Office of the Saskatchewan Information and Privacy Commissioner. Best Practices for Managing the Use of Personal Email Accounts, Text Messaging and Other Instant Messaging Tools. Updated 27 July 2023. • Determine where records are stored (i.e., will the information be stored on servers outside of Canada) and ensure that the public body will have control over how that information is protected, disclosed or accessed. • Ensure that the tools include search and retrieval functions to support access to information and other obligations. • Disable unauthorized software on work-issued mobile and other computing devices. • Ensure that the records produced by all authorized communications tools are included in the overarching records management plans and training. • Include records created through all authorized communication tools in retention schedules and in general records management planning. Develop and Implement Clear Policies Develop clear and consistent policies on the appropriate use of communications tools. These policies should: • Identify which instant messaging tools and email accounts are permitted for business-related communications, and clearly prohibit the use of other tools and accounts. • Require staff, if they have sent or received business-related communications using unauthorized tools or accounts, to immediately, or within a reasonable time, copy records to their official public body associated email account or the public body’s computer or network, unless transitory in nature. This can be as simple as saving a copy to a shared drive or forwarding it to a public body’s email account. After ensuring these records are saved or forwarded to the public body, the public body should ensure copies on the unauthorized tool or account are destroyed. • Inform staff that all business-related communications are subject to disclosure and retention requirements, regardless of the tool, account or device used and that they will have to provide a copy of all business-related communications upon request. • Remind staff that when they are collecting or assembling records in response to an access to information request, they must search for and produce any relevant records from instant messaging and personal email accounts that are in the public body’s possession or control.
RkJQdWJsaXNoZXIy MTgwMjYzOA==