MARTIN BRADLEY offers advice for creating a structure for good document management
Infrastructure | 08 Sep 2005 :
Data storage should equate to good corporate governance
So,
it’s time to do a bit of archiving, is it?
Are the boxes of files that you don’t need every day but can’t yet bear
to part with building up in dark corners of the office?
For
many businesses, management of paper files or data has mainly been about space
– finding the square footage to keep the information safely until it had
outlived its usefulness. In light of past amendments to the Data Protection
Act, however, companies have started to reconsider the implications of storing
information, particularly information pertaining to individuals. There have
been a number of changes to the legislation, the most significant of which is
the broadening of the definition of data to include manual data held in
structured filing systems, not just information held on computer systems.
This
legislative change has led to a lot of businesses calling into question their
filling cabinets and their filing habits.
Deciding
which information to keep and which information to destroy requires planning. As
an important resource, the management of business information requires careful
consideration and clear policies. Failure to capture, retain and protect
information can have serious legal and financial implications and can lead to a
loss of customer confidence through adverse publicity. Good data management has
become a fundamental part of good corporate governance.
In
short, the changes to the Data Protection Act include:
- The Data
Protection Act now applies to manual and computer files
- Consent will be
required in all cases before a business can process personal data
- Individuals will
have the right to prevent businesses from using this information for a
specific purpose
- The Data
Protection Commissioner will have the power to carry out dawn raids and
privacy audits on businesses to ensure compliance – and to impose fines on
non-complying organisations.
- Electronic
information must be backed up and stored off-site
- Disposal of
personal information must be done in a secure manner.
- Personal data in
any format cannot be held for longer than the purpose for which it was
originally collected.
For
many businesses, therefore, much of their manually filed information has
essentially become more trouble that it’s worth. The wave of tribunals and recovery of
confidential documentation in landfills has made the handling and destruction
of documents in a correct manner more important that ever. This, combined with
the scale of the task, has created opportunities for companies that specialise
in the storage, scanning and destruction of data.
One
company within the Records Management industry, DMG Services, explains that
operating to best practice standards in this area is no longer an activity
exclusive to the public sector and bigger corporates. Cecil Ryan, managing director,
said, “We’ve seen the broadening of our customer base from a strong concentration
in the large organisations and the like, who’ve always tended to be careful
about protecting valuable and confidential client information - to a much wider
range of company type. SMEs and
mid-corporates from a whole range of sectors are now becoming a lot more
conscious of their responsibilities when it comes to data management. ”
The
key thing in choosing a supplier is to find someone you trust and someone who
can meet your particular needs. In choosing a supplier, it is recommended that
you go through their security processes with them in some detail and that
paying a visit to their facilities is a must.
There
are significant liabilities involved for the data controller of an
organisation, so they need to be absolutely confident that the data that they
are responsible for is being looked after or disposed of properly.
Many
companies are now operating document destruction policies that insist on
on-site shredding. This means that you will often see the shredding truck
pulling up outside offices to do the job there and then. This ensures that the
documents do not get lost in the shredding process and that somebody from the
company is there to oversee the activity.
For
the information you need to keep, the key is to take a structured, well-documented
approach. Data and document scanning has helped organisations to mange the
creation, distribution and retrieval of files, while also reducing dramatically
the time spent searching for documents. Once scanned, information can then be
stored off-site or confidentially destroyed.
Many
companies are opting for off-site file storage and computer media back up, not
just because of space but also because of business continuity issues. The
benefits of off-site storage of data, both manual and computer system based,
were underlined by Kerry Holland, a senior lecturer in the archives department
at UCD at a recent seminar in Kilkenny. “The benefits of storing documents off site
was clearly demonstrated when after 9-11, merchant banker, Merrill Lynch
successfully resumed operations within days as a result of copies of records
and data stored off site as part of vital records protection programmes”,
explained Holland. Other companies were not so well-prepared.
Other
options for file storage include the electronic storage of manual files,
accessible at the touch of a button over a secure web link. The initial cost
outlay is higher as all of the documents need to be scanned in, however in the
long run this type of service will prove more cost and time efficient, which
provides a further push to companies to get their data house in order.
Ultimately,
good data management and good corporate governance go hand in hand and the
amendments to the Data Protection legislation are a reminder of that. Often
companies end up discovering the hard way that the manner in which they store
and destroy information is all important.
*
Martin Bradley is a qualified Archivist and professional Archives & Records
Management Consultant.