provisions of the

Virginia Freedom of Information Act and the Privacy Protection

Act of 1976.

All electronic records can be used as evidence (see Sec. 8.01-

391 of the Code of Virginia).

Electronic records are subject to the legal discovery process.

If electronic means are used to produce paper original

documents, the original paper document is the preferred

evidence. If the original document has been officially

destroyed, the electronic record, if not also destroyed, is

still subject to discovery. Agencies and localities may be

required to bear the cost of converting electronic evidence into

acceptable paper copies for both sides of any legal dispute.

Agencies and localities may be responsible for establishing the

validity and accuracy of their electronic records in court.

Agencies and localities must take similar security precautions

required of paper records when destroying or reusing recording

media that contain privacy protected or confidential electronic

information.

Guidelines for

Electronically Filed Data including

Digital Imaging: LEGAL CONSIDERATIONS

Rev: January, 1996

INTRODUCTION

Both Federal and the Commonwealth of Virginia’s laws recognize the legal

status of copies made from various sources including electronic data stored

on optical disks. This recognition is stated in Virginia’s “Uniform

Photographic Copies of Business and Records as Evidence Act” 8.01-391:

If any business or member of a profession or calling in the regular course of business

or activity has made any record or received or transmitted any document, and again

in the regular course of business has caused any or all of such record or document

to be copied, the copy shall be as admissible in evidence as the original, whether the

original exists or not, provided that such copy is satisfactorily identified and

authenticated as true copy by a custodian of such record or by the person to whom

said custodian reports, if they be different, and is accompanied by a certificate that

said person does in fact have custody.

Copy, as used in this section, shall include. . .reproductions of electronically stored

data, or copies from optical disk, electronically transmitted facsimiles, or any other

reproduction of an original from a process which forms a durable medium for its

recording, storing, and reproducing.

The creation or conversion of long-term and permanent public records to

digitized images for alternative data storage raises questions about the ability

of these media to satisfy legally-mandated retention periods, access

requirements, and the admissibility in evidence. According to the “Code of

Virginia” 8.01-391 as quoted above, electronically stored data are

acceptable copies of public records provided the records were created during

the regular course of business or reproduced at a later time if done in good

faith and without intent to defraud and the records are satisfactorily

identified and authenticated by a custodian.

—————————————————————————

RETENTION PERIODS

The Library of Virginia cannot accept records for permanent storage on

digital media at this time due to the lack of hardware and software

standards. This policy does not make electronically stored data any less

legal, but does require that all digital records on optical disk meet the

requirements as stipulated in Retention, Maintenance & Disposition of

Digitized Visual Public Records, 1996, The Library of Virginia.

—————————————————————————

ACCESS REQUIREMENTS

Under Virginia’s version of the Freedom of Information Act “Code” 2.1-342,

public records not exempted by law are required to be made accessible to

any requester:

Except as otherwise specifically provided by law, all official records shall be open to

inspection and copying by any citizens of this Commonwealth during the regular

office hours of the custodian of such records. . .Official records maintained by a

public body on a computer or other electronic data processing system which are

available to the public under the provisions of this chapter shall be made reasonably

accessible to the public at reasonable cost….Public bodies shall not be required to

create or prepare a particular requested record if it does not already exist. Public

bodies may, but shall not be required to, abstract or summarize information from

official records or convert an official record available in one form into another form

at the request of the citizen. The public body shall make reasonable efforts to reach

an agreement with the requester concerning the production of the records

requested. Failure to make any response to a request for records shall be a

violation of this chapter and deemed a denial of the request.

Areas of concern regarding access to electronically stored data and digital

public records are: 1) segregating exempt and nonexempt information, 2)

providing long-term access, 3) ability to make copies.

Digital images can store information exempted from public disclosure on the

same media as information open to public access. In many forms of imaging

media such as WORM optical disks or CD-ROM systems, it may be

impractical to retain separate systems for data which is privacy protected

and that which is open to the public. A brand new disk would have to be

created by copying on to it only the information open to the public (this disk

would be used for public access and the original disk would be retained as

the office use copy only), a paper printout of only the requested information

could be made or a software solution could be used which allows certain

fields or records to be masked from view or access can also be restricted by

limiting the database index to only the records which are open to the public.

