GDPR-Compliant Communication via Messenger in Companies

The Advantages of Instant Messaging for Companies

Organizations of all types and sizes have come to rely on messaging services as a quick and versatile means of communication. Employees use chat services all the time to exchange sensitive corporate data. The rise of remote and mobile work in the wake of the COVID-19 pandemic has led to a growing interest in chat apps for fast and straightforward communication in work environments.

Instant messaging offers significant benefits:

• High flexibility: Information can be shared quickly and easily via instant messaging even with employees who work from home or are on the go.
• Efficient one-to-many communication: Using group chats, distribution lists and news feeds, the entire workforce, certain departments, or individual employees and external contributors can be addressed in a fast and efficient manner. The information can be transmitted in various forms (texts, images, videos, files, links, and voice messages).
• Employee satisfaction: The staff already uses instant messengers outside of the office and has no trouble adopting them in the workplace.

It is therefore almost impossible for companies to do without a chat service. The challenge is to find a secure and GDPR-compliant messenger that offers both the required functionality and sufficient ease of use. Because companies often lack the necessary expertise, there’s a lot of uncertainty about which popular chat apps can safely be adopted at work.

Study: Privacy-Compliant Messengers for Business Communication

The current legal situation regarding the corporate use of instant messengers is complex and rather confusing. According to the study mentioned above, few messaging solutions are suitable for business communication because most do not comply with the GDPR.

However, full compliance with data protection laws is crucial to protect corporate data and trade secrets and to avoid hefty GDPR fines. The FZI study puts forward three main recommendations for companies:

Take Measures to Ensure Data Protection

Companies that want to use instant messengers are advised to study the relevant legal requirements in detail. They should only consider privacy-friendly technologies and make the necessary organizational, legal, and technical arrangements to protect both the sensitive data itself as well as any metadata from misuse.

At the same time, effective data protection depends on an awareness and responsible behavior among the staff. When a company introduces a messaging solution, all staff members should be educated about its lawful use.

Avoid Messenger Apps from Countries Outside the EU

The study strongly advises against using messenger services that involve the transfer of data to a country outside of the European Union if no adequacy decision has been adopted by the European Commission.

Particularly the transfer of personal data to the United States is deemed highly problematic ever since the EU–US Privacy Shield has become invalid. The CLOUD Act allows intelligence services and investigative authorities in the United States to access personal data from companies in the EU and Switzerland at any time if the data is stored on US servers.

Separate Personal and Professional Communication

The authors of the study also recommend keeping private and corporate communication strictly separate. That way, sensitive company data cannot fall into the hands of third parties by means of insecure chat apps. Businesses should introduce a GDPR-compliant messenger that was developed for corporate use and is reserved for sharing work-related information.