IFM-PR-002: Information Ownership and Data Custodianship

• Right to Information Act 2009 (Qld) (new window) ss. 21, 47 http://www.legislation.qld.gov.au/LEGISLTN/CURRENT/R/RightInfoA09.pdf
• Education (General Provisions) Act 2006 (Qld) (new window) ss. 373, 426 http://www.legislation.qld.gov.au/LEGISLTN/CURRENT/E/EducGenPrA06.pdf
• Information Privacy Act 2009 (Qld) (new window) Schedule 3, ss. 1, 2 http://www.legislation.qld.gov.au/LEGISLTN/CURRENT/I/InfoPrivA09.pdf
• Public Records Act 2002 (Qld) (new window) Section 8(1) http://www.legislation.qld.gov.au/LEGISLTN/CURRENT/P/PublicRecA02.pdf

• Information Standard 18 (IS18): Information Security http://www.qgcio.qld.gov.au/qgcio/architectureandstandards/informationstandards/current/Pages/index.aspx
• Information Standard 31 (IS31): Retention and Disposal of Public Records Principles 1-2 http://www.qgcio.qld.gov.au/qgcio/architectureandstandards/informationstandards/current/Pages/index.aspx
• Information Standard 34 (IS34): Metadata Principles 1-3 http://www.qgcio.qld.gov.au/qgcio/architectureandstandards/informationstandards/current/Pages/index.aspx
• Information Standard 40 (IS40): Recordkeeping Principles 1-7 http://www.qgcio.qld.gov.au/qgcio/architectureandstandards/informationstandards/current/Pages/index.aspx
• Information Standard 44 (IS44): Information Asset Custodianship Principles 1-3 http://www.qgcio.qld.gov.au/qgcio/architectureandstandards/informationstandards/current/Pages/InformationAssetCustodianship.aspx

• IFM-PR-008: Managing the Department's Records /strategic/eppr/information/ifmpr008/
• IFM-PR-006: Maintaining the Security of Department Information and Systems /strategic/eppr/information/ifmpr006/
• IFM-PR-009: Applying Metadata to Web Pages and Departmental Records /strategic/eppr/information/ifmpr009/
• IFM-PR-007: Intellectual Property /strategic/eppr/information/ifmpr007/
• IFM-PR-010: Managing Electronic Identities and Identity Management /strategic/eppr/information/ifmpr010/
• LGS-PR-008: Access to Departmental Information /strategic/eppr/legal/index.html
• IFM-PR-005: Access to Records Held in Schools /strategic/eppr/information/ifmpr005/

Statement of intent

The department is committed to effectively managing information ownership and data custodianship. Information ownership and data custodianship provide a means of achieving accountability for, and reliability of, information resources. The implementation of this procedure will ensure quality, security, integrity, correctness, consistency, privacy, confidentiality and accessibility of information assets.

IFM-PR-002: Information Ownership and Data Custodianship applies to all departmental business units, including schools, TAFE Institutes, corporate and regional offices. It is considered that TAFEs and those that have become statutory authorities would benefit from adopting consistent management practices for information ownership and data custodianship practices.

Information ownership for specified data collections will be delegated to a departmental position to fulfil the responsibilities detailed in this policy. Each data collection will have a single delegated information owner.

Custodianship responsibilities will be delegated by information owners to a position which:

• has greatest operational need for the data entity
• has delegated responsibility for collecting and/or maintaining the data entity
• is most competent person or in best position to maintain the data entity, or has capability to manage the data over the life of the data entity
• requires highest level of integrity and accuracy of the data set
• Access to data is to comply with relevant legislative requirements, LGS-PR-008: Access to Departmental Information, guidelines and standards.

Activities of data custodians may be outsourced to other departmental units or under contractual agreement to external parties. Custodianship responsibilities remain at all times with the delegated position.

Responsibilities

• approve IFM-PR-002: Information Ownership and Data Custodianship and any subsequent reviews, amendments or associated departmental guidelines developed to operationalise this policy.

• specify information requirements for specific data entities
• specify information management requirements
• define and document business rules, including any changes
• classify information with respect to exposure and access
• define the life cycle of each information element
• delegate custodianship responsibilities to a relevant staff member.

• determine optimal way to satisfy information requirements
• determine and engage custodial service providers
• negotiate agreements or contracts with custodial service providers, and seek advice from Legal and Administrative Law Branch where necessary
• measure and report compliance with requirements
• identify and resolve any non-compliant procedures or processes
• maintain metadata for each data entity and provide metadata with all data supplied in accordance with IFM-PR-009: Applying Metadata to Web Pages and Departmental Records
• store and maintain data collections, including archiving and regular integrity checks of current data to ensure that data has not been modified without authorisation, or accidentally corrupted
• maintain departmental data directory information for delegated data entities
• adopt international, national or whole of government data standards where practicable. In the absence of accepted or documented standards, develop any necessary standards in consultation with users and in accordance with departmental information management procedures
• facilitate easy access by authorised internal and external users, ensuring that appropriate access control mechanisms are in place
• ensure information security mechanisms are in place to protect data from unauthorised access or modification, or accidental loss or corruption
• ensure adherence to information privacy principles (new window)
• disclose to clients any known deficiencies in quality of data provided
• ensure that all rights needed for service delivery with respect to data have been properly obtained, including intellectual property rights in accordance with IFM-PR-007: Intellectual Property

The following diagram illustrates the various relationships between information owners, data custodians and custodial service providers

• ensure compliance with IFM-PR-010: Managing Electronic Identities and Identity Management and related standards in the provision of electronic identities to departmental business systems which may include creating and managing internet accounts, email accounts and network access passwords.

• provide advice on departmental agreements and service contracts in relation to intellectual property issues in accordance with IFM-PR-007: Intellectual Property
• provide advice in respect of the terms and conditions on any written licence agreement.

Forms

• Not Applicable

• Privacy Guideline Section 11 - the Information Privacy Principles (new window)

Other relevant documents

• Definitions/strategic/eppr/information/ifmpr002/definitions.html

Contacts

For further information about information ownership and data custodianship, please contact:

• IFM-PR-002: Information Ownership and Data Custodianship - Version: 1.0, 2.0