As Labour is embroiled in a scandal over leaked messages from a WhatsApp group, some people have been left wondering about their rights on the app.
Sir Keir Starmer is facing calls to widen the party’s investigation into alleged inappropriate WhatsApp messages after the Mail on Sunday revealed the existence of a chat reportedly called “Trigger Me Timbers”.
Labour MP Oliver Ryan admitted he made “unacceptable and deeply disappointing” comments after former health minister Andrew Gwynne was sacked over the “offensive” nature of some of the alleged messages.
With the rise of work-from-home culture, the lines between the personal and the professional have continued to blur. This has left some staff unsure about where this line is drawn when it comes to whether online activities are completely private or, in theory, could get you into trouble at work.
The app was the world’s most popular mobile messenger app last year, according to Statista, with around two billion monthly active users.
Below, The Independent takes a look at the rules surrounding employers and employees when it comes to online surveillance and privacy, especially on WhatsApp.
Can bosses monitor staff’s online interactions?
The short answer is yes – whether you are working at the office or at home.
Most employment contracts, when you examine them, give the company the absolute right to intrude into almost anything you do while using its equipment, working on its premises or working on its behalf.
When it comes to web browsing or any emails you send, or receive, if you’re using a company computer or smartphone, or even your own computer or phone connected via VPN to the company servers, or your own phone with a company sim card, then the firm has the right to observe anything at all you send and receive, with email being unencrypted.
It also has the ability, and right, to look at which sites you visit, and which apps you use to do your browsing. In the latter case, if you were to start a browser specifically required to access the dark web, then even though the employer could not see what you were browsing, the system would probably raise a flag with monitoring software. Companies are often obliged legally to retain this data in case of future lawsuits from inside or outside the business.
If you’re using a company phone and sim card, the company can see which numbers you call, and for how long. Conversations on a desk phone might be recorded: again, some companies, especially in financial services, are obliged to do this and it will be written in the small print of your contract.
When it comes to social media, to some extent, this is your own – but companies will have rules about not bringing the business into disrepute. This can, of course, be interpreted retrospectively, so that if you get into hot water with your employer, your old social media posts can come back to haunt you.
Even typing on a keyboard could be exposing. Some companies use monitoring software that can record individual keystrokes on computers. Even our desks and working areas can be monitored for how much activity is taking place.
But what about WhatsApp?
The end-to-end encryption that WhatsApp offers doesn’t provide employees with all the protection some believe it does. Even if you’re using the app, bosses can still get hold of your messages in some cases if they really want to.
If you’re using WhatsApp, Signal or iMessage on a company phone or your private phone but with a company sim, then even though the messages can’t be read at the time (because they’re encrypted between sender and recipient), they can be reconstituted afterwards by cloning the sim. If the company clones the sim to begin with, it could, in theory, monitor those conversations in real-time. Whether it decides to do any of this reactively or proactively, or if at all, will be up to your boss. But the risk of surveillance is always there.
However, not so much if you are using WhatsApp with a private sim card. Generally, messages on the app using a private phone with a private sim card are considered private.
But, not always – some WhatsApp messages, even informal or off-the-record conversations, can be legally disclosable, such as under a Subject Access Request (SAR), or a Freedom of Information (FOI) request. They can also be disclosed in disciplinary hearings and tribunals, with a high-profile example of this being when damning private government WhatsApp messages were uncovered as part of the UK Covid inquiry.
In other words, there are always scenarios when employees’ WhatsApp messages could be revealed to their employers.
What privacy do staff have?
The information watchdog warned employers in 2023 that it would take action if their monitoring of employees overstepped the line as it issued guidance to ensure lawful monitoring in the workplace.
The Information Commissioner’s Office (ICO) said monitoring of employees must be “necessary, proportionate and respect the rights and freedoms of workers”, warning: “We will take action if we believe people’s privacy is being threatened.”
Employers must ensure that staff know the nature, extent and reasons why they are being monitored in a way that is easy for them to understand, the ICO said, with any monitoring requiring a clearly defined purpose and using “the least intrusive means”.
