Social media records

Last updated:

November 11, 2024

What is social media?

Social media is any technology-based environment that allows users to easily create, publish, collaborate on and share content.

Victorian Government agencies use web-based, internally hosted, or application-based social media environments, including the following:

Social media types	Examples
Web-based externally hosted	social networking sites, e.g. Facebook video and photo sharing websites, e.g. Flickr, YouTube, Instagram hybrid-style platforms, e.g. TikTok micro-blogging and activity stream sites, e.g. X (formerly Twitter), Viva Engage blogs and blogging platforms, e.g. WordPress, Blogger, Tumblr forums and discussion boards, e.g. Google Groups, Reddit online encyclopedias, e.g. Wikipedia instant messaging (including SMS), e.g. WhatsApp online pinboards such as Pinterest geo-spatial tagging including Foursquare or Google Maps online surveys including SurveyMonkey and Google Drive any other websites that allow individual users or companies to use simple publishing tools, e.g. wikis
Internally hosted	VPS Hub blogs including ‘comments’ or ‘your say’ features intranet
Applications built into business systems and devices	forums such as SharePoint and discussion boards Microsoft Teams chats and Teams groups

Why is government using social media?

Social media and related messaging technologies are used by public offices for a range of different purposes as a cost effective, instantaneous and responsive engagement tool.

Social media is a significant opportunity to deliver services, consult and communicate with private individuals and government stakeholders over a broad geographical area.

However, public offices should carefully consider the aims, benefits and risks of using any application before commencing use of social media.

Are social media posts public records?

The Public Records Act 1973 (s2) defines a public record as "any record made or received by a public officer in the course of [their] duties." This definition includes all messages sent, and responses received, by public officers when carrying out their duties, regardless of the:

medium used to send or receive the message
account name used to send or receive the message
role or seniority of the public officer sending or receiving the message.

Social media posts are records when...

Social media posts created or received by a public officer in the course of their duties are evidence of government business. They document the actions taken by public officers and should be managed as a record for reasons of accountability and transparency.

Types of social media posts include:

original posts on a social media site
responses, if any are received, to the original post
relevant posts identified when monitoring social media sites
content republished by the public office when the content has come from elsewhere.

Please note:

this applies whether the account used is one for the public office or the personal account of a public officer when being used for government business
copyright should always be considered before republishing messages.

Social media posts are not records when...

There is no intersection with their duties, private use of social media by a public officer is not considered to result in a public record and therefore does not need to be captured.

Setting social media policy and guidelines

Public offices are responsible for developing and implementing social media policy and guidelines, ensuring that they:

account for PROV recordkeeping and disposal requirements
consider interactions between recordkeeping requirements and other government obligations (e.g. privacy)
clearly state who may authorise or publish social media messages on behalf of the public office
outline how, when and where posts should be captured
provide advice on the responsibilities of government employees when using social media in a private capacity
consider how social media accounts will be monitored
are provided to all staff, including contractors and volunteers.

Public offices will need to capture and retain evidence of how their social media accounts are managed and monitored. What needs to be captured and how long it needs to be kept will depend upon the criticality of the social media content and the risks associated with it.

For further information see the PROV Value and Risk Policy and the PROV Online Recordkeeping Training pages.

Capturing social media records

What social media records should be captured?

Public offices should refer to PROS 19/05 Create, Capture and Control Standard and then conduct a risk assessment to determine:
• which social media posts will need to be captured to meet legislative, regulatory and business requirements
• the risk to their organisation and to the community if the social media posts are not captured.

Examples of social media content required to be captured may include (but are not limited to):
•   emergency warnings
•   communications activities
•   volunteer recruitment
•   complaints and feedback
•   crowd-sourced policy development

It is important when capturing social media records that both the content and the context of the post are captured. Linking the message to the context is vital to creating a narrative in which the record may be properly understood. A person viewing the social media record must be able to follow the story of what was said, when and by whom.

Capturing content

When capturing the content, the information that is sent or received as well as a representation of the format (text, visual, sound or video) of the original content should be captured (if appropriate, a text log of entries may be kept).

