UK health officials accused of sharing pandemic-related information over private channels

Government officials and staff at the Department of Health and Social Care (DHSC) used private correspondence channels to share official information, such as the handling of the pandemic, a year-long investigation by the Information Commissioner’s Office (ICO) found.

While some individuals discussed meeting arrangements, others talked about issues of public concern. Additionally, this also included officials directly emailing from their corporate account to Ministers on their private account, which could spark security and privacy issues.

DHSC staff was found using 29 private WhatsApp accounts, 17 private text accounts, eight private email accounts, and one private LinkedIn account to communicate. Based on the review of 2,261 emails, the use of private correspondence channels was concluded to be “extensive.”

“There was extensive use of private correspondence channels by Ministers, and staff employed by DHSC. Evidence more widely available in the public domain also suggests this practice is commonly seen across much of the rest of Government and predates the pandemic,” the report elaborates.

Despite the allegations that the then Secretary of State for Health and Social Care used exclusively private accounts, the Secretary of State and the other DHSC Ministers involved had been using a mix of private and official communication channels.

The investigation highlights that the use of private channels is not in itself against the law and does not breach freedom of information or data protection laws and rules.

“FOIA does not include a duty to create or preserve any records. However, once a request is received, there are potential criminal sanctions for anyone who ‘destroys or conceals any record held by the public authority with the intention of preventing…disclosure’” the report explains.

Despite this, DHSC did not have sufficient protections in place to ensure the effective handling of requests for information in line with the relevant codes of practice. As a result, these channels posed a substantial risk “to the confidentiality, integrity and accessibility of the data exchanged.”

The ICO emphasized that it does not stand in favor of a full ban on private communication methods, however, urges to consider their appropriateness when sharing data.