Seán Fleming (Laois-Offaly, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

185. To ask the Minister for Health if his Department uses any system software for the auto-deletion of email messages; if so, his Department's guidelines on the use of such a system; and the length of time emails are stored before they are auto-deleted [25182/15]

Leo Varadkar (Dublin West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

My Department uses industry standard email security devices to assess potential threats in incoming and outgoing mail. It operates a shared ICT service which, in addition to supporting the business of the Department of Health also provides IT support to the Department of Children and Youth Affairs, the Adoption Authority of Ireland and the Office of the Ombudsman for Children.

A small number of blacklisted spam addresses, confirmed as nuisance or potentially dangerous, are (without notification) not accepted or routed to intended recipients. Other scanned mails are automatically quarantined based upon their content (for example profane language, virus infection or potential spam) and notifications are issued to the sender and the intended recipient. These may be released, if required, within 10 to 30 days of being quarantined.

All internal emails, and external emails that are accepted by the email security devices, are digitally signed, encrypted and written to a mail archive. These remain retrievable even after messages have been manually deleted. In addition, all email servers are backed up on monitored schedules.

The use of the Department's email system are governed by the Acceptable Usage Policy, the Records Management Protocol (RMP) and Data Retention Policy (DRP), which apply to all staff, and specify the treatment of Departmental records whether in physical or electronic form. Similar policies are in place for those using our shared services.

The RMP provides staff with information and advice on the relevance of emails as Departmental records. The DRP clearly states that no data whether held on physical or electronic media should be earmarked for disposal unless due regard has first been given to the key disposal/retention considerations, including the Data Protection Acts 1998-2003, the Freedom of Information Acts 1997-2014 and the National Archives Act 1986.