Whatsapp Conversation relating to data subject on a work related matter on a non-work phone between senior managers. Is this SAR-able and FOI-able?
Whatsapp Conversation relating to data subject on a work related matter on a non-work phone between senior managers. Is this SAR-able and FOI-able?
Share
Liz
Before reading Andreas post I clarified the situation with the ico. The response I received is:
If the whatsapp group is under the control of the organisation, then it would be covered under a subject access request. If staff within the organisation have set up a whatsapp group, but this is not under the control of the organisation, then you would not be obligated to provide the messages in response to a SAR.
Yorkie82
We had that problem a couple of months back with a SAR from a former staff member and the content of these “private” conversations had been requested by the data subject. The ICO at the time advised that if it is company-related, the company is aware of it and they can request it from their employees (contractual obligations) then you have to disclose it. (which perhaps is than consider as “under the control of the organisation”)
Andrea
I agree with Liz. If you don’t have any reason to think that your senior managers are using WhatsApp for work related conversations you could argue that you are not the controller of any personal information in those conversations. This might be supported by your company policies on, for example confidential information?
If you think you are the controller, then unless you can point to a company policy on this, it is unlikely that you will be able to compel the senior managers to hand over their personal devices for you to search. I would document how the managers respond to any request to search their devices so you can produce this evidence if the ICO investigates.
You might also want to consider whether any information would be disclosable as part of a DSAR taking into account the third party privacy rights of your managers and therefore whether you can decline to search on the basis that it would not be reasonable or proportionate.
Liz
I’ve just been asked this question too! I’m thinking that if it was a conversation on a personal phone the data isnt being processed by the organisation and therefore would not need to be provided by company. Would anyone have any thoughts on this stance please?