The review of the policies and practices of 22 agencies found messaging apps are an established feature of digital communications in the Australian Public Service, though are regularly being used without adequate policies and procedures that reflect statutory obligations. It provides four recommendations for government agencies.

The primary objective of the report is to provide information, advice and assistance to agencies around the use of messaging apps. Messaging apps – such as Signal, WhatsApp, Facebook Messenger and Telegram – are an established feature of personal and professional communication. A common function of these messaging apps is the ability to send messages that disappear after a specified period.

Key findings

• 16 of the 22 agencies permitted the use of messaging apps, three prohibited their use, and three did not have a position.
• 12 of the 16 agencies that permitted their use endorsed, encouraged or communicated a preference for the use of Signal (one of these also endorsed, encouraged or preferred WhatsApp).
• Only half of the agencies that permitted their use had policies or procedures about their use for work purposes.
• These policies generally did not address freedom of information (FOI), privacy and other key obligations.

Recommendations

1. Agencies should review existing policies or develop a policy to clearly set out whether or not they permit the use of messaging apps for work purposes.
2. Agencies that permit the use of messaging apps should have policies and procedures that adequately address information management, FOI, privacy and security considerations.
3. Agencies should examine the features of messaging apps needed to support official work. This should involve conducting appropriate due diligence on apps, considering the implications for communications with other agencies, and developing policies and procedures for individual apps.
4. Agencies that permit the use of messaging apps should conduct due diligence to ensure any preferred messaging app collects and handles personal information appropriately. This may be achieved through a privacy threshold assessment.