Is WhatsApp a secure and appropriate tool of communication at work?

Most of us have been added to WhatsApp groups with family and friends. It's an ideal platform to announce a new arrival to the extended family, or organise a night out with friends, but is it the right place to discuss company business?

Good communication is about delivering the right message to the right people at the right time, according to social media analyst, Stephen O'Leary, MD with Olytico. "If a message is urgent, messaging apps can often help deliver it in the quickest way possible. Messaging apps can be a great medium for group discussions – anyone in a good WhatsApp can attest to that."

Clinical psychotherapist, Stephanie Regan, works with employers and she believes social apps should be kept for social chit chat and fun- even if it's a work group. "That boundary will be wildly more important now."

The security of our data is also wildly more important now, having come into focus following the cyber security attack on the HSE.

Mr O'Leary said the question of security surrounding the use of instant messaging apps like WhatsApp is less about the app, and more about the device on which you access it - typically your phone. "If your work email is on your phone, you could describe it as a messaging app. Basic security steps - such as enabling two-factor authentication will help improve security, regardless of the application you're using."

However, the app itself, which is owned by Facebook, has been targeted by hackers in the recent past. In May 2019, WhatsApp rolled out a security fix to its then 1.5 billion users worldwide after concerns were raised that hackers could inject spyware on to phones via the call function. The vulnerability allowed hackers to insert malicious software on phones by calling the target using the app.

WhatsApp does provide end-to-end encryption, but that does not cover backups or chat exports by default.

Mischa McInerney, Chief Marketing Officer with Digital Marketing Institute urges businesses to think twice before using WhatsApp to communicate with staff.

"Companies cannot regulate WhatsApp groups. What I mean by this, is that someone in the group could share information about the company that is classified and access to that information cannot be revoked or controlled by the company.

"Also, although there is end to end encryption, back up chats are not encrypted, nor is the information if the user chooses to download chat history and again, the company cannot control or monitor this," she said.

WhatsApp shares personal data with parent company, Facebook. The social media giant is a data harvesting machine and it does not have a good track record on how it treats its users' data. The Cambridge Analytica scandal is a case in point.

Data shared with Facebook includes your phone number, device ID, location, and some usage information.

According to Ms McInerney from DMI, this information will likely be used for more targeted advertising in future, which has already happened between Facebook and Instagram.

WhatsApp, however, said that is not the case. It does not share data with Facebook to provide more relevant Facebook ad experiences, and would only do so when it reaches an understanding with the Irish Data Protection Commission on a future mechanism to enable such use.

The company said sharing information with Facebook companies helps it improve its services. "By sharing information with the other Facebook Companies, such as the phone number you verified when you signed up for WhatsApp and the last time your account was used, we may be able to work out whether or not a particular WhatsApp account belongs to someone who also uses another service in the Facebook Companies. This allows us to more accurately report information about our services and to improve our services."

WhatsApp said it also shares information with Facebook to help fight spam and abuse. "So if, for example, any member of the Facebook Companies discovers that someone is using its services for illegal purposes, it can disable their account and notify the other Facebook Companies so that they can also consider doing the same."

Security concerns aside, a message on WhatsApp is less formal than an email, because it is sent on a social platform and using it to communicate with colleagues risks blurring work-life boundaries.

As Clinical Psychotherapist, Stephanie Regan put it, it should be kept for 'chit-chat'.

"Being contactable all of the time can leave one feeling a sense of being 'always on', leaving the body in a state of preparedness - heightening cortisol levels and making it increasingly more difficult to relax. So over time, sleep becomes more difficult, and mood and concentration can be affected."

She recommends in this new phase of hybrid work that emails and contacts are far more regulated. "Contacts and email can be scheduled to arrive at work time."

A Code of Practice on the Right to Disconnect was published by Tánaiste and Minister for Enterprise Trade and Employment Leo Varadkar in April.

The right to disconnect refers to an employee’s right to be able to disengage from work and refrain from engaging in work-related activity outside of normal working hours. A spokesperson for the Department said, "This includes electronic communications, such as emails or other messages, including those received through newer platforms such as WhatsApp".

Business groups Ibec and CIPD Ireland recommend firms put a policy in place which advises employees on the correct use of instant messaging apps for work communications while also being mindful of the recently introduced Code of Practice on the Right to Disconnect.

Director of CIPD Ireland, Mary Connaughton said, "With the proliferation of social media tools, including WhatsApp, we recommend employers put a policy in place that advises employees of the ground rules around the use of such platforms. It’s often necessary to make clear where WhatsApp chats are intended specifically for work content."

Business group, Ibec, also recommends a formal policy to identify when and how instant messaging apps are used.

"Some employers may use instant messaging apps for urgent, and typically exceptional, communications to staff such as notices about severe weather warnings," said Maeve McElwee, Director of Employer Relations. "The other type of usage can be to offer overtime opportunities or to seek cover arrangements where timing is critical. The purpose and extent of communications on instant messaging apps should be clear to employees, along with any expectation around responses to such messages."

Ms McElwee also said that the sender should give due consideration to the timing of their communication and potential for disturbance. "The recipient should understand that they will not be expected to respond until their working time recommences. Always consider the tone/contents/context of texts and emails and other electronic communications including instant messaging apps."