Should employees use WhatsApp for work communications?

A recent ruling by Nunavut's information and privacy commissioner has raised concerns about the use of WhatsApp by employees for conducting official business.

The case involved a Department of Education employee who requested access to records after experiencing a breakdown in relations with senior management. The department disclosed nearly 1,500 pages of heavily redacted documents, prompting the commissioner to review the redactions and the department's handling of the request.

Graham Steele expressed concern about the use of WhatsApp by senior officials, noting that it undermines transparency and accountability.

“This case makes me worry that use of messaging apps is more extensive than I had realized,” he said.

“In short, it is poor administrative practice — and not just for ATIPP [Access to Information and Protection of Privacy Act] purposes — for discussions to be held, and decisions to be made, in an unofficial forum of which there is no easily-accessible record.”

Unlike government-supported platforms like Microsoft Teams, WhatsApp messages are not stored on government servers, creating challenges for record-keeping and retrieval, said Steele.

The report also highlighted concerns about privacy and information security, stressing that sensitive information exchanged on WhatsApp may not be properly safeguarded.

“I have no doubt that WhatsApp is convenient. It is used happily by many millions of people around the world. But convenience is not a good enough reason for government business to be transacted through unofficial communications channels,” the commissioner said.

“I recommend that Education discontinue the use of WhatsApp by senior management.”

Risks of informal messaging apps

The use of messaging apps like WhatsApp in the workplace is becoming increasingly common, says Ellen Porter, partner at Fasken Martineau DuMoulin in Toronto.

"A lot of employers will use either text messages or WhatsApp applications to communicate with employees.”

But she found it surprising that the commissioner in the Nunavut case was taken aback by the prevalence of messaging apps in workplace communication.

"I'm like ‘Where have you been?’" says Porter, pointing out that even in legal settings, firms are dealing with the challenges of storing and managing text messages as part of client files.

The use of these applications comes with significant risks, she says. While they can be a cost-effective way to communicate with remote workers or send out quick informational updates, “it's important to really think about, if you're going to use it… what it can and can't be used for," she says.

‘Their guard goes down’: informal conversations

One big challenge with these tools is the informal tone they may encourage among participants.

"Messaging apps and even texting lead to some informalities where people don't express themselves maybe in the same way that they would if they were emailing with their boss," Porter says.

This was seen, for example, in a recent case involving Metrolinx employees in a WhatsApp group who made sexual comments about co-workers.

"I don't know what it is but when people get on something like WhatsApp, their guard goes down," she says.

“On Teams, employers can see whatever you’ve been messaging; if they wanted to, they could in and check — but people forget.”

Porter provides an example from her own firm, where associates use a WhatsApp group to seek advice on work matters.

 "It becomes a forum where they feel like a safe space," she says, but if inappropriate behaviour ever arose within such groups, employers would be responsible for investigating it.

Inappropriate comments among staff

Employees often fall into more casual, unprofessional communication on platforms like WhatsApp, particularly when used in a group setting, says Tatha Swann, founding lawyer at Swann Law in Toronto.

“What I’ve been seeing for the last 10 years is a sort of descent into madness on some of these platforms, especially with the younger generations,” she says.

“The nature of the communication platform, I find, influences the style of communication of employees.”

For example, Swann says she knows of one retail employer that uses chat groups to communicate among employees and management.

“The kinds of inappropriate and borderline harassing comments that happen on these would just be rampant and common, because it feels like everyone's in a friends’ group, and they're actually in the workplace… And, of course, the manager ends up getting dinged and held vicariously liable, because they're in the group, they're presumably watching all of this unfold, and they have a duty to step in or report.”

With the back-and-forth chat, “managers forget to manage in a professional way because… it blurs the boundary between personal and the workplace,” she says.

Often, the employer has no idea any of this is happening, says Swann, “but they end up having to settle the case when the employee brings a valid harassment claim forward.”

Privacy considerations with messaging apps

The Nunavut privacy commissioner noted in his decision that it’s unlikely that a Privacy Impact Assessment (PIA) has been done, “so Education has probably not thought through the privacy implications of sensitive information being exchanged via WhatsApp.”

