OAR 166-017-0015
General Requirements
(1)
Agencies must ensure that all public records in all formats or mediums, including electronic, are maintained in accordance with an applicable records retention schedule approved by the State Archivist.(2)
Agencies must develop policies and procedures and perform periodic reviews to monitor compliance to agency policies regarding access, use, retention, and disposition of electronic records.(3)
In accordance with their contracting authority, agencies may contract with external vendors for the storage or management of electronic records. The vendors must comply with all rules in OAR 166, Division 17. Agencies must not enter into a contract with any person or entity if the contract will impair the right of the public to inspect or copy the agency’s nonexempt public records, including contracts where the custody of the records is transferred, either purposefully or inadvertently, from the agency to the hosting entity.(4)
Contracting agencies must ensure that vendors manage agency records in compliance with all rules in OAR 166, Division 17. Contracts for the storage of electronic records by external vendors must require the vendor to comply with OAR 166, Division 17 and to return all electronic data files and indexing information to the agency at the expiration of the contract or upon vendor failure to comply with OAR 166, Division 17.(5)
Agencies must ensure that electronic public records are accessible to the public for their entire authorized retention period and that non-permanent records are destroyed at the end of their authorized retention period. Agencies must also maintain confidentiality for electronic public records that are exempt from public disclosure.
Source:
Rule 166-017-0015 — General Requirements, https://secure.sos.state.or.us/oard/view.action?ruleNumber=166-017-0015.