WhatsApp data protection implications for Trusts/Schools

WhatsApp is a great app. It’s free, easy to use and rarely has technical issues. It allows everyone to share words, audio and pictures at the click of a button, and during the Covid-19 pandemic, it has been a lifeline to many people. With everyone spread far and wide, working remotely, it has seen an exponential increase in its use.

Be under no illusion if it’s “too good to be true” then it usually is!

WhatsApp carries high risks to any organisation that chooses to use it for anything besides inter-staff chit-chat or conversations which do not include personal data. Anything else will make the organisation non-compliant with data protection law.

You might argue that during the pandemic the Information Commissioner’s Office endorsed WhatsApp’s use in the health and social care system.

So why not schools?

Clinicians have been told they can use messaging services like WhatsApp “where the benefits outweigh the risk” to share information about coronavirus. The Information Commissioner said:

“The ICO is a reasonable and pragmatic regulator, one that does not operate in isolation from matters of serious public concern. Regarding compliance with data protection, we will take into account the compelling public interest in the current health emergency.”

“We know you might need to share information quickly or adapt the way you work. Data protection will not stop you doing that. It’s about being proportionate”.

Very little communication within Trusts/Schools would fit this criterion; anything else may not meet your privacy obligations.

The ICO has published the Accountability Framework to which every organisation must comply. Trusts/Schools, as public bodies, must demonstrate that their data protection protocols are fully aligned to these principles.

We’ve put together our own version to simply explain how products should align to the Framework and how WhatsApp compares, complete the form below to download it.

The conclusion is very clear

WhatsApp is a wonderful communication tool for individuals. During the pandemic it can be used by health professions if there is no alternative and helps to save lives. However, the risk of using WhatsApp must be understood and every opportunity must be taken to mitigate those risks.

Trusts/Schools may use WhatsApp to share personal data in limited circumstances but for ‘business as usual’ communication it’s really not suitable.