Using WhatsApp Business for School Communication – GDPR Concerns

[Aldmi]

Hi everyone,

 

 

I’m looking for advice regarding the use of WhatsApp Business in a school setting, specifically concerning GDPR compliance.

 

 

As a school, we primarily use Office 365 (Outlook and Teams for some parent meetings) and iSAMS to communicate with parents. However, for the last six months, our admissions manager at our independent school has been using a business phone with WhatsApp Business to communicate with prospective parents. In some cases, the communication has continued even after the students have joined the school.

 

At the time this was introduced, I raised concerns as the school’s Data Protection Officer. I felt this wasn’t appropriate due to the lack of central control over the data and the potential GDPR implications.

Recently, we had a data access request from a former staff member who had communicated with the admissions manager via WhatsApp. Some of the messages exchanged were not work-appropriate, and they even asked if they could delete certain messages before I reviewed the device. This highlighted my initial concerns.

 

Now, the admissions manager wants to continue using WhatsApp Business, but I’ve been asked to report back on whether it’s compliant and, if not, why.

 

 

From my research, most information seems to focus on personal WhatsApp, not the business version. However, my understanding is that GDPR requires data to be centrally managed and easily retrievable for access requests or audits. This is straightforward with Office 365 and iSAMS, but WhatsApp doesn’t seem to meet these requirements, meaning it likely isn’t compliant.

 

I’ve also spoken to a few other schools, and none of them seem to use WhatsApp for parent communication.

 

 

Has anyone else encountered a similar situation or have any advice on how to handle this?

 

 

Thanks in advance!

[PotNoodleTech]

I think the main point you can look at first is where in the data stored. If it's not in the UK or EU then your are taking a big risk to start off with. Then try and get hold of any data protection agreements or privacy policies. If these are not easy to get or don't exist then the answer would be an automatic no form me anyway. Mind you I am not the DPO here so I may not have the say so in the matter but at least I get an email trail to say in the future "I told you so" - make sure you do that too. If it doesnt exist in and email trail then it doesnt really exist as far as investigations go.

[sigma]

Professionally speaking, and stepping back from GDPR for a moment:

 

Who owns the Whatsapp Business Account? (The school or the indivdual).

 

Why was "work inapproprite" communication taking place on a "work" account. Is it a safeguarding risk?

 

How does this fit in the the school's Acceptable Use Policy?

[dmj]

It is a LOT harder to be compliant with GDPR if it isn't centrally managed, but I don't thing that's a requirement for compliance.

[GrumbleDook]

It should be that the WhatsApp business account(s) are owned by the school and WhatsApp are a data processor. The interesting bit comes when a member of staff messages on WhatsApp using a personal account from their own phone. For many, it would be that this is a personal account it comes from so it is a bad thing ... in reality, though, it is no different from someone using their personal email address to email something into work. Should it be used as a primary means of communication between staff? If they are all on WhatsApp for business, then the school is in control. If there is a mixture, then this is not a good thing and should be looked at in comparison to other communication methods.

After all, you are unlikely to be emailing a personal email of a teacher to say that student X is needed out of lesson for a medical appointment ... so why would you do it with messages in any format or any provider. That is the first sticking point, no matter where the data is stored/processed.

[Aldmi]

Who owns the Whatsapp Business Account? (The school or the indivdual).

 

The school own the device and sim card, number etc

Why was "work inapproprite" communication taking place on a "work" account. Is it a safeguarding risk?

 

It was inappropriate in the sense that it included overly critical comments about senior leadership—definitely not something that would been shared via email.

[steve]

Personally I don't think the comms channel in itself is a bad choice, its they way in which its being used.

 

I'd suggest that you look at how you might be able to make it more enterprise compliant - easy to search, easy to monitor, no single points of dependency (widen the pool of responders), ensure if the mobile is lost / mislaid you can continue to work and work securely. Those are some of the risks I'd highlight in using WhatsApp in the current way - how can the service continue if they are ill, the phones lost / broken. If its going to be used and valued, it should be adopted and de-risked.

 

Having had a quick look at the options, you can use up to 4 "devices" on a business account for free - that includes MS and Mac store applications. I think that's where I'd start, get visibility on more systems, it would probably remove any personal use of it too if it was known others can monitor the use.

 

Beyond the free 4 devices, there's an API version (free 1000 message per month) but for that you'd need an application to integrate with it, something like https://respond.io/ @$79 per month for 5 users. This would give a more enterprise style of management - data exports, MFA sign in, developed access and visibility.

[enjay]

Your issue sounds to be the misuse of the medium, not the medium itself. You say the admissions manager used it with parents, but then refer to an exchange between them and other staff member in which they criticise SLT, so this sounds like a case of two friends chatting, and had it been on email/Facebook/etc, there would be no question to answer here. Of course, it does highlight the need for, and difficulty obtaining, access if needed.

 

With WhatsApp Business, can someone else monitor or access the conversations, either in general or as a one-off? If staff are communicating with or about children in a way which can't be reviewed, that's a concern (although as you're presumably not recording phone or face-to-face conversations, that's never avoidable completely).