Security News > 2022 > July > UK Info Commissioner slams use of WhatsApp by health officials during pandemic

The UK Information Commissioner's Office on Monday issued a reprimand and called for a review of how and whether messaging services should be used for government business practices, after finding widespread and potentially dangerous use of private email, WhatsApp and other messaging tools by officials at the Department of Health and Social Care.

The actions ordered by ICO came after a year-long investigation as to whether the DHSC was compliant with the UK General Data Protection Regulations, the UK Data Protection Act 2018 and the Freedom of Information Act 2000 during the COVID-19 pandemic.

According to the ICO report [PDF], confidentiality and security of personal data was put at risk by use of privately operated comms tools.

The reprimand [PDF] issued to DHSC orders the Department to improve its data handling processes and procedures, per the requirements of the UK GDPR. It states the DHSC has violated processing operations related to storage limitation, integrity and confidentiality, security of processing and more.

"It is important to stress that the ICO does not take the view that the DHSC, and public bodies in general, should never send information containing personal data to private communication channels," argued director Steve Eckersley in the ICO's reprimand to DHSC. He went on to explain that communications with personal data must adhere to UK data protection law.

Edwards echoed the sentiment in the official report, stating "The pandemic placed extreme demands and stress on our public services" and that it was "Understandable" some ministers and officials relied on "New technologies to make their work and their lives more manageable." But Edwards also said new or alternative comms technologies do not relieve anyone of data security and transparency obligations.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/07/12/uk_department_of_health_and/