Data protection implications of using WhatsApp within Trusts/Schools
WhatsApp is a great piece of software. It is free, easy to use and rarely has
technical issues. It enables everyone to share words, audio and pictures at the
click of a button, and during the Covid-19 pandemic it has been a lifeline to
many people. With everyone spread far and wide, working remotely, it has seen
an exponential increase in its use.
… but be under no illusion if it’s “too good to be true” then it usually is!
WhatsApp carries high risks to any organisation that chooses to use it for
anything besides inter-staff chit-chat or conversations which do not include
personal data. Anything else will make the organisation data protection noncompliant.
You might argue that during the pandemic the Information Commissioner’s
Office endorsed WhatsApp’s use in the health and social care system. So why
not schools? Clinicians have been told they can use messaging services like
WhatsApp “where the benefits outweigh the risk” to share information about
coronavirus. The Commissioner said
“The ICO is a reasonable and pragmatic regulator, one that does not operate in
isolation from matters of serious public concern. Regarding compliance with data
protection, we will take into account the compelling public interest in the current
“We know you might need to share information quickly or adapt the way you
work. Data protection will not stop you doing that. It’s about being
Very little communication within Trusts/Schools would fit this criterion; anything
else may not meet your privacy obligations.
The ICO has published the Accountability Framework to which every organisation
must comply. Trusts/Schools, as public bodies, must demonstrate that their data
protection protocols are fully aligned to these principles.
We’ve simply explained how products should align to the Framework and how
WhatsApp compares. The conclusion is very clear:
WhatsApp is a wonderful communication tool for individuals. During the
pandemic it can be used by health professions if there is no alternative and helps
to save lives. However, the risk of using WhatsApp must be understood and
every opportunity must be taken to mitigate those risks.
Trusts/Schools may use WhatsApp containing personal data in limited
circumstances but for communication regarded as BAU it is not suitable.