Not uncommonly, employees may forward information back and forth between personal and professional email accounts. The reasons for this practice are varied. Sometimes it is so that the employee can work on a matter while travelling. In these cases, the employee sometimes faces a real or simply perceived system limitation. For example, the employee may not have remote access or the remote access authentication procedure is perceived to be cumbersome or not permit functions (such as printing) that the employee considers necessary. However, there is also the potential of more nefarious purposes such as the potential misuse or misappropriation of confidential information.
Recently, Elizabeth Denham, the British Columbia Information and Privacy Commissioner (IPC), examined this issue in the context of an investigation into whether personal information was shared between the British Columbia government and the British Columbia Liberal Party in contravention of public sector privacy legislation. No evidence of inappropriate sharing was found.
However, the IPC raised concerns over the exchange of government information across work and personal email accounts. In particular, the IPC was concerned that the use of personal email accounts might involve improper disclosure of personal information contrary to the Freedom of Information and Protection of Privacy Act (British Columbia). In particular the storage of email outside of Canada containing personal information of British Columbians could violate section 30.1 of FIPPA. The use of email providers that mine the content of the email for the purposes of providing targeted advertising could involve a disclosure outside of Canada in violation of section 33.1 of FIPPA.
The IPC made a number of recommendations for change:
Provide training on the use of personal email accounts for government business, including ensuring compliance with FIPPA’s restrictions on storing or disclosing personal information outside of Canada.
Ensure that all records relating to government business are located in government controlled information management systems.
Provide employees with sufficient technological resources to ensure that they do not have a reason t use personal email in the course of government business.
Ensure that government employees have mandatory privacy training on the separation of government roles from roles they may have in a political party.
The BC Liberal Party should ensure that employees and volunteers have similar training regarding separation of roles.
The issue of sharing between personal and professional email accounts is particularly acute in the public sector where such sharing may have the effect (however inadvertently) of undermining record-keeping obligations and the public’s rights to access government information. However, the issue should be of equal concern in the private sector where such sharing has the potential to subvert information security policies, data retention programs and access to personal information requests under privacy legislation, and complicate the process of collecting and preserving documents in litigation.