Unauthorised circulation of confidential documents containing personal data in social media network – DPP 4 – security of personal data
Background
A government department reported to the PCPD that a staff member had uploaded a memo containing the names, service numbers, ranks, posting, stationed units and examination dates of 138 service members who would sit for an internal examination in a WhatsApp group without authorisation.
This case originated from the staff member concerned, who noted that all those service members who would sit for the examination were off duty when she received the memo. As she had been requested to disseminate the respective examination dates to the members concerned for preparation of examination, she captured the relevant pages of the memo and shared the image to the members involved in the WhatsApp group to prevent unnecessary delay. Upon receipt of the images, one member in the WhatsApp group further forwarded the image to another WhatsApp group comprising his squad members.
Remedial Measures
To prevent recurrence of similar incidents, the department circulated e-memos to remind its service members to observe the safe use of social media networks and the proper handling of personal data and confidential documents. The department also enhanced staff awareness of personal data privacy protection by issuing another memo citing this incident as an example, briefing the relevant staff members on the importance of compliance with the e-memos, providing ongoing training to all members concerned, etc.
Lesson Learnt
Instant messaging applications like that in this case enhance convenience for communication. If used improperly, however, it may create adverse effects on the privacy of individuals in relation to personal data. The staff concerned in this case had obviously failed to give due consideration to the established protocols on the proper handling of confidential documents containing personal data when using social media networks. Such act could result in inadvertent disclosure of personal data which should be avoided.
(Uploaded in July 2022)