Data watchdog reprimands government over pandemic WhatsApp use

The Department of Health has been reprimanded over ministers' and officials' use of messaging apps and private email during the pandemic.

Using WhatsApp and other apps had meant information on the handling of the pandemic could have been lost, the Information Commissioner's Office said.

It has asked government to carry out a review of the use of private messaging,

The government told BBC News the ICO had found the channels it used had been "lawful".

But its use of encrypted apps and private email has been criticised, as messages might not be provided to people making Freedom of Information requests.

Last year, campaigners brought a case to the High Court, saying these services made it easier to delete information and cover up possible wrongdoing.

But in April judges decided the law on keeping public records said "nothing" about using personal devices for government business.

They also ruled using autodelete software was lawful.

Also last year, the then information commissioner, Elizabeth Denham, launched an investigation into the use of these private channels by the Department of Health and Social Care (DHSC) during the pandemic.

At the time, Ms Denham said: "My worry is that information in private email accounts or messaging services is forgotten, overlooked, autodeleted or otherwise not available when a Freedom of Information request is later made."

The results of this inquiry have now been published in a report, Behind the screens.

There was, it says, "extensive" use of private correspondence channels by ministers and staff.

And the DHSC's policies and procedures were inconsistent with existing policy on the use of private email.

Using private channels of communication did not in itself constitute a breach of either Freedom of Information or data-protection rules, the report says, if there were "sufficient controls in place" to allow information to be given when requested.

"The investigation found, however, that such controls were lacking," the ICO said.

The report also questions the security of private messaging channels, while noting instant messaging brought "some real operational benefits" during the pandemic.

As a result of its investigation, the ICO issued a reprimand requiring the DHSC to improve its "handling of personal information through private correspondence channels and ensure information is kept secure".

Current information commissioner John Edwards said he understood the value of instant communication but "public officials should be able to show their workings, for both record-keeping purposes and to maintain public confidence".

"That is how trust in those decisions is secured and lessons are learned for the future," he said.

"The broader point is making sure the Freedom of Information Act keeps working to ensure public authorities remain accountable to the people they serve."

The UK Covid-19 Inquiry, chaired by Baroness Hallett, will also consider how information was recorded by the government during the pandemic.

The government told BBC News it would carefully consider the ICO report but was glad it had made clear the correspondence channels used were lawful.

"Ministers and officials had to work at extraordinary pace during the pandemic and the use of modern technology was necessary to deliver important public services that saved lives," an official said.

And it had already started reviewing the policy for using non-corporate communication channels.

But Iain Overton, of public-service journalist body The Citizens, which brought the earlier unsuccessful High Court action, told BBC News government had been ruling "more and more in the shadows, refusing to acknowledge they are increasingly running the country on personal, encrypted messaging systems".

"This poses not just a problem for journalists - Freedom of Information Act requests for such messages are consistently refused," he said.

"But it also means that future historians will look back at this era with despair.

"Correspondence between ministers, special advisors and party donors will be long deleted and data on personal phones lost to the rivers of time."