Audit Report No. 201617-02

Page 1 of 13

Public Records Processing December 12, 2016

Audit Report 201617-02 Executive Summary The Florida Constitution, Article 1, Section 24, allows every person the right to inspect or copy any public record made or received in connection with the official business of any public body, officer, or employee of the state, or persons acting on their behalf, except with respect to records exempted or specifically made confidential by the Constitution. Section 119.01, Florida Statutes, (F.S.), defines public records and specifies it is the duty of the Department to provide access to public records upon request. Public records are documents, paper, letters, maps, books, tapes, photographs, films, sound recordings, data processing software or other material, regardless of physical form, made or received in connection with the transaction of official business by any agency. The Department’s goal is to ensure all public records requests are handled promptly and in accordance with applicable laws. The purpose of this audit was to review the efficiency and effectiveness of the processing of public records requests, and determine compliance with applicable laws and Department policy and procedure. During our review of the processing of public record requests, we noted the following key areas in which improvements could be made:

Strengthening coordination and applying consistent practices would improve processing of public records requests;

Fully implementing GovQA would enhance availability of public records to customers and would streamline internal handling and tracking of requests; and

Providing training for division coordinators specific to their role and responsibilities in processing public record requests would enhance the process.

Audit Report No. 201617-02

Page 2 of 13

Background and Introduction The Florida Constitution, Article 1, Section 24, allows every person the right to inspect or copy any public record made or received in connection with the official business of any public body, officer, or employee of the state, or persons acting on their behalf, except with respect to records exempted or specifically made confidential by the Constitution. Chapter 119, F.S., also known as the Public Records Law, states that the public is entitled access to all public records except documents meeting any exemptions identified in Florida Statutes. According to Section 119.011 (1), F.S., public records are defined as documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of physical form, characteristics, or means of transmission, made or received in connection with official business by any agency. Section 119.01, F.S., specifies all such materials, regardless of whether they are in final form, are open for public inspection upon request unless the Legislature has exempted them from disclosure. The Department’s goal is to ensure all public records requests are handled promptly and in accordance with applicable laws. Department Policy 9.03, Providing Records to the Public, specifies the roles and responsibilities of Department members regarding handling public records requests. The Department’s Public Records Coordinator in the Office of General Counsel is primarily responsible for the Department’s public records program and is also the liaison between the Department and the Governor’s Office of Open Government for purposes of training and compliance. While requests for records are received in many areas of the Department, the Public Records Coordinator manages large records requests involving data from multiple sources, and serves as the subject matter expert for questions regarding providing records to the public. Additionally, each division is required to appoint a division coordinator to coordinate requests for providing public records owned by that division. Requesting and Processing Public Records Anyone can request a public record by contacting the Department through mail, telephone, email, facsimile, in person, or even through social media. A public record request can vary in formality—from a simple telephone call requesting one document, to a composed letter that cites the public records law—and can be made orally or in writing. The request usually includes a description of the information requested and contact information for the requester, although the requester can remain anonymous if they so choose. The Department is required to make non-exempt records available for

Audit Report No. 201617-02

Page 3 of 13

inspection and copying upon request; however, if the requested record does not exist, the Department is not required to create it. Because of the broad way in which Florida’s public records laws are applied, any Department member could potentially be the recipient of a records request. Department Policy 9.03 requires Department members to acknowledge requests for public records as received within two business days. All public records requests should be referred to the Department Public Records Coordinator or the appropriate division coordinator or division point of contact. The Public Records Coordinator or division coordinator will determine whether the request is routine and can be handled immediately, or will require additional time. If the request is routine, the Public Records Coordinator or division coordinator will assign for handling. If non-routine, the division coordinator will inform the Department Public Records Coordinator who will determine the best course of action for processing the request. The Department uses a web-based electronic database and tracking system, GovQA, to track and manage public records requests. GovQA is designed to be hosted on the Department’s website so requesters have the ability to make a request, track the status of their requests, and communicate with the Department concerning requests online through the system. The ability to search for answers to common public records questions and access to regularly requested information on the Departments’ web page is also a function the GovQA system is capable of providing. Cost for Records Fees charged for public records requests vary between divisions/bureaus within the Department based on record type. The Public Records Law allows the Department to collect the actual cost of material and supplies used to duplicate public records for requesters. The Department may also collect a service charge when a request for public records requires the extensive use of Department resources. Extensive use is defined in Department Policy 9.03 as any public records request that requires more than 30 minutes of labor. Fees charged for some records are statutorily mandated. For example, Section 321.23, F.S., sets the cost of a traffic crash report at $10, a traffic homicide report at $25, and Section 112.218, F.S., allows the Department to charge $0.50 per page for copies of personnel files.

An estimate of the charges should be provided to the requestor and all charges should be collected prior to fulfilling the request. If the cost for providing paper or electronic copies of records is less than $5, the records are provided at no charge, unless the fee is required by statute. Fees are waived for requests made by other government agencies.

