What Are The Data Protection Rules When Using Private Email And Messaging Apps For Business?

• Published date: 09 September 2022
• Subject Matter: Privacy, Data Protection
• Law Firm: Harrison Drury Solicitors
• Author: Mr Charles Mather

Charles Mather of Harrison Drury's regulatory and compliance team outlines the risks in using private email and messaging applications such as WhatsApp within the business environment.

In July 2022, the Information Commissioner's Office (ICO) released a report, titled 'Behind the screens - maintaining government transparency and data security in the age of messaging apps'.

The report provides the findings of the ICOs investigation, launched by the Information Commissioner in 2021, into the use of private email, WhatsApp and other messaging platforms used by ministers and officials at the Department of Health and Social Care (DHSC) during the pandemic.

While the investigation was focused upon the DHSC, the findings of the report have important implications for business.

The inherent risk of using social messaging platforms

Where company staff use private electronic channels, such as private email or WhatsApp as a communication tool in the course of their work, there is an inherent risk to the data security behind these communications.

That risk stems from the fact that these communications exist on platforms and in places outside the control of the business. This makes them less secure and outside the precautions and procedures that businesses may use to protect business data and team/client communication.

In addition, and in such a scenario, confidential information, including personal data and sensitive personal data, might be dispersed across a range of data centres that sit behind the email and messaging service providers; and may remain there for an indefinite period and beyond the control of the business.

Article 5(1) of the UK GDPR sets out the seven key principles that lie at the heart of the UK's data protection regime. These include: i) lawful, fair and transparent processing, ii) storage limitation, and iii) integrity and confidentiality.

Where company staff use private electronic channels to communicate, it is not difficult to imagine a...