However, whatever solution is used must maintain the integrity of the record

and ensure that the material exempted from disclosure is not either

inadvertently or intentionally made available.

Records custodians are committed to providing access to these records for

as long as they are required to be maintained as stated in the retention and

disposition schedules authorized by the Library of Virginia. Digital imaging

and optical storage technologies are still relatively new. Hardware, software,

and storage media change frequently and national standards do not cover

most imaging system components. Custodians are required to transfer

information from current or old systems to new ones in order to ensure

accessibility of that information. This requirement ensures that records are

not lost before their retention periods are met or their usefulness has ended.

Custodians who are committed to public access must ensure that copying

policies are fair and equitable to all requestors, including those without

access to technology or technological knowledge. Records custodians may

make copies of records in a requested form if the record already exists in

that form or can be easily made available in that form. Electronically stored

data and optical storage media provide for copies to be produced in paper,

magnetic, as well as optical formats, making it easier to provide a record

copy on a media acceptable to the requester. In optical or magnetic form,

the data may be meaningless without the proper hardware and software to

read it.

—————————————————————————

EVIDENCE REQUIREMENTS

Although the “Code of Virginia” explicitly states that electronic and optical

image copies have the same legal status as any other original records,

certain precautions reduce the chance that these electronically stored public

records will be challenged as evidence.

There are several basic issues on which the legal acceptance of electronically

stored images may be challenged: 1) the relevance of the information to the

case, 2) the accuracy of the information offered as evidence and 3) the

creation of the public record by a public agency during the regular course of

business. The final arbiter of both one and two is the presiding judge.

However, in the second issue concerning accuracy, by following certain

practices the evidence can be demonstrated to be accurate to the

satisfaction of most judges and legal counsel.

These practices are:

1) Operations which create the public records are part of the daily routine

of business

2) A procedural manual is created which describes how the information

is imaged, maintained, retrieved and stored. The system’s hardware

and software characteristics should be fully documented. The

documentation should indicate the type, brand names, and model

numbers of all hardware components including recording media which

are used in the system together with the dates that specific

components were put into or taken out of service. Technical

specification sheets provided by vendors will typically provide

sufficient detailed information to satisfy documentation requirements.

Documentation should also include a description of all systems

software and application programs used in document imaging. The

software descriptions should indicate version numbers and

implementation dates for all software upgrades. If application

software was developed on a customized basis, flowcharts, source

code, and other developmental documentation should be included.

Document scanning, data entry, and quality control procedures should

be fully documented for each optical storage application. Written

instructions shall be prepared for operators of all equipment used in

document scanning, index data entry, and image inspection. Periodic

training and routine checks should be instituted by managers to ensure

that the procedures are known and being followed.

3) Access control procedures, such as password protection and privilege

authorization, should be fully documented. A list of all users and their

access privileges should be maintained and audited regularly. The list

should differentiate users who are authorized to record or edit images

from those who can only read or retrieve them. If changes are made

to documents stored in an imaging system, those changes should be

recorded on a list along with the person who performed the change

and reasons for doing so.

4) An audit should be performed periodically which includes a review of

all informational changes, practices, and system security.

5) Copies made from the system are verified against the original image

and can be authenticated by the custodian of the records or the

system administrator.

6) There is at least one person designated as the system administrator

with responsibility for system operation. This person would be able

to give knowledgeable testimony about the system if required in a

court of law.

7) The imaging system is periodically checked for meeting all relevant

national and state standards.

Properly designed, implemented and maintained information technology

systems are capable of producing records that are more reliable and accurate

than paper-based systems. By following these practices, copies made from

an imaging system or the original electronically created record itself will

stand an excellent chance of being accepted as evidence in legal

proceedings.

