Highly regulated industries must be especially careful with social media records. Guidance on social media from the Financial Industry Regulatory Authority (FINRA) states that firms engaged in the buying and selling of securities (referred to as "broker-dealers") must retain records of all communications related to business as such made through social media sites.
Records managers in financial services must also be aware of the FINRA ban on the use of communication devices containing technology that automatically deletes content in electronic communications. This ban also applies to sponsored social media sites.
The mortgage industry must also be careful about social media. The New York State Department of Financial Services requires licensed mortgage bankers to adopt internal policies that regulate employee social media use, specify information that may be posted on social media, and provide examples of postings that could trigger penalties or disciplinary action.
Once tweets, blogs and other social media content become part of your official records and information management program, you’re compelled to enact privacy and security best practices. So how is your business dealing with the legal and regulatory consequences?
Best practices for social media records are still emerging. As you seek to develop a solution that works for your organization, the National Archives' guidance on social media and electronic records can be a helpful resource. Though developed for federal agencies, it applies to many of the same issues faced by enterprises.
When crafting social media records policies, think of posts and blogs like all other electronic records. First, determine if the content is a business record. If so, ascertain how to approach data storage to ensure social media content is not altered. Next, determine how long to keep it based on regulatory, legal and business requirements. It's essential to keep metadata intact so it's never in question who posted the content, where and when.
But social media has its own nuances, too. A good chunk of an organization's social media content likely sits on vendor servers. This makes it vital that records managers understand the vendors' retention policies and work with vendors to ensure that content is held in a manner compliant with enterprise policies. This may entail accessing all posts and storing them in an online data storage repository, where the records manager can control retention and destruction.
Social media content is often interactive, which can pose a challenge. Social media pages must be stored in a way so that links and playable video remain intact.
Records policies will need frequent fine-tuning in the digital age. Social media records are another enduring information change requiring agile and informed records management.