Despite the availability of many other forms of electronic communication, email usage has never been higher, and it remains a key way of conducting business for charities. There are a number of risks and pitfalls to be aware of though when it comes to using email in your trustee duties for your church or charitable organisation. As this article explains, many of these risks can be reduced by using an email account provided by the church or charity rather than a personal email account.
1. Subject Access Requests
A data subject access request (SAR) can be made of any organisation by any individual that the organisation holds data on. (Find out more about SARs and how to deal with them).
A SAR will often cover emails that refer to that individual. If you use your organisation’s email account for work purposes (or a personal email account dedicated to work purposes), then the SAR could not lawfully extend to any personal email account you use for non-work purposes. However if you use an email account for both work purposes and personal purposes, the request could lawfully cover all emails in that account, personal and professional. You would therefore need to provide access to your personal email account so the organisation could process the SAR, and potentially have to allow the individual to see what you have said about them in any unguarded non-work communications. Would you be prepared for this if a SAR was made?
2. Record retention and deletion
Emails often contain important information either in the body of the email or their attachments, but what do you do with these emails? Having them sit in your inbox means they remain at risk from being forwarded on by mistake, and may also be subject to a SAR should you receive one. Best practice is to save important information from an email – ideally in a centralised information base (such as iCloud or SharePoint) if your organisation has one – and then delete the email once it is no longer needed. Please note that a SAR can cover items sitting in your deleted folder, but you would not normally be legally required to reinstate items that have been deleted from your deleted items.
3. Record searchability
How many of us have spent hours trying to find an email containing some bit of information we need? Not only is storing important information in your inbox risky, but also impractical and time consuming when it comes to needing it. Storing it in a central information base is much less risky and more efficient, as (assuming you have a good system!) you will know exactly where to find the information you need.
4. Data breaches
Data breaches are the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Whilst they can happen even if you have a designated email domain for your organisation, the risk is greater and the control you have lower if using an external email provider. If that external provider experiences a data breach, the sensitive data contained in your trustee-related emails could be leaked. It may therefore be more secure to use the email address provided by your church or charity, if there is one.
If you use a personal email address, there may be a greater risk of unauthorised or accidental access of it by others in your household, for example if they have access to the same equipment you use to access your email.
5. Cyber attacks
Charity trustees are increasingly being targeted as ‘big fish’ by cyber criminals, both as targets themselves, and as means of targeting others.
As personal email addresses are used for all kinds of online interactions and often connected to social media accounts, they generally suffer greater exposure to cybercriminals, and generally have less security attached to them than an organisation’s email. As a result, using a personal email address for your trustee duties could increase the risk of receiving and therefore falling for cyber scams. Using a recognised organisational email address can also provide greater protection and peace of mind for those coming into contact with your organisation – if you receive an email from us @edwardconnor.com there is greater confidence that we are who we say we are; if it comes from a @gmail or @hotmail address for example, there is a greater danger that this could be a fake address, or a hacked personal account.
If your church or organisation has a website and you are worried about email addresses being visible, there are ways of protecting these which your website manager (if you have one) may be able to advise on, or you may want to use a contact form rather than present an email address.
See the NCSC Cyber Security Toolkit for Boards for further guidance to protect against cybercrime.
6. Operations
A final thing to be mindful of (and not just for trustees, but for members of staff or non-trustee church leaders) is having certain functions such as websites, social media accounts or licenses/subscriptions linked to a personal email address. If that person moves on, transferring access to another person is a lot more difficult. Does your church or organisation have a plan for when the person operating that function steps down and someone else needs to take over?
Support from Edward Connor Solicitors
We have a high level of expertise in data protection and want to help churches and Christian organisations navigate these tricky waters, that their gospel ministries might flourish. If your church or charity receives a SAR, our SRA Pack contains template documents and guidance to help organisations respond appropriately. Our GDPR Pack contains comprehensive guidance notes, template policies (including information security, record retention and data breach procedure), an extensive FAQs document and much more.
This information has been provided by solicitors working for Edward Connor Solicitors. It is designed for the purpose of knowledge sharing only and does not constitute legal advice.
