ICO: Private email is subject to FOI

Guidance suggests organisations should update communications policies.

Data Security

Guidance issued by The Information Commissioner's Office (ICO) has put the use of personal email for business communications under the spotlight.

The ICO clarified last week that information concerning official business held in private email accounts is subject to the Freedom of Information (FOI) Act.

The watchdog published its guidance after the Financial Times reported education secretary Michael Gove and his advisers had been using private email for departmental business. Gove refused to release data from the accounts in response to FOI requests.

Advertisement - Article continues below

Christopher Graham, information commissioner, said it should not come as a surprise to public authorities that information held in private email accounts can be subject to FOI law if it relates to official business.

"This has always been the case the Act covers all recorded information in any form," he stated.

Greg Jones, ICO press officer, also told IT Pro that, although the ICO has never stated personal email fell outside the remit of the FoI, the Cabinet Office guidance that had been circulated to other government departments gave that impression.

"That's why we've issued new guidance today with two key aims first, to give public authorities an authoritative steer on the factors that should be considered before deciding whether a search of private email accounts is necessary when responding to a request under the Act; second, to set out the procedures that should generally be in place to respond to requests," Graham said.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

While the guidance (PDF download) said the need to search private email accounts should be a rare occurrence, minimising any increased regulatory burden on public authorities, Jones confirmed that the use of private email for public authority business should also be an exception rather than the rule.

While "it should be avoided if possible," he said copying the email into an official authority address would ensure the completeness of the authority's records and avoid it having to take extra effort and time to access personal accounts.

If an individual's email account might include official information, which falls within the scope of the request and is not held elsewhere, the ICO said the authority is required to ask that individual to search their account. An audit trail of the access and search should be maintained also.

The guidance also reminds public authorities to remind staff that deleting or concealing information with the intention of preventing its disclosure following receipt of a request is a criminal offence under section 77 of the FOI Act.

Advertisement - Article continues below

Graham added that, having conducted a good practice visit at the Department for Education, the ICO is now "keen to carry out similar visits to other Whitehall departments."

He added that its investigation of specific complaints made to the ICO about the Department of Education's handling of individual FOI requests was still ongoing and that its decisions would be published early in the New Year.

The data protection watchdog used its powers to make the University of East Anglia commit to better FOI practices last year.

Stewart Room, partner in the Privacy and Information Law Group of Field Fisher Waterhouse, said having to manage private email systems for compliance with FOI law "will be very burdensome."

"Another interesting question is the extent to which this decision indicates a course of trajectory for the Commissioner on the issue of data security," Room said.

"If the principles behind the FOI decision are extended to the matter of security breaches, we may conclude that invasion of the "private space" of private emails will be more readily justified, if this is required to achieve an appropriate degree of security."

Featured Resources

Key considerations for implementing secure telework at scale

Identifying the security risks and advanced requirements of a remote workforce

Download now

The State of Salesforce 2020

Your guide to getting the most from Salesforce

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Rethink your cybersecurity strategy for the new world

5 steps to secure the enterprise and be fit for a flexible future

Download now
Advertisement
Advertisement

Recommended

Hundreds of thousands of Instacart customers impacted by data breach
phishing

Hundreds of thousands of Instacart customers impacted by data breach

23 Jul 2020
Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
UN report points to a 350% rise in phishing websites at start of 2020
phishing

UN report points to a 350% rise in phishing websites at start of 2020

7 Aug 2020