Preschool Employment tribunal for the use of WhatsApp
The case of Ms L Pagnello v Barrow Hill Pre-School is primarily about public interest disclosures and highlights the risks associated with using workplace social media.
The reserved judgement can be read: 👉Case Number: 2200448/2024
The tribunal warned that WhatsApp group chats can 'blur the boundaries' between the professional and private lives of employees. There are dangers of colleagues mixing messages about work with 'chit-chat and inappropriate language'.
Emma, has put together some advice about Mobile Messaging Apps for us to share with schools:
Mobile Messaging Apps – Top Tips
What is a Mobile Messaging App (MMA)?
MMAs are software applications installed on a mobile device that allow text (and other) communications between users. Some of the most well-known are WhatsApp, Telegram and Signal, but there are many different products available and there are new ones being offered all the time.
Social media platforms (e.g. Facebook) also offer messaging services.
What is the issue?
💥There has been an explosion in the use of MMAs both for personal and professional purposes. It has been suggested that around 23 billion text messages are sent worldwide every day and that figure will only go up.📈
Most of us who use mobile phones or smart devices will use at least one MMA platform. They are very much a part of our lives these days so we need to understand some of the issues that may arise which we may not have thought about.
What do you use it for?
Most of us use MMAs to chat to friends and family. It is a fast and easy way to communicate and we also love sending photos, GIFs and emojis☺️
Worth thinking for a moment about how much of your personal and private information you and others share, often without giving it a second thought.
There have been some controversies about privacy and security over the years. As a general rule, if you are using something and not paying for it…you are the product. Data is big business, and the big tech companies that provide these platforms don’t do so out of the goodness of their heart. They do it because it is a very lucrative business model for them and they can make good use of your data, including things like location tracking📍
It is always worth taking a moment to find out about privacy settings on your devices. It will be time well spent. You have more control than you may realise.
But what about in the workplace?
The number of employment tribunals referring to messages on MMAs is increasing dramatically which indicates that this is something we all need to pay attention to.
You will likely have work colleagues that are also friends. It is very easy for a chat about what you both did over the weekend to move to a chat about the workplace meeting you are both having to prepare for, or the performance of another member of staff.
Sometimes that may not matter. But, depending on the nature of your organisation and the role you have in it, it may lead to problems.
Because we are all using MMAs more, both at home and at work, we are prone to blurring the boundaries between the personal and professional. We also forget that these messages are not ‘chats by the water cooler’, they are stored and retained and shared in ways we often don’t think about, expect, or want!
You may recall how the UK Government was accused of ‘government by WhatsApp’ during the pandemic😷. There was a lot of anger about the way in which some government officials were having important discussions, and making important decisions, via an informal messaging app. There was also anger at the way some of the messages on people’s phones ‘disappeared’ meaning that they were not able to be properly held accountable for decisions that were made.
Not many of us have jobs that involve dealing with a national health emergency, but the principle is the same.
This is an extract from a recent employment tribunal – “the WhatsApp group was a perfect example of how to unprofessionally blur the boundaries between the workplace and personal relationships. The things spoken about on the group were both about the day to day running of the setting, personal issues involving the members of the group, jokes, photos of holidays and sometimes included inappropriate language and chit-chat”
So what should we all do?
If you are an employee
Your employer should make the rules around the use of MMAs for workplace communications clear. If they are not clear, ask.
Try and keep your work and home life separate. It won’t always be easy, but remember that everything you write that relates to work in any way can be used and shared, potentially in legal proceedings.⚖️
If you have blurred those boundaries, it may mean that private messages and even photos could be disclosed. You won’t want that and the people you are chatting to won’t want that.
If you are an employer
Have a clear policy about the use of MMAs for work related communications. Talk with the staff about the policy and your expectations as well as their experiences.
It is easy to put rules in place, it is less easy to make sure those rules are understood and applied. Use some of the stories linked at the end to explain why this is an issue.
Things to think about when writing an MMA policy –
❔How do your staff like to communicate?
❔How often do they need to communicate?
❔What is your communication plan in the event of an emergency or incident when normal communication channels may not be available?
❔Are there particular sensitivities around the work that you do which may mean certain risks around information governance are greater?
❔If you prohibit the use of MMAs for work related communications, what alternative channels are you providing?
❔If you allow the use of MMAs, what are you doing to ensure that their use, in the context of work communications, is appropriate?
❗️Don’t forget - if you work in the public sector, you have legal obligations under Freedom of Information (FOI) legislation. Communications sent, on whatever platform, relating to the organisation, may well be disclosable. The public have a right to expect that when acting in a professional capacity, you are acting with integrity and accountability. FOI legislation is a foundation for that.