Audit Report No. 201617-02

Page 4 of 13

Confidential and Exempt Records Confidential public records have been identified in statute as confidential. The information in these records is not subject to inspection by the public and may be released only to persons and entities designated by statute or court order. Exempt records are records that have been identified in statute as exempt from public inspection. In certain circumstances, releasing protected documents is a felony under the Florida Criminal Code. The Driver's Privacy Protection Act of 1994 (also referred to as "DPPA"), is a United States federal statute governing the privacy and disclosure of personal information gathered by state departments of motor vehicles. DPPA restricts public access to personal information such as social security numbers, driver license or identification card numbers, names, addresses, telephone numbers, and medical or disability information contained in motor vehicle and driver license records. Non-personal information such as vehicular crash records, driving violations, and driver status are considered public information. All exempt records or information must be redacted prior to releasing the records to the public. If a record contains information that is exempt, only that portion for which the exemption applies should be redacted and the remainder of the record should be provided.

Findings and Recommendations During our review of the processing of public records requests, we noted the following key areas in which improvements could be made:

Processing Public Records Requests Finding No. 1: Strengthening coordination and applying consistent practices would improve processing of public records requests. Department Policy 9.03, Providing Records to the Public, states that the Department’s Executive Director shall designate a member to serve as the agency’s public record/open government contact. The policy further states that each division will appoint a division coordinator to coordinate requests for providing public records owned by that division, and that if the nature or volume of public records requested requires extensive use of Department resources, additional costs to cover such extensive use of Department resources may be charged.

Audit Report No. 201617-02

Page 5 of 13

We interviewed Department members responsible for processing public records requests and determined there is confusion and inconsistencies between divisions in how public records requests are received and processed. Specifically, we noted the following differences:

There are not official appointed division coordinators in each division. Instead, requests are handled by points of contact in certain division units;

Several divisions/bureaus have multiple business email addresses that receive records requests. It is that division/bureau’s responsibility to monitor requests received through those channels, and to add those requests to GovQA; however there is no assurance that all requests received, no matter the method in which they were received, are entered into GovQA for tracking purposes;

Some divisions/bureaus maintain a spreadsheet to track requests received, and only enter some requests into GovQA;

Requests are not always routed through division coordinators/contacts;

Depending on who made the request, there is confusion as to whether the request is considered a public records request (For example, requests made by other governmental entities);

Some payments for public records requests are being mailed to the business area handling the request, while others are being collected through the mailroom accounts receivable process; and

Costs to cover extensive use of Department resources are being calculated differently. Some divisions are using the hourly rate of the lowest paid person as stated in the definition section of Department Policy 9.03, some are using the hourly rate plus benefits as stated in the procedures section of Department Policy 9.03, and some are not charging at all because they are unsure of the correct way to calculate the cost.

Recommendations We recommend the Office of General Counsel request each division appoint an official public records division coordinator. We also recommend the Office of General Counsel provide formal guidance to division coordinators/contacts on the following:

Defining what requests are considered public records requests;

Coordinating and routing of public records requests using GovQA; and

Receiving payment for public records requests. We further recommend the Office of General Counsel clarify Department Policy 9.03 on calculating extensive use of resources fees and provide guidance to division coordinators/contacts.

Audit Report No. 201617-02

Page 6 of 13

Management Response We agree that each division should appoint an official public records division coordinator. Presently, the Department's Public Records Coordinator coordinates the compilation and production of public records with the office contacts, which are presently in place without the benefit of a division coordinator. Having an official public records division coordinator in each division who is dedicated to this task as his/her top priority would be a significant process improvement. The Office of General Counsel (OGC) will have official division coordinators appointed within the next 60 days. We agree that OGC should provide formal guidance to division coordinators and office contacts by conducting training to explain what a public record request is, how a public record request should be handled and routed through GovQA, how an estimate of the cost to produce public records should be calculated, and how payments should be processed. The OGC will provide formal guidance to division coordinators to explain what a public records request is and how to calculate the costs to produce public records within the next 90 days. The OGC will provide guidance on the coordination and routing of public records requests using GovQA within the next six months. We agree that OGC should clarify Department Policy 9.03 concerning the calculation of extensive use of resources fees and provide guidance to division coordinators and office contacts in that regard. The OGC will clarify Department Policy 9.03 concerning calculation of extensive use of resource fees within the next 120 days. Tracking Public Records Requests Finding No. 2: Fully implementing GovQA would enhance availability of public records to customers and would streamline internal handling and tracking of requests. GovQA was purchased in August 2014, to provide a complete end-to-end customer service tracking solution, specifically to help the Department better meet its obligations under the Public Records Act by reducing staff time in preparation of public records responses and increasing transparency and availability of public records to customers. However, the full capabilities of the system have not been activated since its purchase, and the current partial implementation does not allow the Department to use the program as intended. According to the GovQA Public Records Software Project Charter and procurement documents, to increase transparency and availability of public records to customers, GovQA was to be hosted on the Department’s website with requesters having the ability to make a request, track the status of their requests, and communicate with the

