Access, Privacy, and Security Considerations for Archivists and Records Managers

In large organizations, archivists and records managers—individuals with specific expertise— handle access management, privacy protection, and systems security related to documents and files. 

Sometimes these areas are combined, but from a theoretical perspective, information management and security professionals are the ones who implement the requirements for access and privacy controls. 

Expectation of Privacy

The first and older issue for privacy is what expectation, if any, employees have for privacy of their documents, especially email, at work. There is no expectation of privacy in a work environment unless the employer expressly grants it. I often joke to clients, “Dance like nobody’s watching. Write emails as if they’ll be read in court,” because they certainly could be. 

The expectation of privacy is absent when employees use company computers and networks. Legal rulings are still evolving about ownership of what employees can do on a personal computer that they own. Both employers and employees need to be clear about rights to information on employee-owned computers. However, the issue will become murkier the more work and home life merge in a post-pandemic, 24/7 work environment. 

Personally Identifiable Information

The newer privacy issues swirl around personally identifiable information (PII). The United States lags behind several countries, especially the European Union, which have taken a much tougher stance on protecting the privacy of individuals. The US Patriot Act gives the Federal government considerable access to various types of personal information in the name of national defense. The act highlights the many places where personal information is stored, and the price people pay in the diminution of privacy for the many advantages of digital services.

The most significant issues from an archives and records management perspective are compromised data, deductive disclosure, and the question of whether making hard-to-locate public data available on the internet is an invasion of privacy. It may arise in various formats, but there are two classic ones. One example is putting the names and addresses of those convicted in court of driving while intoxicated or other crimes online. The records are public, but they have been hard to find without going to the court itself. 

Deductive Disclosure

For many years, the Office of Personnel Management, an agency of the United States Federal Government that manages US civilian service, had made available a complete listing of federal employees and their phone numbers. The list was requested under the Freedom of Information Act and was provided to the Washington Post in electronic form as requested. The Post put the information on its website to facilitate people contacting government officials, but it eventually pulled down the listing because of deductive disclosure issues. For example, criminals might identify the federal employees employed by the Drug Enforcement Agency or other law enforcement agencies who live in small towns. Deductive disclosure is when individuals can be identified even though their personal information is not provided. For example, in public use versions of the census, income is top coded (e.g., over $250,000), and ages or number of children are put in ranges to make the pool of people larger. These and similar masking techniques are used to protect the identity of individuals. 

Data Breaches

Data breaches have also been in the news in recent years, including charges that NARA allowed PII to escape its custody, once on a lost hard drive and once on a hard drive that was returned to the manufacturer because it was broken. Other examples abound of data from public and private organizations being lost or compromised due to hacking. Health and banking information are the two most sensitive areas. Others worry about employers using health data to determine the best people to fire based on projected health care expenses. Archivists and records managers should establish policies and procedures and monitor PII in their organizations to minimize the risks of compromised information. Part of those procedures should cover restrictions on the collection and retention of PII. 

Protecting Authenticity and Integrity

Archivists and records managers should work closely with security staff because both are interested in protecting the authenticity and integrity of the records and information assets of the organization. Controlling access and monitoring what access takes place is central to the work of computer security staff. Security overlaps with archives and records management in that both seek to control access to information to ensure its integrity while striving to provide legitimate access as broadly as possible. But the two are complementary in focus. Security is focused on the threats to the integrity of the information and defeating those threats. Archivists, records managers, and other information professionals concentrate on the records themselves and maintain their integrity over time.