Firstly, there is the Data Protection Act (1998), one of the central principles of which is that:

“Information shall not be kept longer than is necessary”

This is a clear call to dispose of information when it is no longer required. Indeed, roughly half of the IRMS Toolkit is an extensive list of how long to keep records of a particular type.

The second relevant piece of legislation is the Freedom of Information Act (2000), which provisions for subject data access requests (SARs) by individuals who wish to see any and all personal information which may be held regarding them.

When considered alongside the longer term storage requirement, these pieces of legislation create a complex picture for information retention and disposal.

Typical problems surrounding Information Retention and Disposal

There are obvious issues of space if paper documents are simply stored long term in a file room. It is likely that at some point you will run out of space or – as in the case of many new-build schools – there may simply be no space (read our separate piece on physical storage in BSF schools).

Regardless of space, simply placing documents in deep storage has 3 key problems:

1) Finding a given record – in an increasingly cluttered store – is going to be a challenge that no-one wants to tackle. Certainly, this is unlikely to be done quickly and there may be some doubt about whether it could be done comprehensively in the event of a subject data access request (SAR).

2) By law, a school cannot retain documents beyond their set retention periods. Older files will need to be removed at some point – even if this is by whole years of filing at a time. A store full of paper represents a future archiving challenge and there are costs for bulk destruction services.

3) Storing documents in this way is not legally compliant with the Data Protection Act. A school adopting this approach will also be hard pressed to prove compliance with Freedom of Information requests.

It’s worth remembering that the same principles, problems and legislation apply to documents related to pupils, staff, governors and the financial management of the school. Whilst points 1 and 2 may be something that a school could live with, accepting the associated costs, point 3 is a major compliance issue that cannot be ignored.

Options for managing paper

A potential solution could be to periodically remove and destroy paper documents in the archive which are no-longer required under retention laws. However, faced with potentially thousands of files containing millions of pages, this is likely to be massively time consuming. For example, if it takes 5 minutes to retrieve a file and manually search through the contents for a particular type of document (a not unreasonable time for a 200+ page file) then repeating the process for a full year group of 500 students would take one person more than a week. This multiplies out for larger schools, manually archiving many years’ worth of files (remember - all kept until the former student is 25) and taking care to retain or remove file types with varying retention dates.

Safeguarding must be a consideration if you choose to manually archive paper files. Sensitive files, for example those pertaining to child protection, must be handled only by authorised employees. (Read more about this in issue 3 of this series).

Also, manual sorting of numerous files can be fraught with human errors, so frequent rest breaks are advisable in the interest of refreshing tired eyes.

An alternative solution

Space issues can be addressed by scanning paper files and storing them electronically. Provided you have a system that enables compliance with BSi10008 (a standard and code of practice which ensures the evidential weight of documents stored electronically), you can destroy the original paper documents.

A good electronic document management system (EDMS) will apply retention rules to each part of a classification of documents stored in the system. Documents are stored against the appropriate classification (eg; attendance, admission, parental permission forms, SEN statements). The system can then apply rules to dispose of documents or present them for review on a set date – possibly with reference to pupil specific information, such as date of birth. This approach dramatically reduces the management time associated with retention and completely eliminates the issues associated with large physical paper archives.

It’s important to note that simple scanning of documents into folders on the school’s network, or other internal databases, does not provide adequate functionality to properly manage the retention and disposal of documents. This approach is not compliant with BSi10008 and is often fraught with problems relating to document retrieval and network capacity, making a specialist EDMS a much more practical solution.

Of course, success also depends on an appropriate records management policy being enforced within the school, routine information audits (as explained in my previous articles) and matching the outcome of these audits to the retention guidance provided in the IRMS Toolkit. If all of this works as it should, the school can confidently place documents into an electronic store and destroy the original paper documents.

Things to consider

Legal admissibility of electronic documents

Following the destruction of paper records, it is important that a school can rely on electronic information if called upon to provide evidence for a legal case. Assurance on this matter is provided by an EDMS that complies with the guidance in BSi10008, the code of practice for legal admissibility of documents stored electronically. This standard requires that the EDMS has sufficient auditing to demonstrate the provenance of a given document, including who created the document and when.

Freedom of Information (FoI)

In the event of a request under FoI, it may be necessary to evidence that a full and complete response has been provided to a subject data access request (SAR). For this reason, the IRMS Toolkit states that the school should maintain a list of records which have been destroyed and how this was authorised. Thereby, the school can protect itself from any allegation of failing to provide the requested information. A good EDMS will automate this.

Hardware and backup media disposal

An EDMS will be part of data backup processes, typically meaning that copies of the system will be stored on magnetic backup tapes. For complete compliance, it is necessary that these tapes are subject to a destruction plan; otherwise the school may be retaining information unlawfully. Further, the school should consider disposal processes for obsolete computer equipment. The IRMS Toolkit suggests that hard drives should be “dismantled and sanded”, which is the ultimate way of ensuring that data cannot be recovered (in fact, Google crush and shred hard drives that are no-longer required). However, this does seem a little excessive and commercial software is available to over-write disks, ensuring that data cannot realistically be recovered from them, after which the disks can be recycled rather than sent to land-fill.

Evolution of the rules

One final point to note is that retention requirements are evolving. The IRMS toolkit was last updated in May 2012, but already we are seeing customers with emerging needs that post-date this document. This evolution is often stimulated by developments in technology and processes adopted by schools; for example, we recently worked with a school that needed a new document classification and retention rule for biometric data permission slips.

In Conclusion …

Whether you choose to work with paper or electronic files, it is essential to keep on top of the information retention and disposal issue as rules continue to change. A school is required to nominate someone to update its policies and processes in line with changing legislation. In the eyes of the law, the headteacher maintains overall responsibility for the records and information held. Installing an EDMS gives you the support and expertise of an external provider, and a practical, automated means to manage the increasing burden.