—————————————————————————

Additional information can be obtained by purchasing the following technical

reports:

“Performance Guideline for the Legal Acceptance of Records Produced by

Information Technology Systems: Part I: Performance Guideline for

Admissibility of Records Produced by Information Technology Systems in

Evidence” (ANSI/AIIM TR31-1992).

“Performance Guidelines for Acceptance by Government Agencies of

Records Produced by Information Technology Systems: Part 2: Acceptance

by Federal or State Agencies” (ANSI/AIIM TR31-2 1993)

“Performance Guidelines for the Legal Acceptance of Records Produced by

Information Technology Systems: Part 3: User Guidelines” (ANSI/AIIM

TR31-3 1994)

“Performance Guideline for the Legal Acceptance of Records Produced by

Information Technology Systems Part 4: Model Act and Rule” (ANSI/AIIM

TR31-1994)

These four technical reports are available for $30 members, $39

nonmembers from:

Association for Information and Image Management

1100 Wayne Avenue, Suite 1100

Silver Spring, Maryland 20910-5699

Tel: 301 587-8202

Fax: 301 587-2711

Association for Information and Image Management (AIIM) International Home

Page

Other pertinent publications which can be obtained from the Library of

Virginia or from the State Council on Information Management (CIM) include:

The Library of Virginia

“Guidelines for Managing Electronic Records”, The Library of Virginia,

1994.

“Maintenance, Retention and Disposition of Electronic Public Records –

Guidelines”, 1991, The Library of Virginia.

“Retention, Maintenance & Disposition of Digitized Visual Public

Records”,

1996, The Library of Virginia

“Virginia Public Records Act”, Sections 42.1-76 through 42.1-91 of

the “Code of Virginia”.

Council on Information Management

COV ITRM Guideline 91-2, “Imaging”, 7/8/91, Council on Information

Management.

COV ITRM Policy 90-1, “Information Security Program”, Revised

12/9/91, Council on Information Management.

COV ITRM Standard 90-2, “Contingency Management: Procedures for

Development, Implementation, and Review”, 12/14/90, Council on

Information Management.

COV ITRM Standard 91-1, “Information Security”, 12/9/91, Council

on Information Management.

RETENTION, MAINTENANCE & DISPOSITION

OF DIGITIZED VISUAL PUBLIC RECORDS

Rev:1/96

Information contained in public records must be accessible

for administrative, fiscal, legal, and historical purposes.

It is the responsibility of The Library of Virginia to

develop and monitor the adherence to policies which ensure

that public records are accessible, protected and preserved

for future generations. Under the Virginia Public Records

Act, Code 42.1 et.al., the definition

of a public record is:

…recorded information that documents a transaction or

activity by or with any public officer, agency or

employee of state government or its political

subdivisions. Regardless of physical form or

characteristic, the recorded information is a public

record if it is produced, collected, received or

retained in pursuance of law or in connection with the

transaction of public business.

The medium on which such information is recorded may

be, but is not limited to paper, film magnetic, optical

or solid state devices which can store electronic

signals, tapes, Mylar, linen, silk or vellum. The

general types of records may be, but are not limited to

books, papers, letters, documents, printouts,

photographs, films, tapes, microfiche, microfilm,

photostats, sound recordings, maps, drawings and any

representations held in computer memory.

With increasing frequency, digital technology is being

utilized to create, capture and store public records. A

digital record can be text in a binary code like ASCII,

scanned images in a bit-mapped form, sound or video. A

digitized record is the product of a computer imaging

system which captures a record by scanning or by creating

it as binary code which is translated by the computer into

human readable language. Both of these types of records can

then be stored on various media such as magnetic tape,

optical disk and CD-ROM.

The information on these types of media can only be

read using an imaging system which may require proprietary

computer hardware and software. These imaging systems are

used to reduce the handling and storage of records on paper

or microfilm and to increase accessibility to the

information in them. They can be extremely efficient in

handling heavily used files accessed by many people at

different locations.

However, current industry standards for scanned records

have still not reached a common level of general acceptance.

