At least for the financial institutions on this list, I can say they have no other choice. Regulation forces them to log everything to avoid insider trading, etc. Any communication outside of their internal systems can't be logged and is therefore a compliance risk.
Been a sackable offence for over a decade in finance, I can not fathom why other sectors have been so slow to enforce some basic standards.
Recording every call, message (and in my office - thing you said at your desk) is mostly used for conflict resolution - when counterparties disagree you go to the tapes and see what was said. From there my word is my bond, it is done.
It provides a right to privacy if the company allows personal messaging services on the device, but I don't think it provides a right to having personal messaging apps on the device(s).
Personally I think it's much cleaner to keep work stuff on your work device(s) and personal stuff on personal devices. The only place that gets sticky is where companies don't provide the device but want you to have work information on it (e.g. mobile phones)
It is a right in EU to have some level of personal activity on work-supplied devices. This does not come from the GDPR but some other legislation. We had a call with HR about that only recently when some leader again suggested "just block xyz on work devices".
And if you don't want to use BYOD we are required to supply a phone if we require employees to use one (which we do, for MFA).
As much as I prefer the European way of some items. I think the American way of treating the work computer as a company asset and just locking it down to an insane degree makes way more sense. Especially for areas like finance.
I've been in a lawsuit with Oracle (as engineer, not direct). And their discovery hit EVERYTHING.
If I used work devices for personal messages, my personal messages would absolutely been in scope.
Or if I used personal devices for work, my personal devices are now in scope. Hell NO!
My work laptop is on my personal network. Its also on its own vlan and can only talk to the imternet, and not fellow devices. And I can attest to that as much if I'm ever called in for a discovery hearing.
I have my work items on a separate network as well but my motivation is more not trusting some random item being pushed down from corp and having it scan my network or something.
Discovery doesn't work like that in Europe though. It's not nearly as all-encompassing. And personal messages definitely would not be in scope. I think this is one of the reasons there is so much difference in strategy.
When we get requests to "legal hold" an account for discovery, this is always coming from the US.
That is more of a problem with the insane discovery system in the US than with anything else. If you had worked in Europe, GDPR would have protected your personal data from being sent over, as the Credit Suisse case has shown. They had to scrub all personal data before transferring files to a US counsel.
> Or if I used personal devices for work, my personal devices are now in scope. Hell NO!
In Europe, unless it's a criminal investigation, which this wouldn't be, there is no way a lawsuit would touch your personal devices if you didn't agree (and mostly also nobody would care I think).
Not to forget many constitutions enshrining privacy of correspondence which extends to emails and instant messages. Lot of work done to poke holes on it but generally it still holds somewhat in many countries.
Which is actually a good reason for entities subject to GDPR to forbid use of personal messaging apps on work devices... (And to forbid users to use work / official apps for personal messaging.)
I don't understand why they put this up like it's working in their favor. Their website doesn't explain anything extraordinary that makes them different from the average chat app, except that it is europe based.
If anything it is highlighting the pointlessness of any new messaging platform. Companies can and should lock down to the platform that comes with their subscription for everything else - and for all personal matters that is locked down with network effects by sms, whatsapp & wechat.
You could maybe make the case for a federated - email like - messaging service for inter company / party communications. Matrix basically ...
Why would they need anything different? If they offer the same features as other chat apps, they can simply aim to compete on price (and/or on other non-functional attributes like performance, reliability, UX, social connection, etc).
In reality, they don't, not really. The only important differentiator is whether your friends use it and whether you have to self-host a server to use it (which has a large impact upon point 1).
I'm not reading anything in this article that seems to pretend like it's working in their favour?
It's just an article from a company about their industry, companies do that all the time for brand recognition, building trust (showing expertise in their domain), and educating potential customers about why they might need this sort of product (lead generation).
Our company does the same. We are not allowed to use whatsapp for any work-related stuff.
This is for several reasons, mostly security and data-loss prevention. On Teams we can monitor with purview what happens with personal (customer!) data, which is mandatory here in europe under GDPR. We must take steps to ensure it is only processed by entities we have a data processing agreement with.
But we don't block people from using it for personal purposes of course. Whatsapp groups between colleagues to coordinate lunch options and nights out are super commonplace and perfectly fine. Even on work hardware (on android on the personal side of the phone, on iOS we just block copy/paste into whatsapp from corporate app).
