Messaging Platforms in the Workplace – Data Protection Considerations
17th October, 2024
Messaging platforms have rapidly become a leading form of communication between colleagues, clients and business contacts, but this has the potential to create significant risks for organisations.
Data Protection
The use of informal messaging platforms in a work context raises challenges and data protection concerns as the lines between our private and professional lives become blurred.
In data protection terms, think about the following:
- is personal data shared via messaging apps held securely and subject to adequate security?
- Has the sharing of information been subject to a Data Protection Impact Assessment?
- If work is being carried out via WhatsApp is the messaging app a processor in those circumstances? Bear in mind that Article 28 requires a controller to have a contract in place with a processor.
Remember always that it is a controller’s responsibility to make sure that staff are properly trained and aware of data protection obligations.
Messaging Platforms and Dangers of Workplace Use
Messaging on these platforms is typically quite casual and often unguarded, which can lead to inappropriate or derogatory language being used. Users often appear to believe that such platforms, like a WhatsApp group chat, are private but if the platforms are used to discuss work-related matters they can create liability for the organisation.
As an example, in Abdi v Deltec International Courier Limited, the Employment Tribunal found that racial slurs made in a WhatsApp group chat that included senior management amounted to unlawful harassment, even though the messages were shared on personal mobile phones. The messages were made in connection with employees’ duties at work or contained information about other employees and hence these messages were considered disclosable as part of the Tribunal proceedings.
From a litigation perspective, where relevant documents are created via messaging platforms like WhatsApp, they will be disclosable in the event of a dispute. Any notion that WhatsApp and similar messaging platform communications are ‘private’ and not disclosable is a myth. Indeed, the opposite is true and lawyers and litigants in person know that these platforms are will often contain highly relevant documents. If these messages are not preserved and disclosed then there can be serious consequences.
A further complication arises in that often these platforms are not likely to be under the organisation’s direct control and they may not have access to the messages unless individual employees provide that access. Even corporate messaging systems such as Teams can be difficult to search centrally.
Reducing the risk
In an effort to control the sharing of corporate and personal data on such messaging platforms and to mitigate the risks, it is important to consider raising awareness, setting clear boundaries, and training staff on the appropriate use of messaging platforms. Some of the ways to mitigate risk include the following:
- Introducing a fair and transparent policy in relation to the use of messaging platforms.
- Setting clear boundaries in relation to acceptable/unacceptable content, and in particular making clear that confidential and/or personal data should not be shared on e.g. WhatsApp.
- Training employees to recognise the risk and consequences of inappropriate use, including that messages will need to be disclosed in the event of a dispute
- Consider whether such methods of communication are actually necessary to your business and if they are, whether centralised corporate messaging platforms (like Teams or Slack) can be used instead.
If you have any questions about this, or any other issues relating to data, please do get in touch with our expert Data Protection team.
Please note that this briefing is designed to be informative, not advisory and represents our understanding of English law and practice as at the date indicated. We would always recommend that you should seek specific guidance on any particular legal issue.
This page may contain links that direct you to third party websites. We have no control over and are not responsible for the content, use by you or availability of those third party websites, for any products or services you buy through those sites or for the treatment of any personal information you provide to the third party.
