Decision 131/2020: WhatsApp messages
Public authority: Scottish Ministers
Case Ref: 202000512
Summary
The Ministers were asked for all WhatsApp messages in the group used by the Cabinet Secretary for Health and Sport, the Minister for Public Health, Sport and Wellbeing and a Special Adviser. The Ministers told the Applicant it did not hold the messages. The Commissioner accepted the Ministers did not hold the messages.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 5 February 2020, the Applicant made a request for information to the Scottish Ministers (the Ministers). The request read as follows:
Please provide the content for all WhatsApp messages (up to maximum 10,000 under WhatsApp allowances) in the group used by the Cabinet Secretary for Health and Sport, Minister for Public Health, Sport and Wellbeing and a Special Adviser (as per letter to the Public Audit Committee: https://www.parliament.scot/S5_Public_Audit/General%20Documents/20200114_Minister_for_Parliamentary_Business_FOISA.pdf.) Please include all media as well as messages in the group.
2. The Ministers responded on 28 February 2020 and notified the Applicant, under section 17(1) of FOISA, that they did not hold the information he had requested.
3. On 1 March 2020, the Applicant wrote to the Ministers requesting a review of their decision. He commented that, if the group is used regularly or semi-regularly (as suggested by the Minister for Parliamentary Business), there must be content in the group.
4. The Ministers notified the Applicant of the outcome of their review on 24 March 2020 and confirmed their original response. They advised the Applicant that information in WhatsApp groups is only routinely held for the length of time it takes a member of staff to receive and read a message.
5. On 5 May 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Ministers' review. He considered that, if the messages had been deleted, they may be retrievable and, therefore, still held.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 6 August 2020, the Ministers were notified in writing that the Applicant had made a valid application and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Ministers were invited to comment on this application and to answer specific questions regarding their reliance on section 17(1) of FOISA.
Commissioner's analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and the Ministers. He is satisfied that no matter of relevance has been overlooked.
Section 17(1) - Information not held
10. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received. This is subject to qualifications, but these are not applicable here. If no such information is held by the authority, section 17(1) of FOISA requires the authority to give the applicant notice in writing to that effect.
Submissions from the Applicant
11. The Applicant argued that the deletion of messages used as a means of communication between Ministers and a special adviser does not appear to be in keeping with the spirit of the Scottish Government's data retention policy. He referred to a recent letter to the committee on the Scottish Government's handling of harassment complaints[1], in which the Permanent Secretary confirmed that all emails are retained for 14 months.
12. The Applicant argued that, although Scottish Government guidance does not appear to have been updated to include WhatsApp and other electronic messaging means of communication, it appears there is scope for further retention of records. The Applicant submitted that, if such a system exists for WhatsApp, there may be a case for using it to retrieve deleted messages.
Submissions from the Ministers
13. The Ministers explained that, in an environment where the traditional lines between corporate and personal digital tools are becoming increasingly blurred, iTECS (the Scottish Government's Information and Technology Services Division) have to meet the demand to securely deliver and protect corporate material, yet also allow officials and Ministers to easily access digitally-enabling consumer tools and software.
14. The Ministers submitted that WhatsApp, along with other messaging Apps, are not provided as a service by iTECS, although officials are not prevented from installing digital tools and Apps on the physical device provided by iTECS. The Ministers explained that individuals are allowed to install Apps on their devices which are neither recommended nor supported by iTECS as they are confident in the levels of secure separation they can guarantee on the Smartphones and tablets they provide.
15. The Ministers submitted that employees using their mobile phone services have to accept (i.e. press a button) the Mobile Services Employee Agreement during activation, which refers to the Scottish Government's IT Code of Conduct. The Ministers argued that iTECS has no access to data created and/or saved or archived in what are effectively personal applications, including, but not limited to, WhatsApp, Facebook, Twitter and other cloud-based social and/or messaging platforms.
16. The Ministers contended that social media solutions are not used for substantive government business and, where they are, Ministers and Special Advisers are fully aware of their FOISA and Public Records (Scotland) Act 2011 responsibilities. As part of these responsibilities, Ministers and Special Advisors must ensure that relevant information is flagged to their Private Office staff who will then ensure that the information is stored in the Scottish Government corporate record solution (known as eRDM), either by the Private Office themselves or by the relevant policy team. Following these procedures enables the Ministers to meet their statutory and legislative responsibilities and the policies contained in their Corporate Records Management Plan.
17. The Ministers were asked whether the 14 months' retention policy, referred to by the Applicant, applies to WhatsApp messages as well as emails. The Ministers explained that the 14 month rule referred to in the Scottish Government Permanent Secretary's letter of 1 May 2019 to the Committee on the Scottish Government Handling of Harassment Complaints (which was referenced by the Applicant) is not the procedure relating to the retention of all emails received within the Scottish Government. It relates only to the automated deletion of emails remaining within the Enterprise Vault after 14 months of sending or receipt if they have not previously been deleted by officials.
