The Clean-Up Instruction, the Missing Retention Class and a 20-Day Access Request
The Department of Community Services is 11 months into migrating from a 14-year-old shared drive to a new EDRMS. The drive holds roughly 2.3 million files in 60,000 folders, most named by staff initials and dates rather than by business function. The department's approved retention and disposal authority has no class covering 'neighbourhood mediation case files', a series of about 9,400 files created between 2009 and 2016; staff have assumed they are temporary and have kept deleting them at each year end. On 3 March the department receives an access request under freedom of information legislation for all mediation records concerning a named housing complex, due in 20 working days. On the same morning the CIO circulates a 'clean-up' instruction asking all staff to delete duplicate and superseded files before the migration cut-over on 30 April. A litigation hold over a tenancy dispute involving the same complex has been in place since January, but it was circulated only to the legal team. Two staff have already deleted 300 folders this week.
1. What must happen to the clean-up instruction, and what are the immediate risks if it proceeds unchanged?
Read the worked answer
The instruction must be suspended, in writing, to all staff, today.
Why
- A litigation hold is in force. Destruction of potentially relevant records after a hold is known about - or ought to be known about - exposes the department and individual officers to spoliation findings, adverse inferences, contempt and, depending on jurisdiction, criminal liability. A hold circulated only to legal staff does not discharge the duty; it must reach every custodian.
- The access request fixes a date from which destruction of requested records is prohibited. Continued deletion after 3 March is a breach of the access statute, not merely poor practice.
- 'Duplicates and superseded versions' cannot be identified reliably in an uncontrolled drive named by initials and dates. What looks like a duplicate is often the only surviving version of an earlier decision.
Immediate steps
- Issue a written stop-deletion notice to all staff and contractors; require acknowledgement.
- Re-issue the litigation hold to all custodians, including the mediation team, with a description of the classes covered and the consequence of breach.
- Quarantine rather than delete: move candidate files to a read-only holding area.
- Recover what can be recovered - recycle bin, backups, version history - and record what cannot.
- Document the 300 folders already deleted: what, by whom, when, whether recoverable. This becomes part of the disclosure and, if needed, a notification to the regulator.
- Inform the legal team, the FOI officer and the CIO in writing.
2. How should the department deal with the 9,400 mediation files that have no retention class?
Read the worked answer
Absence of a disposal class is not permission to destroy. The default under records law is that unsentenced records must be kept until a disposal authority covers them.
Assessment
- Freeze disposal of the whole series immediately, including at year end, and remove any automatic deletion rule that touches it.
- Characterise the series properly before deciding anything: what function created it (dispute resolution), what evidential value it has (agreements reached, complaints about outcomes, child or tenancy matters), what personal information it contains, and what the statutory minimum for comparable case files is (often 7 years after closure, longer for minors or matters that could be litigated).
- Approach the records authority for either a specific class or coverage under a general administrative-records class; document the submission and the interim freeze.
- Assess the files already deleted. Unauthorised disposal of public records is a reportable event in most jurisdictions; prepare a brief for the accountable authority covering the volume, the period, the cause (no class plus an assumption by staff) and remedial action.
- Publish an interim rule so staff stop guessing: 'mediation files - do not destroy - pending sentencing'.
For the migration, tag the series as unsentenced in the EDRMS so that disposition is blocked by system configuration, not by staff memory. A retention rule that depends on people remembering not to delete will fail again.
3. Design a defensible search and response for the 20-working-day access request, given the state of the holdings.
Read the worked answer
Day 1-3: scope and control. Confirm the scope in writing with the requester - the complex, the date range, whether they want mediation files, emails, complaints and case notes. Appoint a single search coordinator and open a search log recording every source, term, custodian and date searched.
Day 3-8: identify custodians and sources. The named complex, the mediation team, the tenancy dispute team, the complaints register, the Ministerial correspondence system, the shared drive, the new EDRMS, personal mailboxes, paper files in the two regional offices, and the legacy case management system. Search by property name, address, street variants, known party names and file reference numbers.
Day 8-14: capture and review. Copy hits into a review set; do not review in place. De-duplicate; apply exemptions (personal information of third parties, legal privilege, confidential material) with a schedule recording each exemption and the clause relied on. Consult affected third parties where required.
Day 14-18: decisions and notice. Prepare the decision letter, schedule of documents, statement of reasons for any refusal or partial refusal, and review rights. Have it signed within delegation.
Day 18-20: release and record. Release, and file the complete search record with the request file.
Throughout, note in writing that the shared drive's naming conventions mean keyword searching alone will miss records, so custodians must also be asked directly whether they hold relevant material. Backups: state whether retrievable and on what basis.