I even saw our CISO using whatsapp web on his corp laptop. It's fine as long as it's not used for actual work. Here in EU it is mandatory to permit some level of personal activity even on work devices.
I'm living a glorious Outlook-free life at work. I'm glad that I don't need any of that crap. Maybe Slack is right to push people away from the Microsoft shitware that businesses stick to.
What does that even mean? I doubt you can forbid the usage of personal messaging apps except in very exceptional cases (like a court room).
On the other hand: Using personal messaging apps for work related information is a no-go anyway because of confidentiality agreements basically everyone signs.
- Ban ANY use of your personal chats / device at work (eg. your wife texts you to bring milk on the way home)
- Ban WORK communication (eg. My colleague don't understand recent commit I've made)
So the web really isn't explaining how things enforced or what is being done.
I do know of some industries where you put your personal phone when entering specific locations or having stickers on cameras) but here I didn't fully understood the scope.
Using personal messaging apps for work, for example, sending work related messages through WhatsApp or Telegram instead of using the proper corporate/official app.
You can forbid your employees to use non official apps to send work related messages for privacy, compliance, security and other reasons.
I have not for couple of years, but before covid I've worked in a well-known Polish company that was trying to force everyone to use at first HipChat, then some awful OSS chat. My team set up discord then.
Meanwhile in Spain I use WhatsApp to contact the municipality, the GP uses it to send my blood results and package delivery drivers ask me to share my location. I hate it.
Thanks for typing the exact reply I wanted to give! Yes, I’m happy that I can request garbage pickup through WhatsApp instead of having to fill out a form at the municipal building. An online portal or app would be even better than WhatsApp.
Some secure online portal would be nice for the GP or municipality.
The delivery issues can be solved by introducing a standardized address system for Spain but that would take decades to roll out. Some people I know don’t even have an address, they just use the land registry number. Or just the name of their village + surnames, which is typically good enough for the standard mail (but not good enough for DHL/UPS/DPD packages, their drivers want your location via WhatsApp)
I'm surprised any company allows work to be done over employees personal apps/devices/numbers. If a colleague/boss contacted me about work via my personal number they'd be quickly told to never do it again.
It's not at all uncommon. I didn't have a usable work phone number for years given that, even when I technically had a desk, I was never there. I always used my personal phone and, for that matter, laptop for that matter.
At least for the financial institutions on this list, I can say they have no other choice. Regulation forces them to log everything to avoid insider trading, etc. Any communication outside of their internal systems can't be logged and is therefore a compliance risk.
Been a sackable offence for over a decade in finance, I can not fathom why other sectors have been so slow to enforce some basic standards.
Recording every call, message (and in my office - thing you said at your desk) is mostly used for conflict resolution - when counterparties disagree you go to the tapes and see what was said. From there my word is my bond, it is done.
GDPR guarantees a right to privacy even on work devices. I think you need to filter out personal messages if compliance requires logging.
It provides a right to privacy if the company allows personal messaging services on the device, but I don't think it provides a right to having personal messaging apps on the device(s).
Personally I think it's much cleaner to keep work stuff on your work device(s) and personal stuff on personal devices. The only place that gets sticky is where companies don't provide the device but want you to have work information on it (e.g. mobile phones)
It is a right in EU to have some level of personal activity on work-supplied devices. This does not come from the GDPR but some other legislation. We had a call with HR about that only recently when some leader again suggested "just block xyz on work devices".
And if you don't want to use BYOD we are required to supply a phone if we require employees to use one (which we do, for MFA).
The leadership can block anything they want on a work-supplied device. They might get the Works Councils on board but generally they can.
However they can not reduce private social life to zero at work [1]. And there the employees are guaranteed privacy. NB: This was pre GDPR.
This however does not go so far, that people must be allowed private chatting apps on work phones. They can and should use their private phones.
[1]https://www.jacksonboyd.co.uk/barbulescu-v-romania-work-rela...
As much as I prefer the European way of some items. I think the American way of treating the work computer as a company asset and just locking it down to an insane degree makes way more sense. Especially for areas like finance.
Exactly this.
I've been in a lawsuit with Oracle (as engineer, not direct). And their discovery hit EVERYTHING.
If I used work devices for personal messages, my personal messages would absolutely been in scope.
Or if I used personal devices for work, my personal devices are now in scope. Hell NO!
