Excerpts from the National Archives and Records Administration regulations in Title 36 CFR
Beginning at PART 1220—FEDERAL RECORDS; GENERAL.
I would ask HRC to address how each of these items are addressed during use of a private email server.
(just an excerpt and many more line items that make a private server highly questionable and not in compliance with regulations ie Title 36 CFR)
https://www.ecfr.gov/cgi-bin/text-idx?SID=2cb32d56fb6af59e4b4ee022f092b321&mc=true&node=pt36.3.1220&rgn=div5
§1220.34 What must an agency do to carry out its records management responsibilities?
To carry out the responsibilities specified in 44 U.S.C. 3101 and 3102, agencies must:
(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in §1220.32;
(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance, storage, and disposition practices into agency programs, processes, systems, and procedures;
(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation, in accordance with 36 CFR parts 1225 and 1226 of this subchapter;
(h) Comply with applicable policies, procedures, and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget, NARA, GSA, or other agencies, as appropriate (see §1222.22 of this subchapter);
(i) Institute controls ensuring that all records, regardless of format or medium, are properly organized, classified or indexed, and described, and made available for use by all appropriate agency staff; and
(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices, and to ensure that they comply with NARA regulations in this subchapter.
§1222.20 How are personal files defined and managed?
(b) Personal files must be clearly designated as such and must be maintained separately from the office's official records.
(1) Information about private (non-agency) matters and agency business must not be mixed in outgoing agency documents, such as correspondence and messages.
(2) If information about private matters and agency business appears in a received document, the document is a Federal record. Agencies may make a copy of the document with the personal information deleted or redacted, and treat the copy as the Federal record.
§1222.34 How must agencies maintain records?
Agencies must implement a records maintenance program so that complete records are filed or otherwise identified and preserved, records can be readily found when needed, and permanent and temporary records are physically segregated from each other or, for electronic records, segregable.
(d) Institute reference and retrieval procedures and controls that:
(1) Facilitate the finding, charging out, and refiling of records, including safeguards against loss during transit; and
(2) Ensure that access to electronic records minimizes the risk of unauthorized additions, deletions, or alterations;
§1236.10 (a) Reliability: Controls to ensure a full and accurate representation of the transactions, activities or facts to which they attest and can be depended upon in the course of subsequent transactions or activities.
(b) Authenticity: Controls to protect against unauthorized addition, deletion, alteration, use, and concealment.
(c) Integrity: Controls, such as audit trails, to ensure records are complete and unaltered.
(d) Usability: Mechanisms to ensure records can be located, retrieved, presented, and interpreted.
(e) Content: Mechanisms to preserve the information contained within the record itself that was produced by the creator of the record;
(f) Context: Mechanisms to implement cross-references to related records that show the organizational, functional, and operational circumstances about the record, which will vary depending upon the business, legal, and regulatory requirements of the business activity; and
(g) Structure: controls to ensure the maintenance of the physical and logical format of the records and the relationships between the data elements.