Public records in private accounts
Evidence of work activities are public records, regardless of how or where they are made or received, and must be managed in accordance with the Public Records Act 2023 (the Act).
Public records include emails, social media interactions, text messages and messages in any other messaging applications, photographs and videos.
Making and using public records in private accounts
The Act does not restrict the use of private email and social media accounts, messaging apps, or personal devices. However, public records made or received using these methods must be managed in accordance with the Act in the same way as public records made or received using official government channels.
Using private email and social media accounts and apps for work purposes can increase the risks of:
- public records not being captured, managed or accessible
- public records being unlawfully disposed or lost
- information security being compromised (e.g. malware, information inadvertently shared)
- staff breaching other legislation, rules or guidelines (e.g. Criminal Code Act 1899, Right to information Act 2009, Information Privacy Act 2009, Code of Conduct)
- actual or perceived misconduct or corruption (PDF, 572KB).
Check:
- other legislation, rules, guidelines and regulations restricting or allowing the use of private email accounts for work purposes (e.g. Ministerial Records Policy, Private Email Use Policy)
- when private accounts, apps or devices can be used (e.g. email colleagues about change in work plans, working off-site, IT systems unavailable)
- with your Records Manager how and when public records sent, received or generated from a private account or apps are to be captured (e.g. forwarding the record to an official government account, exporting it into a format that can be saved).
Responsibility for managing and capturing public records
All government employees need to be aware of their recordkeeping responsibilities under the Act to make and keep complete and reliable public records of all work-related interactions when using private accounts, apps and devices. This includes capturing any public record made or received in a private account, or messaging app into an official government account within 20 calendar days of creation or receipt.
If a ministerial record is made or received in a private account, ministers, assistant ministers and ministerial staff must forward the email from the private account to an official ministerial account within 20 calendar days of creation or receipt.
If a mayor or councillor receives or makes a public record relating to the administration of council business in a private account, best practice is to transfer within 20 calendar days of creation or receipt.
Specific requests for advice relating to the implementation of policies and procedures about the management of public records in private accounts should be directed in the first instance to your public authority's records area.
Capture public records
Capture any public records made or received in a private account, or messaging app into an official government account within 20 calendar days of creation or receipt.
Consider what processes or procedures need to be in place to capture any public records sent, received or generated in private accounts.
Use the following options to assist in the development of your procedures.
Format/Account | Capturing options |
|---|---|
Emails | Forward the email to your official government email account and save it as per your public authority's recordkeeping procedures. |
Messaging App Social media accounts | Capture according to your device or social media platform. Options include:
|
Text messages | Capture according to your device and the type of interaction. Options include:
|
Deciding what needs to be captured
You need to capture all public records. This includes any public record made, received or kept by you on behalf of your public authority in the course of conducting public authority business.
Find out more about what public records you need to capture. You can also use the information guide for deciding what you need to keep .
The following table provides examples and scenarios to help you determine what public records received or made in private accounts, apps or devices need to be captured as public records.
| Example | Public record? |
|---|---|
An email received in the private email account of the Director-General of the Department XYZ asking about the outcomes of a meeting held for which both parties were present. | Yes |
An email sent by a lobbying organisation requesting a meeting to discuss the future of industry XYZ in Queensland sent to the private email account of an employee of a public authority who is known to the lobbying group personally. | Yes |
Text message sent to public servant on private phone regarding update on current issues regarding disaster situation during cyclonic activity. | Yes |
Photos taken on a personal phone of actions from a business unit meeting captured on a whiteboard. | Yes |
Emails sent and received from private accounts while working from home or off-site, where access to work accounts is not available. | Yes |
Using a private social media account to share an official post or information about a business activity. | No |
Using a mobile app on a private device to receive access codes to allow an employee to securely access work systems off-site e.g. 2-factor authentication for Citrix, some work social media accounts etc. | No |
Disposal of public records
Public records can only be disposed of in accordance with the Public Records Act 2023.
Public records captured within an official government account, including those made or received within a private account or apps, or on a private device, need to be managed and disposed of in accordance with your public authority's recordkeeping procedures and the Act.
Once the public record has been captured into an official government account, the public record on your private account or device can be deleted.
Find out more about how to dispose public records.
Personal information contained within public records
Public records are made or received to provide evidence of the activities, affairs or business of the public authority. Personal, private, party-political, constituent or electoral public records should not be combined with, or included in public records.
This includes public records in any form including emails, letters, text messages, apps, social media posts, spreadsheets, etc.
This also applies regardless of where the public record is made or received, including whether the public record is made or received in official or private devices or accounts.
If other types of information are in a public record, it becomes part of that public record and must be kept for as long as that public record is required to be retained in accordance with an authorised retention and disposal schedule.
It is not possible to redact or black out information in a public record, as a public record must be complete and reliable. This includes any permanent value public records that are transferred to QSA and will become available for access by the public.
More information
For more information see our advice on:
- Ministerial public records policy
- Roles and responsibilities of mayors and councillors
- Local government public records
- Private email use policy
- Emails
- Text and instant messages
- Meetings and conversations
- Social media and Yammer
- Mobile and smart devices
- Surveillance and monitoring public records
- Use of ICT Services, Facilities and Devices policy (IS38).