My work laptop is on my personal network. Its also on its own vlan and can only talk to the imternet, and not fellow devices. And I can attest to that as much if I'm ever called in for a discovery hearing.
I have my work items on a separate network as well but my motivation is more not trusting some random item being pushed down from corp and having it scan my network or something.
Yeah I'm about to do this too just to be safe.
Some of our antimalware like SentinelOne actually does this by default though we have switched it off for privacy reasons (EU)
Discovery doesn't work like that in Europe though. It's not nearly as all-encompassing. And personal messages definitely would not be in scope. I think this is one of the reasons there is so much difference in strategy.
When we get requests to "legal hold" an account for discovery, this is always coming from the US.
That is more of a problem with the insane discovery system in the US than with anything else. If you had worked in Europe, GDPR would have protected your personal data from being sent over, as the Credit Suisse case has shown. They had to scrub all personal data before transferring files to a US counsel.
> Or if I used personal devices for work, my personal devices are now in scope. Hell NO!
In Europe, unless it's a criminal investigation, which this wouldn't be, there is no way a lawsuit would touch your personal devices if you didn't agree (and mostly also nobody would care I think).
Not to forget many constitutions enshrining privacy of correspondence which extends to emails and instant messages. Lot of work done to poke holes on it but generally it still holds somewhat in many countries.
Which is actually a good reason for entities subject to GDPR to forbid use of personal messaging apps on work devices... (And to forbid users to use work / official apps for personal messaging.)
That sounds like a simple solution but it is not that simple, employees have a right to use work tools for personal reasons too within reason.
And GDPR explicitly forbids personal items to be released during discovery even to jurisdictions that require that.
I don't understand why they put this up like it's working in their favor. Their website doesn't explain anything extraordinary that makes them different from the average chat app, except that it is europe based.
If anything it is highlighting the pointlessness of any new messaging platform. Companies can and should lock down to the platform that comes with their subscription for everything else - and for all personal matters that is locked down with network effects by sms, whatsapp & wechat.
You could maybe make the case for a federated - email like - messaging service for inter company / party communications. Matrix basically ...
Why would they need anything different? If they offer the same features as other chat apps, they can simply aim to compete on price (and/or on other non-functional attributes like performance, reliability, UX, social connection, etc).
What would possibly differentiate a chat app?
It works reliably and without surprises. Messages are not lost. No weird errors.
Features: easy to switch devices, including PC. File transfers. Video sharing. Audio-to-text conversion out of the box.
E2EE? F/OSS? P2P?
In reality, they don't, not really. The only important differentiator is whether your friends use it and whether you have to self-host a server to use it (which has a large impact upon point 1).
I'm not reading anything in this article that seems to pretend like it's working in their favour?
It's just an article from a company about their industry, companies do that all the time for brand recognition, building trust (showing expertise in their domain), and educating potential customers about why they might need this sort of product (lead generation).
I would imagine this is the exact problem they are trying to stop:
Civil servant accused of leaking Govt information to foreign intelligence service in Ireland
https://www.rte.ie/news/courts/2026/0530/1576047-yevgen-mcke...
Our company does the same. We are not allowed to use whatsapp for any work-related stuff.
This is for several reasons, mostly security and data-loss prevention. On Teams we can monitor with purview what happens with personal (customer!) data, which is mandatory here in europe under GDPR. We must take steps to ensure it is only processed by entities we have a data processing agreement with.
But we don't block people from using it for personal purposes of course. Whatsapp groups between colleagues to coordinate lunch options and nights out are super commonplace and perfectly fine. Even on work hardware (on android on the personal side of the phone, on iOS we just block copy/paste into whatsapp from corporate app).
I even saw our CISO using whatsapp web on his corp laptop. It's fine as long as it's not used for actual work. Here in EU it is mandatory to permit some level of personal activity even on work devices.
Of course, the consequence is you end up communicating for work on something like Teams instead of an usable chat app.
Like zoom where you chat disappears when the meeting is closed?
Or how about slack, that lives in an alternate reality where outlook calendar can be ignored?
Teams will spam your outlook calendar :)
Slack is actually the best I've used for actual work comms so far. But then I mean communication, not calendar spam.
I'm living a glorious Outlook-free life at work. I'm glad that I don't need any of that crap. Maybe Slack is right to push people away from the Microsoft shitware that businesses stick to.
