Clerk & Recorder Has Insufficient Protection for Information
Published on May 20, 2021
DENVER – The Clerk and Recorder’s Office is working toward digitization of documents without taking sufficient measures to protect personally identifiable information and without a strategic plan that properly protects historical documents, according to a new audit report from Denver Auditor Timothy M. O’Brien, CPA.
“I admire Clerk Paul Lopez’s goal to digitize the city’s records and make documents more transparent and accessible,” Auditor O’Brien said. “However, the office needs to have a solid plan to protect the city’s most important information, including the personal data of our residents and the documents showing the rich history of Denver.”
Our audit examined the Recording Division’s responsibility for preserving and distributing records, as well as making that information available online to the public and other city agencies. The city’s elected Clerk and Recorder requested this audit.
Our audit team found that certain personally identifiable information was mishandled at the Office of the Clerk and Recorder, the specific details of which were communicated separately to the management due to their sensitive nature. Although state law does not specifically require the redaction of certain information and the office is not required to follow the mayor’s executive orders, standard practices still indicate this should be done.
We also found the office provides no disclosure to individuals and organizations regarding e-recorded documents and mail-in documents becoming part of the public record when posted in the online records database.
“The public needs to know what it means for their recorded documents to be part of the public record,” Auditor O’Brien said. “Specifically, management should do all it can to protect sensitive information and to ensure members of the public understand their information will be posted online.”
Denver residents and other individuals could be exposed to identity theft if their personally identifiable information is posted publicly in the online records database. Management told us during the meeting of the independent Audit Committee that they are working to balance proactive protection of individual information going forward, along with retroactively looking at privacy concerns related to documents going back decades.
The Clerk and Recorder’s Office initially said they did not have the resources required for the additional technology and labor that would be needed to undertake a redaction project. However, management did eventually agree with all of our recommendations to help better protect the public’s information while still ensuring accessibility and transparency.
“I appreciate how Clerk Lopez has embraced our audit work and how it can be used to help them strengthen their work on behalf of the people of Denver,” Auditor O’Brien said. “The office has taken our findings seriously and they tell me they are already taking action, which is an example I would hope to see more agencies follow.”
When it comes to handling Denver’s oldest documents correctly, the Clerk and Recorder’s Office needs to improve how it designates and saves historical records. The office identified digitization, preservation, and accessibility as central to their mission and strategies, however there are weaknesses in the preservation of historic documents and in the protection of sensitive information during the online publishing process.
Historical records have substantial value in telling the city’s story and should be kept indefinitely. But the audit team found the Clerk and Recorder’s Office did not have a standard for what is considered a historical record, and no one had been tasked with determining what records are historical.
It is likely that many historical records need to be digitized, but without a standard for determining what is historical, the office cannot know how many unscanned physical records have historical value. Without formal processes for handling, storage, and protecting records, those with historical value could be damaged or destroyed.
The office was also not evaluating or addressing risks to stored physical records – whether they are historical or not. Records should not be stored in basements, attics, or near any water pipes. They should be stored at the correct temperature and humidity levels and away from direct light.
However, some of the locations used for storage currently are underground, are near exposed pipes, or are in a building that has flooded in the past. The Clerk and Recorder keeps records in several rooms in the Webb Municipal Building and City and County Building. It also contracts with a third party for more storage facilities.
Additionally, certain media formats, like audio and video cassette, degrade over time. The office has records stored on both but has no plan to convert these records into a less risky, digital format.
Finally, we found that all of these elements and other strategies should be addressed in a comprehensive plan that ensures the efficiency and effectiveness of the division’s work. Management needs to implement a plan addressing records management to establish a timeline and document how the office is working toward its mission.
“Digitization and preservation need to be done in the right way to avoid errors or loss of documents,” Auditor O’Brien said.
Officials say they did not have a strategic plan because the previous administration did not leave one and the onset of the COVID-19 pandemic created delays in building a new plan. The current administration says its goal is to scan and preserve all records; however, there was no plan or timeline for the project. Office staff were unsure how many records still need to be scanned and they said scanning has been a low priority over the last several months.
Staff told our audit team there was only one employee responsible for scanning older records, and scanning occurs when records are requested by the public or other agencies. They also told us this individual has had to take on additional responsibilities due to extended office vacancies.
“Agencies across the city had to freeze hiring and keep positions vacant due to pandemic-related budget cuts,” Auditor O’Brien said. “Now that resources are returning to the city, I hope our audit work will help the Clerk and Recorder’s Office refocus staff priorities and do appropriate planning.
The Clerk and Recorder’s Office agreed to all our recommendations, which also included information about following retention policies, organizing staff efficiently, succession planning, and conducting needs assessments.
“Clerk Lopez says these issues are a high priority and they appear to be taking quick action. We will follow up on how the office addresses our recommendations,” Auditor O’Brien said. “I hope our recommendations and findings will help him build the framework for a reliable process and successful work.”
Read the Audit
AUDITOR TIMOTHY O'BRIEN, CPA
Denver Auditor's Office
201 W. Colfax Ave. #705 Denver, CO 80202
Follow us on Facebook Connect with us on Twitter
Read our Social Media Policy Here