That is correct. Employer’s cannot force staff members to hand over personal
devices even if they suspect inappropriate conduct.
Employers also cannot take any action
against the staff member or fulfil their legal requirement to submit the evidence to employment
tribunals.
Even with a clear mobile and messaging policy, a business cannot either
ensure subject access requests and prompt access to chats and historical conversations are met (as
there is no auditing or monitoring function). Failure to comply is the higher tier of GDPR fines for
the company.
3. “It is on a personal phone, so GDPR (data privacy) does not apply to the
employer”
Yes and no. The good news is that if you are the owner of the device and it is only
used for private use,
GDPR Article 2 paragraph 2c
provides an exemption “Regulation does not apply to the processing of personal data by a natural
person in the course of a purely personal or household activity”.
Unfortunately the
exemption does not apply to the employer. The regulatory risks (due to data breaches) and the
responsibility of business increases significantly when WhatsApp is installed on either a personal
phone when used for professional purposes (BYOD) or one which is supplied by the company. If, for
example, an employee stores a business (or client) contact on either a private or company phone then
the business may be committing a data breach as data is transferred to WhatsApp to the US without
obtaining consent from each contact as outlined in the GDPR.
Larger businesses may
install MDM (Mobile Device Management) software to separate professional and personal contacts, a
step in the right direction but often a step too far for small businesses with no or limited IT
support.
WhatsApp may say it meets GDPR and that it complies with its data usage of its
own personal users. This is very different to being a compliant tool for another company to use with
their own clients.
4. “Whatsapp is safe no? it is encrypted. Or is Telegram better?”
To ensure security you need (1) to know the identity of the participants and (2) that the
information is accurate and has not been modified.
Unfortunately, both Whatsapp or
Telegram allow users to self-register to use the platforms – with the name of their choice and in
most cases a mobile number and/or email linking them to their account. Each user can also invite any
other users to chat and share content and this has opened up the door for hacking and impersonation
(like phishing attempts on telephone lines). So effectively, none of the information is verified or
can be trusted. This may be acceptable for social interaction, but not for businesses. Having these
conversations encrypted (coded) from the sender to the receiver’s phone only prevents communications
from being read…other than by those holding the keys.
There is no need for businesses to run unnecessary legal and regulatory risks as
above when safe and compliant alternatives can be deployed internally and to clients within minutes
without the need for IT experts. Qwil B2C secure chat platform was built to be safe enough
for the financial sector, but easy and intuitive to use as any social chat platform.
