Dear AS Van Wey Lovatt,

 

I refer to your request of 27 May 2021 for information concerning the
University’s recordkeeping of electronic communications. The University’s
response follows.

 

“I am writing to request documents, policies, protocols, guidelines,
regulations, etc., which include information about the back-up, retention,
and archiving of electronic communications sent or received by UofA
employees and affiliated researchers with a UoA email address. In
particular, I request documents which specify the frequency of back-up and
archiving, as well as the period of retention.”

The document setting out information on the University’s email service
(entitled “ITS Business Service Description – Enterprise Email and
Calendaring) is attached. Unfortunately, the University cannot provide any
further information to you on the nature and capabilities of its backup
system. Ransomware is a significant threat to all businesses currently,
and one of the key mechanisms in an organisation being able to recover
from a ransomware attack is the effective use of backups. Public
disclosure of the nature and capabilities of the University’s backup
system can be used by an attacker seeking to launch a ransomware attack
against the University to assist them in their attack. This part of your
request is refused under section 9(2)(k) of the Official Information Act.

 

“I also request information as to the legislative requirements,
regulations and mandates which specify the length of time in which the
university must retain electronic documents in an accessible format in
order to be compliant with the Privacy Act 2020, Electronic Transactions
Act 2002, the Public Records Act 2005, Health Act 1956 and any other
relevant Acts.”

 

The General Disposal Authority for University Records under the Public
Records Act 2005 covers records in all formats. The required minimum
retention period is determined by the content of the record, not the
format. This document is publicly available through the Archives New
Zealand site at:
[1]https://www.archway.archives.govt.nz/Vie.... Other
relevant documents concerning University recordkeeping obligations have
been attached.

 

To the extent that other legislation creates recordkeeping obligations for
the University, those obligations are as specified in that legislation,
which is publicly available at [2]www.legislation.govt.nz. I note that the
Electronic Transactions Act 2002 has been repealed.

 

This constitutes a partial refusal of your request under section 18(d) of
the Official Information Act, on the ground that the information requested
is publicly available.

 

You have the right to make a complaint to an Ombudsman if you are
dissatisfied with this response.

 

Yours sincerely,

Rebecca Ewert

General Counsel

University of Auckland

 

From: Amy S Van Wey Lovatt
<[3][FOI #15580 email]>
Sent: Thursday, 27 May 2021 8:50 am
To: legal <[4][email address]>
Subject: Official Information request - Retention of electronic
communications

 

Dear University of Auckland,

I am writing to request documents, policies, protocols, guidelines,
regulations, etc., which include information about the back-up, retention,
and archiving of electronic communications sent or received by UofA
employees and affiliated researchers with a UoA email address. In
particular, I request documents which specify the frequency of back-up and
archiving, as well as the period of retention.

I also request information as to the legislative requirements, regulations
and mandates which specify the length of time in which the university must
retain electronic documents in an accessible format in order to be
compliant with the Privacy Act 2020, Electronic Transactions Act 2002, the
Public Records Act 2005, Health Act 1956 and any other relevant Acts.

If any of this information is publicly available, I request that you
please refer to the specific document, including the section, page and/or
clause of the document, and an web address where the information may be
found.

Thank you.

Kindly,
AS Van Wey Lovatt

-------------------------------------------------------------------

This is an Official Information request made via the FYI website.

Please use this email address for all replies to this request:
[5][FOI #15580 email]

Is [6][University of Auckland request email] the wrong address for Official Information
requests to University of Auckland? If so, please contact us using this
form:
[7]https://fyi.org.nz/change_request/new?bo...

Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
[8]https://fyi.org.nz/help/officers

If you find this service useful as an Official Information officer, please
ask your web manager to link to us from your organisation's OIA or LGOIMA
page.

-------------------------------------------------------------------

References

Visible links
1. https://www.archway.archives.govt.nz/Vie...
2. http://www.legislation.govt.nz/
3. mailto:[FOI #15580 email]
4. mailto:[email address]
5. mailto:[FOI #15580 email]
6. mailto:[University of Auckland request email]
7. https://fyi.org.nz/change_request/new?bo...
8. https://fyi.org.nz/help/officers