BPC Polling
News
E-Mail Private? Best not to count on it.
Beth Cate, University Counsel, was kind enough to provide the following comments regarding the open records act, as it relates to email:
- Email as a type of record does not get any special exemption under the open records act. That is, email in our IU email accounts is just another type of record maintained by IU, and that means that as an initial matter, it is subject to disclosure under the open records act. Only if the nature of a specific email places it within a specific exemption under the open records act, would that email not be disclosable. For example, if an email contained personal health information, related to a faculty member's research project, or was a personnel record for an employee.
- There are a number of exceptions under the act, but no broad exception for "personal" as opposed to business-related email. Since IU permits some incidental personal use of IU email accounts, as long as the use is otherwise lawful and in accordance with IU policy, people may be using their IU email accounts to communicate with family and friends, send jokes, etc. All of those email are disclosable under the open records act unless they fall within specific exemptions.
- Anyone -- whether or not they are from the State of Indiana -- can make a request under the open records act, and they don't have to tell us why they are asking for the records. There are very few limits on what types of requests people can make -- the requests need to be reasonably specific so that we know what they are asking for, and commercial and political entities are prohibited from getting lists of contact info for students, faculty, staff, and participants in IU programs, for commercial (spamming) or political (fundraising, vote-getting etc.) use.
- If staff are concerned about their personal email being disclosable under the open records act, they should get a private email account and use that for personal email instead of their IU account. They can still use their IU internet access to check Gmail etc. from their IU desktop, but as long as they don't store the Gmail items on their desktop or on any IU server, we believe those items would not fall within the definition of "records" under the act.
- Having said that, IU employees should not be using private accounts to conduct IU business by email, or forwarding/storing their IU email in a private account. This raises problems for the University for ensuring the accessibility of such business email if/when needed -- for example, if we are sued and need to produce copies of those email in response to a subpoena or other discovery request, or to get them ourselves as part of our defense of the lawsuit. Plus, we don't have control over the level of security afforded those records by the third party provider, so if they contain sensitive personal or institutional data, that could pose substantial risks to those data.
