ICO launches formal investigation into use of private email accounts at Department of Health and Social Care

In a blog Information Commissioner Elizabeth Denham said the ICO had served information notices on the department and others to preserve evidence relevant to her inquiry.

The ICO’s investigation will establish if private correspondence channels have been used, and if their use led to breaches of freedom of information or data protection law. The watchdog will publish the results of that investigation in due course.

Denham said the suggestion of ministers and senior officials using private correspondence channels, such as private email accounts, to conduct sensitive official business was a concerning one.

“It concerns the public to feel there may be a loss of transparency about decisions affecting them and their loved ones. And as the regulator of data protection and freedom of information laws, it concerns me,” she said.

Denham stressed that the use of private correspondence channels does not in itself break freedom of information or data protection rules.

However, she said that her worry was that information in private email accounts or messaging services was “forgotten, overlooked, autodeleted or otherwise not available when a freedom of information request is later made”.

This frustrated the freedom of information process, and put at risk the preservation of official records of decision making, the Information Commissioner said, adding that she also worried that emails containing personal detail were not properly secured in people’s personal email accounts.

Denham pointed to the ICO’s guidance on the use of private communication channels, which she said had been available on its website for a considerable period of time.

The government’s own Code of Practice also sets clear standards, and emphasises the importance of good records management in ensuring public trust and confidence, particularly following a national crisis, she said.

Denham noted that the ICO has a range of powers following the completion of an investigation, ranging from good practice recommendations and enforcement notices, up to the option of criminal prosecution of individuals where information has been deliberately destroyed, altered, or concealed after it has been requested under the Freedom of Information Act.

“I will follow the evidence in this investigation where it leads and use all the powers available to me to ensure a full understanding of what has happened,” she said. “I will not comment further until the conclusion of our investigative work.”