Should a Clerk be using their private personal computer for all council business?

Question

It's just come to light that for more than a year our Clerk has not been using the laptop bought out of public funds and provided solely for our council's use. Instead, the Clerk has been using their own computer for our council business. This was not brought to the council's attention as an agenda item to be addressed at any convened meeting during the Clerk's tenure. The council bought its own laptop along with a combined printer/scanner which we now find out is used by the Clerk for both our council's work and the other much larger council they are Clerk to - again without this fact being made clear to or agreed by our council. 

Is this common practice? Is it a proper way to administer council business? Are there any security/data protection/insurance/other risks in using a private computer for council work? Should it be challenged?

I recall that our ALC provided special grants available for a short period of time a couple of years ago for councils to buy sole-use laptops on the grounds that private computers should not be used by Clerks for council business, and that Clerks should never use one computer for several councils' business. Each council should keep separate its own computer for safety and security reasons, particularly with concerns about protecting GDPR. 

This appears to have been backed up by our Internal Auditor at the time, who wrote much the same in his annual accounts report, and made the recommendation, taken up almost immediately afterwards by the council, that the council should own and use a completely separate set of office equipment. Our Clerk claims they have it on good authority that they have every right to choose whether they use their own laptop or that owned by the council, and they have chosen to use their private laptop. Is this correct?

 

Answer 1

A key principle of the UK GDPR is that you process personal data securely by means of ‘appropriate technical and organisational measures’ – doing this requires you to consider things like risk analysis, organisational policies, and physical and technical measures.  

Your measures must ensure the ‘confidentiality, integrity and availability’ of your systems and services and the personal data you process within them. The measures must also enable you to restore access and availability to personal data in a timely manner in the event of a physical or technical incident.

It is for the Parish Council (as the data controller) - and not your Clerk - to decide how best to meet its responsibilities. If your Clerk continues to use his own laptop, how comfortable are you that you can ensure the confidentiality and security of your information? 

The ICO has published Bring your own device (BYOD) guidance for organisations who want to allow staff to use personal devices to process personal data which may be helpful to inform your thinking.

Answer 2

By Default NO the clerk should not be using their personal computer for Council Business if he/she has the use of a corporate one.  It creates numerous issues and is bad practice.  Using a personal laptop introduces risk which may amount to a breach of the CLerk's contract of employment & job description as a data controller.  What antivirus software is being used?  What firewall is in use?  What happens if the hard disc fails in the personal laptop? What happens if it is hacked. What data backup processes are in place? What happens if a family member uses the machine and gets a virus on it or a ransomeware demand with a threat of data encryption if the ransom isn't paid? The parish Council can put in place measures to manage the risks above on a corporate device, but how can they know for certainty what the answers are to the above on a private machine they have no access to?  I was an Officer for a Principal Authority until retiring recently, and used a corporate laptop to work from home during covid restrictions.  The ICT policy was very clear - use the corporate device, based on the risks above. The Council have an obligation to comply with legislation and introducing an element of non compliance via equipment they have no jurisdiction over should be rejected.

Answer 3

“...Our Clerk claims they have it on good authority that they have every right to choose whether they use their own laptop or that owned by the council,..”

Your clerk is an employee and should conduct their duties as directed.  Claiming to “have it on good authority” is utter nonsense  All of the reasons stated above are completely correct.  What are you going to do if that employee resigns, retires, is fired, goes sick?  All of a sudden you’ve lost access to your records  

Comments

I raised the issue with the External Auditor who seemed to think it was OK and the council could not dictate that the clerk should use the council's computer if they wanted to use their own personal one. I was astonished.