I refuse to install that malware on my phone. Upshot is that I don't get bothered by coworkers after hours.
True, Teams is a horrible tool. I wish we had something better but our company insists on keeping everything within the MS ecosystem.
"ban personal messaging apps at work"
What does that even mean? I doubt you can forbid the usage of personal messaging apps except in very exceptional cases (like a court room).
On the other hand: Using personal messaging apps for work related information is a no-go anyway because of confidentiality agreements basically everyone signs.
I also didn't fully understand if the context is:
- Ban ANY use of your personal chats / device at work (eg. your wife texts you to bring milk on the way home)
- Ban WORK communication (eg. My colleague don't understand recent commit I've made)
So the web really isn't explaining how things enforced or what is being done. I do know of some industries where you put your personal phone when entering specific locations or having stickers on cameras) but here I didn't fully understood the scope.
Yahoo messenger/BBM used to be popular when I was in banking and that's where banking was done. Then confirmed via email.
Now the idea is all banking related stuff is done on approved devices and clients so you can deal with retention(more like deletion) and loss.
And no personal chat clients too. If you're low enough on the pole, you don't even get to keep your personal devices with you.
Using personal messaging apps for work, for example, sending work related messages through WhatsApp or Telegram instead of using the proper corporate/official app.
You can forbid your employees to use non official apps to send work related messages for privacy, compliance, security and other reasons.
Finance - no personal devices in the office and no personal (or unauthorised) messaging apps on your work devices.
I've seen this too in a meta moderation center. They were real sticklers for this. Even personal headphones were not allowed.
I don't think this is legal in EU but for that kind of low-level work they tend to get away with that.
Last thing anyone wants is exfiltration of the content meta moderates ...
I see no EU regulation that would give employees a right to play with their phone on the job.
No but being reachable by family is important for example if someone is a parent.
However this company was super abusive anyway. Putting pressure on people to work nights and weekends etc. It was a subcontractor.
In the end meta replaced them all by AI moderation and fired thousands of people in one go.
Colleagues often setup WhatsApp groups etc so not on company slack/ms teams which will be monitored/loggged
What? 75% people use personal chats for work? I've never seen this in my over 20 years working in the UK, Poland and few other countries.
Personal messaging apps were always banned everywhere I worked.
I have not for couple of years, but before covid I've worked in a well-known Polish company that was trying to force everyone to use at first HipChat, then some awful OSS chat. My team set up discord then.
Meanwhile in Spain I use WhatsApp to contact the municipality, the GP uses it to send my blood results and package delivery drivers ask me to share my location. I hate it.
The 2016 coup attempt in Turkey was organized entirely on whatsapp. All of the conversations were recovered from multiple phones too.
Why not delete it? I assume that if you don't have it, they offer some other form of communication with you?
Yes, they do but they require walking to their office and deal with paper or call them during ever shrinking office hours. Take your poison.
Pick your poison.
“Take” sounds too threatening.
"Inject" is clearly the right word here.
Actually...
Shakespeare’s Othello (c. 1603‑1604)
Iago says to Othello: “Good name in man and woman, dear my lord, / … O, thou wilt choose thy poison, and be damned!”
Shakespeare did not have to deal with today's tech problems.
Thanks for typing the exact reply I wanted to give! Yes, I’m happy that I can request garbage pickup through WhatsApp instead of having to fill out a form at the municipal building. An online portal or app would be even better than WhatsApp.
Very funny.
Would you rather they used Teams? Or what would be a better alternative? Phone / email?
Some secure online portal would be nice for the GP or municipality.
The delivery issues can be solved by introducing a standardized address system for Spain but that would take decades to roll out. Some people I know don’t even have an address, they just use the land registry number. Or just the name of their village + surnames, which is typically good enough for the standard mail (but not good enough for DHL/UPS/DPD packages, their drivers want your location via WhatsApp)
I'm surprised any company allows work to be done over employees personal apps/devices/numbers. If a colleague/boss contacted me about work via my personal number they'd be quickly told to never do it again.
It's not at all uncommon. I didn't have a usable work phone number for years given that, even when I technically had a desk, I was never there. I always used my personal phone and, for that matter, laptop for that matter.
[dead]
TLDR: yes, governments in favor of Chat Control legislation want to make absolutely sure it doesn't apply to them.
Chat Control 1 or 2?