Policy overview
This policy sets out individual responsibilities when using non-corporate communication channels (NCCCs) for council business.
It assists in reducing information risk while recognising the need for flexibility in exceptional circumstances.
A NCCC is a system that does not provide corporate access to the information held on it.
Scope
The policy applies to council business conducted via:
- SMS
- Signal
No other NCCCs, including private email, are authorised to communicate council business.
Corporate use of social media platforms is not included within the scope of this policy. These are managed under the social media policy and coordinated by our communications team.
General responsibilities
You must use council systems for council business unless it is necessary to use a NCCC and no alternative corporate solution exits.
If it is necessary to use NCCCs then you must:
- exercise professional judgement and ensure you can justify its use
- be proportionate
- only use them for communicating basic, non-sensitive information
NCCCs must not be used for sensitive communications unless there are exceptional circumstances. In any instance you must keep it to the absolute minimum and where possible delete the communication as soon as is practicable. Sensitive information relates to information which if lost or compromised could have a moderately negative impact on the council or individuals. Examples include:
- Special Categories of Personal Data such as health or ethnicity data
- commercially, politically, or financially sensitive information
Communications remain our responsibility and continue to be subject to our policies including our:
Council information held on NCCCs could become the subject of an information access request and you may be asked to search NCCCs in response to a request. Deletion or concealment of material relevant to an information request may be a criminal offence.
Records management
A communication that is a record of an activity or transaction, or which presents business value, such as that which supports decision-making, must be captured into council systems to support accountability and transparency.
You are responsible for deciding whether this applies to each communication using professional judgement and considering the context.
You should capture such information:
- by copying, forwarding, exporting or by screenshot onto a council system; or
- by recording its substance in a message, note or document on a council system
You must ensure that ‘disappearing message’ functions within some NCCCs do not undermine accountability and transparency.
Using the NCCC
Where available switch on Multi Factor Authentication (MFA) and do not share MFA verification codes.
Review the default privacy settings to ensure the most appropriate privacy settings are in place.
Only allow the NCCC to have the minimum permissions necessary to support your business requirements.
Only use the NCCC on a corporate device unless exceptional circumstances apply i.e. business continuity.