What are some best practices for fulfilling Public Records Requests?

Here are some suggestions, gathered from a variety of public records handbooks from across the U.S.

01. Assign Responsibility

Someone in your agency should have overall responsibility for managing and retaining records.

02. Training

Everyone involved in public records requests (intake, vetting, gathering documents, reviewing/redacting, releasing, and reporting) should have adequate training and know-how to manage and retain the records they own and/or touch. In fact, everyone who participates in the public records request process should be trained on your organization’s policies and procedures. Technology tools (some of which include training) can streamline operations, security, and provide other benefits. When using technology, it’s best practice to complete all important work in the solution to create a defensible audit trail verifying your compliance.

03. Post Your Policies

Draft, display, and make your policies available for inspection/copying (via signage, handout, website).  Be sure to include a description of your organization, established times/places where records can be accessed or requested, costs for obtaining records (if any), methods for accessing or obtaining copies, and records retention policies.

04. Requester identification may be required to determine authorization

Sometimes requester identification should be required to determine authorization to obtain requested records.  In most cases, the requester does not have to state a reason for the request. Your policies may include rules for residents and non-residents of your state (a few states allow restrictions for requests from out-of-state, non-citizens, and underage or incarcerated individuals).  Additionally, individuals may have special access rights to records about themselves.

05. Clarify Scope

Require reasonable specificity from requesters in regard to the subject matter and length of time involved. If specificity is not forthcoming and excessive amounts of time and resources might be spent deciphering and responding to a request, consider using a “burdensome request” exemption when possible.

06. Know the mandatory timing requirements

Familiarize yourself with mandatory timing requirements and comply or deny within these limits. Use modern software tools to help you track response times when you have multiple simultaneous requests in your care.  Know the laws around enforcement and sanctions in your jurisdiction.

07. Understand the exemption code

Take time to fully understand the allowable exemption codes used in denials. Portions of records which are disclosable should be disclosed. Use modern redaction software to securely remove portions of public records that are exempt from disclosure; automatically creating an exemption log and defensible audit trail. Types of exemptions may include:

08. Use the 4-step approach

When vetting and reviewing requests to determine if records should be released, consider using the 4-step approach:

09. Filing

Your agency staff should know what records you have, where they are, and in what format they are stored.  File and inventory your public records to allow for easy access over time. Maintaining a sizable volume of records is a significant commitment of resources; and protecting the investment in these records requires adequate security.  Records must be kept safe from vandalism and theft as well as unauthorized access and use. Agencies should establish security procedures, assign responsibilities, and develop a disaster recovery plan.  The structure of your records files should capture their form, content, and relationship to other records.  New records should be captured and stored in digital form for the best accessibility and security.

10. Retention & Storage

Responsive Records should be preserved according to the retention periods outlined in the law. Unique challenges exist in retaining electronic records due to their fragility, susceptibility to damage or loss, and difficulties ensuring their authenticity and accessibility.  Agencies should have standards for the storage of optical disks and electronic records.  Records should be kept for the minimum retention period listed in current approved records retention schedules.  The life of a public record includes the following steps:

11. Fees

If your state/jurisdiction allows you to charge fees for inspecting and copying records, you should do so.  This allows your agency to recoup some of the costs associated with fulfilling public records requests.  Generally, most agencies do not charge for an in-person inspection.  Small fees can cover the material costs of photocopying (per page to cover paper and printer costs – often $0.10 per black/white page and $0.25 for color) or burning records to media such as DVDs or thumb drives. Your agency may estimate these fees before performing the work; and upon acceptance of the estimate by the requesters, you can collect partial or full payment of fees prior to actually incurring the expenses.

12. Emergency/Crisis Management Plan

Your agency should have plans and backups of records needed to resume critical operations in the event of a disaster.  This includes the ability for agency staff to telework for business continuity (and to avoid backlogs) during stay-at-home social distancing mandate periods such as those during COVID-19. GovQA has created a Covid-19 Crisis Assessment & Future Plan worksheet which may help your agency improve your flexibility and speed for future emergencies. You can check it out here.

View the National Association of Counties state-by-state report on Open Records Laws here.