18. The Ministers explained that emails that have been in a user's mailbox for 60 days are automatically archived to the Enterprise Vault and then, after a further 12 months (therefore 14 months in total) the emails are automatically deleted from the archive by iTECS. The Ministers stressed that it is the individual's responsibility to ensure that emails with corporate value are added to eRDM as soon as possible to maintain the corporate record.
19. The Ministers reiterated that WhatsApp is not provided as a service by iTECS, and iTECS do not have access to data created and/or saved/archived in what are effectively personal applications, such as WhatsApp. Therefore, the 14 month rule mentioned above does not apply to WhatsApp messages.
20. The Ministers advised the investigating officer that they do not have any policy or guidance that is issued to staff specifically regarding the use and retention of WhatsApp messages, and that there is no work currently underway for such a policy.
21. The Ministers submitted that Ministers and Special Advisers are not sent government business via WhatsApp. Government business is sent to the Ministerial Private Office, in line with the standard Scottish Government process. WhatsApp is used infrequently for logistical exchanges, and is routinely disposed of by each individual.
22. The Ministers noted that, if a Minister or Special Adviser received a WhatsApp message which contained information that needed to be retained or referred to in the future, it would be passed to their Ministerial Private Office, either by email or verbally. Depending upon the type of information, the Private Office would phone or email advising the relevant logistic or policy team of the information to enable them to take action as necessary (for example calling or emailing the Government Car Service team to advise of a change of timing for pick up or drop off). The policy or logistic team would then be responsible for saving any relevant information to the corporate record, if appropriate.
23. The Ministers stated that, at the time of the Applicant's request, the Ministers did not hold any messages in the WhatsApp group referred to by the Applicant in relation to this request, either within the WhatsApp application itself, or which had been generated in the group but exported to another medium.
24. As evidence, the Ministers provided the Commissioner with emails which were sent to members of the WhatsApp group, and which confirmed that no information was held. The Ministers explained that, on receipt of the request, individuals within the Ministerial Private Office looked at the special adviser's phone to check if there were any relevant WhatsApp exchanges and nothing was found. The Ministers stated that each of the members of the WhatsApp group have confirmed that they have not exported any data to another medium.
25. In an effort to determine how frequently the WhatsApp group was used, the Ministers were asked to confirm how many messages were sent in the group in the previous month or, if that data was not held, to limit this to the previous seven days. The Ministers submitted that the group infrequently send messages and, as of 3 September 2020, they did not have any messages stored in WhatsApp in relation to this request. As a result, the Ministers submitted that they were unable to confirm whether any messages and, if so, how many, had been sent over the last month. However, the Ministers did confirm that no messages had been sent over the seven days prior to 3 September 2020.
26. The Ministers were asked for details of the back-up systems in place on each individual's phone who were members of the WhatsApp group. The investigating officer referred the Ministers to various websites which outlined techniques to retrieve WhatsApp messages depending on which back-up systems were in place. In response, the Ministers submitted that none of the individuals who use the WhatsApp group relating to the Applicant's request have any back-up options currently set up for their WhatsApp group, and they did not have any set up at the time of the Applicant's request. Consequently, the Ministers submitted that it was not possible to retrieve any messages from the time period requested.
27. The Ministers were asked to comment on the Applicant's view that deletion of these WhatsApp messages was not in keeping with the spirit of the Scottish Government's data retention policy. In response, the Ministers explained that the Scottish Government's data retention policy only requires information that has a corporate value (e.g. to evidence and justify key business activities, decisions and actions) to be saved to the corporate record. They argued that there is no requirement for the Scottish Government to retain information that has no value, such as old email exchanges, work conversations that are no longer relevant, notification emails, purely logistical or personal emails.
28. The Ministers noted that phones have limited storage. It is therefore unrealistic and unnecessary to expect individuals to hold on to every message they send, regardless of its nature. The Ministers reiterated that, in the event that any information exchanged on WhatsApp is substantial government business, it would be retained and stored in eRDM, in line with Scottish Government guidance. The Ministers maintained that the Scottish Government has clear records management guidance in place which its staff, special advisers and Ministers adhere to.
Commissioner's conclusions
29. The Commissioner has carefully considered the submissions made by the Ministers and the points raised by the Applicant. The Applicant has claimed there is some discrepancy between the Ministers claim that WhatsApp is used infrequently, and a letter[2] issued by the Minister for Parliamentary Business, which suggests it is used regularly or semi-regularly.
30. The Commissioner has considered this point, but he notes that the same letter goes on to state, "I understand that these groups are used on an ad hoc basis, often when other forms of communication are unavailable." In addition, it notes that the WhatsApp groups are, "used for logistical or leave planning purposes, not for substantive discussion about Scottish Government business". Having considered the full text of the letter along with the Ministers' submissions in this case, the Commissioner does not see the discrepancy highlighted by the Applicant.
31. In conclusion, having taken into account the arguments put forward by the Ministers, and the evidence of the searches they have conducted, the Commissioner is satisfied, on the balance of probabilities, that the Ministers do not (and did not, on receipt of the request) hold the information requested by the Applicant. He finds that the Ministers were therefore correct to give notice, in terms of section 17(1) of FOISA, that they did not hold the information requested.
Decision
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
16 October 2020
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
…
