Does Your Academy Trust Prevent Staff and Governors from Using Their Personal Email Addresses?

In our experience many trusts do not realise that staff and governors using their personal email addresses for governing body work raises data protection risks until it is too late.

Information Security

Your trust must take measures to keep personal data secure. This is the case under the current Data Protection Act (DPA) and under the GDPR.  By permitting staff and governors to use personal email accounts, it is unlikely that you will be doing enough to safeguard personal data. 

Many households share computers or email accounts. In addition, home computers often remember passwords. All of this means that there is a risk of access to trust data by family members or, worse still, by anyone who gains unauthorised access to the computer either by theft or 'hacking'. In addition, personal email accounts will often 'sync' with other devices by default. This means that an email saved to a governor's personal smartphone may also appear on their PC, tablet and on their online 'cloud' account. 

Data Subject Rights

Under both the DPA and the GDPR individuals have rights in their personal data. The most commonly exercised of these rights is the right of subject access. If an individual makes a subject access request (SAR) your trust is obliged to provide them with a copy of their personal data subject to various exemptions.

Responding to a SAR will involve carrying out extensive searches for the requester's personal data and in many cases this will involve searching emails. If you know that staff and governors use email addresses which do not belong to the trust for work reasons, and you have good reason to believe that the requester's personal data might be held on a non-trust email account, then you are obliged to consider the contents of these email accounts when responding to the SAR.

This raises a number of issues. If a governor uses an email account which belongs to their employer, that employer is unlikely to provide your trust with access to the email account to carry out searches. Secondly, if a staff member or governor is away for the holidays you may need to carry out urgent searches of their emails in their absence and this will not be possible on a non-trust email account. This becomes problematic as there is a strict timeframe for complying with a SAR. Under the GDPR the timeframe is one month in most cases.

Steps to Take

There are four key measures to take:

1. Provide all of your governors with trust email addresses
   
   
2. Include a prohibition on using personal email addresses for trust work in a staff policy (such as an information security policy) and make it clear to staff that they face disciplinary action if they breach this policy
   
   
3. Train your staff and governors on the importance of keeping information secure which includes only using their trust email account
   
   
4. Provide the technology to enable staff and governors to access their trust email address securely when using personal devices (eg. mobile device management)

For specialist advice on information security measures for you trust, please contact Andrew Gallie on 0117 314 5623 or complete the below form.