Public Records (Scotland) Act 2011: Consultation on the revised Model Records Management Plan

Page 1 of 6

Closes 7 Mar 2019

Specific amendments

1. What are your views on the proposal to add an explanatory headline statement to the beginning of each Element?

2. What are your views on the proposal to add bullet points under each of the Elements as an indication to authorities of what “Best practice might include”?

3. The new text of element 12 highlights the importance of staff training generally, rather than training for the individual identified at element 2 (the focus of the previous version). Is this change appropriate?

Element 12: Records management training for staff

Staff creating, or otherwise processing records, are appropriately trained and supported.

The RMP must be adhered to by all staff in an authority. The Keeper will expect an authority’s RMP to detail how the day-to-day operation of activities described in the elements in the authority’s RMP are explained to the staff who will be required to carry them out. It is important that authorities recognise that records management processes are likely to be implemented by staff in various roles and business areas out-with the immediate information governance officers. These staff members must be trained and supported accordingly. Guidance should be made available. 

The level of training required by staff will vary considerably depending on their role. 

Staff processing personal data will require particular training in the handling of those categories of record.

It is important that there is a mechanism in an authority that will allow staff to be alerted to changes in records management procedure.

Best Practice might include:

  • The authority is responsible for identifying the skills and training required for staff engaged in records processing
  • Staff engaged in records processing activities are given regular training and development so that they understand their records management responsibilities.
  • The operation of the authority’s records management processes should be included at induction where relevant.
  • Staff engaged in activities that include records with personal data are trained so that they understand their responsibilities under data protection law.
  • Any professional record-keeping staff are supported to maintain involvement in Continuous Professional Development schemes
  • Training for staff who use records is refreshed periodically.
  • Training is recorded.

4. Does the text now being proposed under Element 12 clearly and adequately describe what’s required?

5. What are your views on the proposal to add an additional Element (15) for public records being created or held under contract by third parties when providing a function of a public authority?

Element 15: Public records created or held by third parties

Adequate arrangements must be in place for the management of records created and held by third parties who carry out any functions of the authority.

Section 3 of the Act describes the meaning of public records for the purposes of the Act. It says that public records in relation to a named authority means records created by or on behalf of the authority in carrying out its functions. This is extended to records created by or on behalf of a contractor carrying out the authority’s functions and includes records that have come into the possession of the authority or contractor in carrying out the authority’s functions. 

An authority’s plan must include reference as to what records are being created and held by a third party carrying out a function of the authority and how these are being managed to the satisfaction of the authority. This does not mean the authority must impose its own arrangements on the third party. 

Authorities should take a risk-based approach to the arrangements it puts in place with third parties to ensure that these are relevant and proportionate to the public records that fall within the scope of each contract type. Records management requirements, and evidence of assurance that prospective contractors will be able to meet these, should be included in the procurement exercise.

An authority will wish to ensure the scope of its proposed arrangements include sub-contractors. It will further wish to ensure that arrangements are in place to allow it to meet statutory obligations under other information legislation, for example, to FOI(S)A and data protection legislation (see Element 9). There may be other regulatory obligations that an authority will wish to consider in relation to the function being carried out by the third party. 

Best practice might include:

  • An authority will set out arrangements for managing public records created and maintained by a third party provider through the provision of adequate records management contractual clauses and monitoring procedures
  • Arrangements under procurement documentation and contractual clauses will reference contract monitoring and “end-of-contract” procedures for public records being created and maintained by third parties
  • Arrangements will provide for proper retention and disposal of records throughout the duration of the contract
  • The authority and the third party will have a clear understanding of the records that fall within the scope of the contract
  • An authority will be able to demonstrate its satisfaction to the Keeper that corporate and operational responsibility for records management within the third party is robust
  • Arrangements will provide for records of enduring value and records with on-going business value reverting to the authority on conclusion of the contract or where the third party falls  
  • An authority will be satisfied that the third party keeps its records management arrangements under review.
  • A public authority can demonstrate that contractors have had regard to the Guidelines for Contractors as part of the procurement exercise

6. Does the text being proposed under the new Element 15 clearly and adequately describe what’s required?