Audit Report No. 201617-02

Page 7 of 13

Department concerning those requests online through the system. Requesters should also have the ability to search for answers to common public records questions and have access to regularly requested information electronically on the Department’s web page. Through interviews, we determined only three offices (out of 18 interviewed) are using GovQA closely to its intended purpose; including entering public records requests when received, using GovQA to send an automatic response to the requester that their request was received, uploading the requested records, and using the system to reply back to the requester with their requested documents. Most offices are only using GovQA as a database to enter basic information for records requests, and some are not using GovQA at all. Additionally, GovQA is not presently hosted on the Department’s website, and public records requests are being received through multiple channels and by many Department members. It is up to the Department member who receives the records request to manually enter the request into GovQA for tracking purposes. Furthermore, during interviews with Department members who have an active role in processing public records requests, we determined one bureau only saves emails regarding public records requests and has no formal way to track requests because they do not have access to GovQA. If used as intended, GovQA can significantly reduce repetitive work in locating and appropriately redacting information to respond to duplicate or repeated requests for the same information. Tracking the receipt of requests and the responses through GovQA provides needed documentation to demonstrate that the Department abides by the requirements of the Public Records Act. Implementing the portal function of GovQA and allowing the public to use an electronic form on the website to request public records would enhance the availability of public records to customers. Recommendations We recommend the Office of General Counsel fully implement GovQA to reduce liability risks, reduce staff time in preparation of public records responses, and increase transparency and availability of public records to customers. We also recommend the Office of General Counsel ensure Department members who have an active role in processing public records requests are granted access to GovQA.

Audit Report No. 201617-02

Page 8 of 13

Management Response We agree that GovQA should be fully implemented and made available to the public to ensure the tracking of all requests and streamline the production of requested documents. OGC will conduct training to ensure full implementation and compliance with all relevant laws. The OGC will develop a plan to fully implement GovQA within the next 90 days with full implementation expected within the next six months. Full implementation will reduce liability risks and improve customer service but may increase staff time in preparation of public record responses. We agree that all members with an active role in processing public record requests should be granted access to GovQA. The OGC will make sure all members who have an active role in processing public record requests are granted access to GovQA within the next 90 days. Training Finding No. 3: Providing training for division coordinators/contacts specific to their role and responsibilities in processing public records requests would enhance the process. Training is important for an organization’s development and success—both for new members and as a refresher for existing members. Department Policy 9.03 states the Learning and Development Office will work with the agency public records/open government contact to establish a Department-wide training program for all members who are authorized to release public records. The policy further states the Learning and Development Office will continually monitor changes to legislation and to Florida Department of State rules and regulations relating to public records, and recommend additional member training as needed. Currently, all Department members are required to take annual Records Management training. The training contains basic information for managing and providing records to the public. The Department does not provide training for division coordinators specific to their role and responsibilities in processing public records requests for their division. During interviews, members who have an active role in processing public records requests believed they could benefit from more detailed training specific to their role and responsibilities; including topics such as who is responsible for redaction, DPPA information and exemptions, and the difference between providing records for a public records request versus providing records during the normal course of business.

Audit Report No. 201617-02

Page 9 of 13

Recommendations We recommend the Office of General Counsel coordinate with the Learning and Development Office to implement training specifically for division coordinators/contacts responsible for processing public records requests. We also recommend the Office of General Counsel implement periodic training meetings for division coordinators/contacts to discuss issues relevant to processing public records requests. Management Response We agree that OGC should provide on-going training for division coordinators and office contacts in coordination with LDO. Regular meetings to discuss issues of concern and the processes in place would be productive. Within the next six months, the OGC and LDO will develop and implement a training program for division coordinators/contacts responsible for processing public records requests. The OGC will implement a plan to hold quarterly meetings with all division coordinators/contacts to discuss issues relevant to the processing of public record requests within the next 90 days.

Purpose, Scope, and Methodology

The purpose of this audit was to review the efficiency and effectiveness of the processing of public records requests, and determine compliance with applicable laws and Department policy and procedure. The scope included all aspects of the Department’s process for receiving, filling and tracking requests received from March 1, 2016 through August 31, 2016. The methodology included:

Reviewing applicable statutes, rules, and procedures;

Reviewing the methods used to process public records requests;

Reviewing acquisition and procurement documentation for GovQA;

Reviewing training documents specific to processing public records requests; and

Interviewing appropriate Department staff.

Audit Report No. 201617-02

Page 11 of 13

ATTACHMENT - Management Response

Audit Report No. 201617-02

Page 12 of 13

Audit Report No. 201617-02

Page 13 of 13