When employees create their own unsanctioned groups, there probably is an expectation of privacy, says Porter.

"But typically what happens is that somebody within the group rats out the others in the group and brings screenshots or something to the attention of the employer," she says. “Once it has become part of that public sphere, that’s when people get into trouble because you can no longer say that it’s a private exchange."

Typically, searches of employee computers or messaging apps are conducted when there’s suspicion of misconduct, which affords employers broader rights, says Swann.

"When you're investigating, it's quite broad — you can request text messages between employees on personal devices, even though it's not business at all.”

However, regular monitoring of personal devices is not allowed, she says.

In Ontario, monitoring is permitted for work purposes, but employers must inform employees and limit the scope to what is necessary, such as monitoring log-in and log-out times.

"You have to restrict, of course, monitoring to what's necessary," says Swann.

Retaining data another challenge

The Nunavut privacy commissioner also noted that the WhatsApp messages do not go through government servers.

“They are not accessible to the [government] if the employee dies, resigns, goes on leave, or for any other reason is unwilling or unable to cooperate. They are not available to successors. They are not archived and stored,” said Steele.

This is a big concern, says Porter: the inability to retain and retrieve information when necessary.

Take, for example, a company that faces a grievance and needs to prove certain communications, such as shift offers based on seniority.

“If you have to go back and confirm what was done or who said what, then it can be difficult to go back and get that data as part of your record, particularly if a manager leaves or something like that — there's no continuity," she says.

If there’s an issue around scheduling and it goes to arbitration, retrieving data from these apps can also be a time-consuming process.

"It often takes a long time to get the subpoena and have the… phone company or… to go directly to the app provider," says Porter. “So, oftentimes, employers don’t want to engage in that because it’s just too costly.”

‘Extremely cumbersome’ to gather evidence

Gathering evidence from these platforms can be unreliable and disorganized, says Swann.

“It all becomes extremely cumbersome for gathering evidence, whereas email tools are meant to be archived and stored — it's easy to see the back and forth, all the dates and date stamps are there.”

The problem is exacerbated when employees use non-company-owned apps like WhatsApp, which aren't subject to the same oversight as business tools like Slack or Teams, she says.

Additionally, data from these apps can disappear when employees lose or replace their phones.

"A lot of people use these platforms on their phones, which they lose or which they often conveniently claim not to have anymore," she says.

As an example of how messy informal communications can become, Swann mentions a client using Facebook to communicate around an employee’s accommodation plan.

“The communications are so casual, and they don't really follow a logical question-and-answer format, asking for the relevant medical information. So, it becomes quite a mess.”

Should apps be banned at work?

Despite the risks, banning these platforms could be seen as an “antiquated approach,” says Porter, who instead recommends that companies set clear boundaries for their use.

"Rather than banning it outright, it probably makes more sense to just turn your mind to what types of communication you would think are acceptable over those applications," she says.

“Rather than just being arcane about it and saying, ‘No, this is unwieldy, we can't manage this’ — which is I'm sure what people thought initially about email — really, you have to adapt to the times and figure out what and when you would use the different applications.”

Updating workplace policies is a key step to managing these risks, says Porter, such as those related to email, technology, and social media, to ensure they encompass messaging apps.

"You want to [give workers] notice that, ‘Hey, if this is work-related, then we can access it, and we have a right to see it,’” she said, highlighting the importance of transparency with employees about the potential lack of privacy in work-related group chats.

That also applies when it comes to a code of conduct,  says Porter, so employees know they should treat people with respect on this platforms, and not be defaming the company, for example.

To address these risks, Swann recommends that employers establish clear guidelines in their code of conduct regarding the use of different communication tools, and what’s appropriate.

That can include statements such as: "Please be aware that all communications with colleagues, managers, subordinates that may take place on external platforms still constitute communication in the workplace, and these communications are subject to our Code of Conduct.”

“It’s just as simple as that, to remind people how to use these proper tools and how far the workplace extends,” she says.