❗️All organisations will be covered by data protection legislation when processing personal data (information about people). You need to ensure that your MMA policy reflects your legal responsibilities.
Here is an example of a MMA policy document - https://www.gov.scot/publications/mobile-messaging-apps-usage-and-policy-guidance/
We are only human, but…
Being able to communicate quickly and easily with each other is certainly a good thing, most of the time, for most people.
It can be easy to treat messages differently to face to face or more formal written communications. Things can be misconstrued, tempers can fray, humour can turn into bullying. Once a message is sent, it is difficult to take it back. Even if a message is deleted by the sender, the recipient may still have it, and may have forwarded it.
⏳So we also need to pause sometimes, just to think about some of the unintended consequences and possible risks, to ourselves and others.
Dig deeper –
Technology has revolutionised the way we communicate, and the speed with which can communicate.
Making sure we are all clear about expectations, consequences (intended and unintended) is important for us all in the workplace, but it is also important for us all as individuals.
People’s lives can be turned upside down with one message.
We are all responsible for our own behaviour. We have the right to expect the rules in our workplace to be clear and fair. We also have the responsibility to act as decent and thoughtful citizens in the workplace, and outside it.
This is not an issue about words in a policy document, it is an issue about all of us. Here are some examples to illustrate why -
https://www.bbc.co.uk/news/uk-politics-65752422
No. 10 denies cover-up over Boris Johnson Covid WhatsApps
Employment Tribunal decision criticising staff use of WhatsApp
https://en.wikipedia.org/wiki/Reception_and_criticism_of_WhatsApp_security_and_privacy_features
Some concerns around security and privacy
https://www.bbc.co.uk/news/articles/c9dj1zlvxglo
Police review couple’s arrest in school WhatsApp row
Inappropriate content shared on WhatsApp by Metropolitan Police Officers
https://www.bbc.co.uk/news/uk-england-london-61909072
Police officers disciplined over WhatsApp photo sharingMobile Messaging App Poster
Emma has also shared her mobile messaging app poster with us to share share with you and is available to download:📄 Mobile Messaging Apps
What the Cyber Resilience Centre say about WhatsApp:
Using WhatsApp for business: Is it a good idea?
WhatsApp Scams
We've also seen a number of scams in relation to WhatsApp:🚩 Impersonation scams - one of the most prevalent and effective where a threat actor pretends to be a close friend or member of the family who has lost their phone.
🚩Verification code scams - hackers will claim to have accidentally sent a code to your phone and ask you to forward it to them. Sending them the code will give them access to your WhatsApp account. WhatsApp scam warning as West Midlands policy say ' six things you must do'
🚩Phishing links and malware - scammers send messages with malicious links disguised as legitimate ones.
🚩Job offer scams
🚩Investment scams
🚩Romance scams
🚩Wrong number scams
Should we use WhatsApp for Incident Response or in an Emergency?
We are asked this question a lot - if a cyber incident causes your phones to be down, should you use WhatsApp on your mobile phone for emergency comms? Ideally all communications for a disaster or cyber incident, and the method used, should be documented as part of your Incident Response Plan.Using WhatsApp for emergency communications or incident response is generally not recommended because of the risks:
🚨Non-personal use terms of service - WhatsApp's terms of service explicitly state that it is for personal use only.
🚨Lack of consent for contacts - when staff use WhatsApp, they often allow it to access their phone contacts, which uploads personal data to Meta's servers.
🚨Data control and retention - organisation's have limited control over data stored on individual's phones and it's difficult to apply retention policies, if at all.
🚨ICO Reprimands - the ICO has issued reprimands to organisations for sharing personal data over WhatsApp groups.
🚨Security - while WhatsApp offers end-to-end encryption, the security of the device itself is not controlled by the organisation.
🚨SARs and FOI's - any work-related communication on WhatsApp, even on a personal device, could be subject to a SAR or FOI request.
🚨Confidentiality - it's very easy to accidentally add the wrong person to a group.
Therefore, organisations should look to other methods for mass communication in an emergency, such as SMS, dedicated internal platforms, specific incident management systems or mass notification systems.
While we can see how tempting it might be to use WhatsApp for group chats, department chats, emergencies and general chat, it is generally discouraged due to the significant data protection and operational risks. Review Emma's guidance and assess the risks for your organisation.
Scottish Government Independent Review Report
Emma's report of her independent review of the Scottish Government's use of mobile messaging apps and non-corporate technology can be viewed here 👉Scottish Government Publications
Emma has worked in data protection for more than 25 years. Read more about Emma here:The Data & Marketing Commission Board Profiles.
You can read more about the Data Protection Education team here: DPE About Us
Our customers should review our Social Media and Marketing Best Practice Library.