Although there are many technical standards which have been

issued and are being worked on by various standard

organizations such as the Association of Information and

Image Management (AIIM), the American National Standards

Institute (ANSI), and the International Organization for

Standardization (ISO), there is still no general consensus

or standard on a universal format for reading digital

documents which allows them to be accessed on any vendorşs

imaging system. In addition to the compatibility problem,

there is no agreement on the permanence of the media itself.

According to various sources, longevity of digital media can

range from as little as 5 years to as long as 200 years.

The durability of digital media is compounded by the

problems of hardware and software obsolescence. Usually,

computer hardware has a life expectancy of 5 years or less

and versions of software change yearly. This poses

significant problems for the retention of and accessibility

to future public records. The following policy exists to

minimize the risk of premature disposition of public

records, to ensure their long-term accessibility, to retain

the ability to make copies, and to preserve them for future

generations.

POLICY FOR THE

RETENTION, MAINTENANCE & DISPOSITION

OF DIGITIZED VISUAL PUBLIC RECORDS

1. Digital imaging systems that create, use, maintain, and

store the record (original) copy of any public record

shall meet the following minimum requirements:

a. Label and index any digital record in such a

manner as to enable authorized personnel to

retrieve, protect, and implement approved

dispositions for all records in the system.

b. Provide a standard interchange format, when

required, to permit the exchange of records and

information between agencies, departments or

personnel that utilize different software and/or

hardware.

c. Provide for an approved disposition of the

records, including when appropriate, their

transfer to the Library of Virginia (LVA) on

archival film or alkaline paper. Permanent public

digitized records which are required to be

transferred to the LVA as authorized in the

appropriate retention and disposition schedule,

are to be transferred either on archival film or

alkaline paper. Film meeting archival standards

can be created directly from the digital images by

various vendors. The digital image can then be

retained for use in the office environment and the

film can be stored as a permanent backup copy.

1. The output onto film or paper must conform to

the indexing scheme used by the computer

program and must be produced in a logical,

sequential order. A hard copy index must

accompany the paper printout or film copy.

2. In some cases, the intrinsic value of the

original record as determined by the LVA, may

require the transfer of the original record

to the LVA for permanent retention.

3. Disposal of any originals after

digitalization or of original digital media

must comply with the requirements in this

policy and also with the established

retention and disposition schedules using the

RM-3 form (Certificate of disposal) which is

available from the Records Management

Division, Library of Virginia.

d. The LVA will accept digital media for storage only

as a security backup copy, not as a permanent

archival record.

2. Agencies, local governments, and political subdivisions

shall ensure that no information is lost prior to the

expiration of stipulated retention periods due to

changing technology or deterioration of the storage

media by converting such media and taking any other

action as required to provide compatibility with

existing hardware and software. The migration

strategy used for upgrading equipment shall be

documented and include the following:

a. Periodically recopy to the same digital media as

required and/or transfer all digital records to

new media. Digital data shall be recopied as

necessary or when the error rate becomes

unacceptable when tested. The digital media kept

in storage should be sampled a minimum of every

two years in order to determine if any degradation

has occurred. The sampling method used should be

similar to that used for film in section 4 of

ANSI/AIIM MS45 Recommended Practice for

Inspection of Stored Silver Gelatin Microforms for

Evidence of Deterioration.

b. When systems are upgraded or replaced, the newer

system shall be backward compatible with the

existing system or as an alternative, all records

and applicable indexes in the existing system

shall be transferred/converted to the newer

system.

3. Rewritable and WORM optical disks, CD-ROM, or other

types of digital storage media may be utilized for

maintaining public records regardless of their

retention periods provided that the above items, and

those following, are adhered to:

a. Ensure proper documentation procedures and audit

controls are established and maintained. This

documentation should be in the form of a manual

(if in digital form it should be accessible

through printout to hard copy) which includes

system security, authorized access privileges

(read and write), and a record of all rewrites,

changes, additions, and deletions to any original

record. The latter should be maintained for the

life of the record. Audit control points include

the following:

Control points in an image system where audit

techniques can be applied to help identify areas of

potential exposure in a typical LAN-based image system

are illustrated in figure 1 below.

Control point 1 – If the original paper or

microform is kept for legal …