Capturing context

When capturing context, keep in mind that it should assist with the understanding of the message when it is viewed by a third party or at a later date. It should include at a minimum:
•   Date and time it was sent or received
•   For messages sent from a public officer/officer's account: the name of the public officer that sent the message, who authorised the message, and to whom it was sent (at a minimum a group address)
•   For messages sent to their account: the public officer (if different from who sent the original message) and account name that received the message, the person to whom it was sent, and the name used by the person who posted the message (no need to determine the sender’s actual identity)
•   The purpose of the message.
•   The name of the social media application that the message was published on.

See PROS 19/05 S2 Minimum Metadata Requirements Specification for more information.

Capturing conversation threads is a good way of retaining the context of a social media message.

How to capture social media records?

After establishing which social media records should be captured, a method for how to capture the posts will need to be chosen.

Methods of capture include:
• manually saving a screenshot of the post along with information regarding its context as a Word or PDF document
• using an automated application to capture posts.

Any automated process for capturing social media records should be able to store the metadata required to contextualise the message appropriately.

The metadata should communicate:
•   the relationship the social media record has with other records
•   the context that the social media was used in (for example, a statement or a reply)
•   any other related documents that help make the social media usage understandable.

Agencies should thoroughly investigate the specifications and Terms of Service for any commercially available product before commencing its use to ensure the product meets their capture, privacy and security needs. Many services for backing up social media records require the data to be stored on a cloud computing system. If a service is cloud-based, agencies should be aware of the legal and privacy implications of storing data in a cloud computing system before subscribing to any back-up service.

Agencies should implement a regular review of any automated processes used to capture social media posts. Agencies should also undertake reviews if/when terms of service or major shifts in functionality occur in the technology used to undertake automatic record capture.

How soon after posting should social media records be captured?

Social media posts should be captured as soon as possible after posting as there is no guarantee how long they will remain online.

Timely record capture may be required for performance review, Ombudsman or Royal Commission purposes and may support decisions made in critical situations.

Capture frequency may occur at the end of each day or week, or other time period, as deemed appropriate by the public office. Your risk assessment will help you to determine how frequently posts should be captured.

Agencies should:
• set guidelines outlining when a record should be captured, which should provide for the priorities associated with the value of the record in question (for more information see the high value, high risks records topic page)
• always be conscious of the fact that externally hosted social media sites have no guarantee of long-term access to the post or message once it is sent.

How long do social media records need to be kept for?

The retention period for any record is set based on the purpose, content, or result of the communication and not by the format of the record. Therefore, there is no ‘one-size-fits-all’ answer with regard to how long social media records should be kept.

Public offices should refer to relevant Retention and Disposal Authorities (RDAs) issued by PROV to determine retention and disposal actions for their social media records.

Records of irrelevant, ephemeral and off-topic responses (including, for example, spam responses created by unaffiliated 'bot' accounts) can be culled under Normal Administrative Practice (NAP).

How do we protect privacy in social media records?

All public officers are bound by the Information Privacy Principles in the Privacy and Data Protection Act 2014, regardless of the format of the records they create.

See Office of the Victorian Information Commissioner for further information.

How does copyright apply to social media?

Copyright restrictions may vary between social media sites. Agencies need to be aware of the Terms of Service of all social media outlets utilised to ensure appropriate copyright measures are taken.

See Copyright on social media for further information.

Social media, artificial intelligence and emerging technologies

Social media is a fluid space where new technologies are often implemented without formal user consultation. This requires government bodies using social media to regularly review new features to assess their alignment with policy and recordkeeping requirements. An example of one such development is the introduction of Artificial Intelligence (AI) tools into major social media apps (e.g. Facebook's Meta AI, Snapchat's My AI, TikTok's Creative Assistant, Microsoft's Copilot).

While there are possible benefits provided by the utilisation of these tools, they must be met with caution given the risks associated with their use. Potential recordkeeping issues raised by AI use in social media include, but are not limited to:

confidentiality of information (especially with open web-hosted models)
lack of clarity surrounding authorial attribution
accuracy of information
ability to adequately capture context.

As such, PROV would recommend a robust recordkeeping risk assessment be undertaken prior to authorising any use of these tools.

See the topic page on AI for further information.