Loading...
HomeMy WebLinkAboutEmail Policy, Revised 2020-05Town of Danby Email Policies and Procedures Effective: November 17, 2014 Revised and Adopted: May 11, 2020 1.0 General Policies The Town legally owns all emails that employees and officials create and receive in the process of conducting business on behalf of the Town and its constituents. Employees and officials have no promise of personal privacy when using email on behalf of the Town. 1.1 Ownership of Email All officials, appointees, and staff will have town emails. All email users of town email accounts will acknowledge that they understand the town’s policy on email ownership by written acknowledgement to the Town Clerk. Email users will not use personal email to conduct town business except in emergencies. Town officials and employees must recognize that all town-related emails are public records that are covered by New York State’s Records Retention and Disposition Schedule (MU-1) and by this town email policy. 1.2 Roles and Responsibilities The management of email is the responsibility of town officials and includes everyone who uses email to conduct town business. Below are the individuals who have specific responsibilities for managing the Town’s email. These responsibilities are indicated throughout this policy under each main subject heading. 1.2 (a)​ Town Clerk 1.2 (b) ​Town Attorney 1.2 (c)​ Town Supervisor and Town Board 1.2 (d)​ Town Computer Support Vendor 1.2 (e)​ Records Advisory Board 1.2 (f)​ Town IT Support Staff 1.2 (g)​ Staff, elected or appointed officials and paid service providers using email for town business. 1.3 Training No employee will have use of a town email account without appropriate initial and ongoing training. Training will include established email use and management policies. Training will occur immediately after employment or appointment and thereafter as follows. Ongoing training will be offered after upgrades, transitions to new email programs, and on an as-needed basis. The Town Clerk will arrange for training, which will include the following topics: 1.3 (a)​ identifying records and general records management practices 1.3 (b)​ responsibilities of employees in records and email management 1.3 (c)​ appropriate use of town email accounts 1.3 (d)​ how to write and communicate effectively via email 1.3 (e)​ responding to legal actions and FOIL requests Employees who do not attend ongoing email use and management training are at risk of forfeiting their email use privileges. 1.4 Policy Review and Updating To ensure that this policy is current and relevant, it will be reaffirmed by the Town Board at the annual organizational meeting. 2.0 Maintaining the Email Management System The technical maintenance of the system will be a coordinated effort involving several key players with defined roles and responsibilities. 2.1 Town Supervisor and Town Board 2.1 (a)​ Ensure an adequate budget for maintaining the email management system. 2.1 (b)​ Promote, support, and enforce this and other records management policies. 2.2 Town Clerk as Records Management Official (RMO) 2.2 (a)​ Ensures that appropriate state retention requirements are complied with. 2.2 (b) ​Ensures that the current and future systems meet federal and state records requirements. 2.3 Town Computer Support Vendor Maintains the technical capabilities of the email management system 2.4 Town IT Support Implements user profiles to allow town officials and employees to access the email and other records management applications. 3.0 Access to Email Access to email must be possible for the full retention period of the email but subject to strict controls to ensure against unauthorized or inappropriate access. In the email archives, emails are filed first by department, and then by retention and disposition rather than by subject area or document type. Email users must assign intelligible subject lines to all outgoing emails. The RMO, and the Computer Support Vendor have access to all town email records in the email archive and can allow access to legal counsel and others on an as-needed basis. Access to certain emails relating to law enforcement investigations, court actions, and personnel matters may be restricted by law to specific individuals in town government. The RMO is responsible for ensuring access to email records for the duration of their retention periods. 4.0 Retention and Disposition The system will manage the retention and disposition of email automatically, and support the retention and disposition process for permanent and general emails. Certain circumstances (legal proceedings, Freedom Of Information Law[FOIL] requests, audits, staff departures) will require that the Town be prepared to suspend or supersede retention and disposition procedures. 4.1 Managing Retention and Disposition The RMO, is responsible for all email retention and disposition including the retention and destruction of backups. Legal counsel will initiate the process of halting the destruction of email-records in response to an impending legal case or other need. Legal counsel must alert the Town Clerk/RMO, who will contact the Computer Support Vendor to halt the destruction process. Retention and disposition is tied to the Town’s classification system for email records. It is the responsibility of the RMO to permanently retain the appropriate records. 4.2 Backups The Town creates backups of its email system as a disaster management strategy only. Backups are not intended to be archival copies of permanent records. 4.3 Suspending Retention The Town has a legal obligation to suspend all retention and disposition activities in the event of an impending lawsuit, a legal investigation or ongoing fiscal or program audit. In this case emails may be retained even after their retention periods have expired. 4.5 Departure If a staff member or official departs from the Town, the Town Clerk will place a hold on the email account of that individual within 15 days of the user's departure until their account and computer can be reviewed for record content. This requirement may be waived when enough notice is provided in advance by the departing staff member so that the individual can appropriately deal with the records and is able to demonstrate this to the Town Clerk. It is the responsibility of the Town Clerk to notify the Town IT Support when a hold needs to be put on a town email account or when a user needs to be removed. 4.6 Transition In the event that a town position is open and a new official has not been appointed or hired, the Town may choose to allow the previous occupant of said position to remain in control of a town email. It is the responsibility of the Town Clerk to notify the Town IT Support when there is a change in status of a town email account. 5.0 E-discovery All town email messages, including personal emails related to town business, may be subject to discovery proceedings in legal actions. Legal counsel will work with the Town Clerk to establish internal procedures for preserving evidence relating to imminent or ongoing legal actions. These procedures are subject to review by the Town’s Records Advisory Board. If a staff member or official becomes aware of potential litigation, it is his or her responsibility to notify legal counsel immediately. The Town Attorney will determine what action, if any, needs to be taken. Legal counsel will work with the presiding judge and opposing counsel to narrow the parameters of a records search as much as possible so as not to overburden the Town’s technical infrastructure. In the event of an extended legal proceeding, the Town Clerk, working with the Town’s Computer Support Vendor, must ensure that records of potential relevance to the case remain accessible for the full extent of the proceeding, which may require moving relevant email records offline to storage media or a detachable drive. 6.0 Inappropriate Use Inappropriate use will be handled and enforced as a serious security issue. 6.1 Responsibility for Inappropriate Use and System Security. All users of the Town’s email are expected to know the difference between appropriate and inappropriate use of email. 6.2 Inappropriate Uses of Email Do not use the Town of Danby’s email for: 6.2 (a)​ activities unrelated to official assignments or job responsibilities 6.2 (b)​ any illegal purpose 6.2 (c)​ transmitting threatening, obscene, or harassing materials or messages 6.2 (d)​ distributing confidential town data and information 6.2 (e)​ interfering with or disrupting network users, services, or equipment 6.2 (f)​ private purposes, such as marketing, business transactions, or advertising of products or services 6.2 (g)​ installing copyrighted software or computer files illegally 6.2 (h)​ promoting religious or political causes 6.2 (i)​ unauthorized not-for-profit business activities 6.2 (j)​ any activity meant to foster personal financial gain 6.2 (k)​ modifying, obtaining, or seeking information about files or data that belong to other users, without explicit permission to do so 6.3 Enforcing Appropriate Use The Town has the right to: 6.3 (a)​ log network use and monitor file server space utilization by users 6.3 (b)​ inform users there is no promise of personal privacy 6.3 (c)​ restrict listserv membership to those listservs that are directly related to the job and the work of the Town 6.3 (d)​ address misuse through disciplinary action if necessary, and report messages relating to or in support of illegal activities to the appropriate authorities The Town Board will review alleged violations of the email appropriate use policy on a case- by-case basis. Violations of the policy that are not promptly remedied may result in termination of internet and email services for the person at fault. 7.0 Technical Security The Town Clerk, with the support of the Computer Support Vendor, has primary responsibility for overseeing the technical security of the Town’ s email management system. 7.1 Handling Suspect Emails Any user who receives suspect email or email with suspect attachments, must delete these emails and report them to the Town Clerk. Under no circumstances should users open suspect email attachments. Users should exercise similar care when linking to external websites from unsolicited messages. 7.2 Passwords All users must use passwords to access their email, and passwords will not be shared. Users will also be required to change their passwords annually. The Computer Support Vendor will alert users when it is time to initiate the password change. 8.0 Preservation Except where indicated, the Town will apply all preservation standards described in New York State’s Record Retention and Disposition Schedule(MU-1)​. 8.1 Backups and Long-term Preservation Backups of the email system are to be used for disaster recovery purposes only, not for retention purposes. Data on backups are not indexed and are in a proprietary compression format, making it less likely that the data will be accessible long-term. 8.2 Media Integrity The Town will ensure the ongoing integrity of media used to store long-term and permanent emails. Questions Questions regarding town email use can be directed to the Town Clerk. Town Board Resolution 114 of 2014, passed November 17, 2014 Town Board Resolution 50 of 2020, revised May 11,2020.