Investigating Business Communications on WhatsApp

Organisations increasingly face the challenge of business communications conducted via messaging applications such as WhatsApp. This presents significant issues for regulatory compliance, internal investigations, and litigation discovery. Untracked and unmanaged communications can create substantial evidential gaps and compliance risks.

Understanding how to identify, preserve, collect, and review WhatsApp data is crucial. This note provides practical guidance for solicitors, in-house counsel, and investigators navigating these complexities within a UK legal context, ensuring adherence to regulatory obligations and robust evidential practice.

The Proliferation of WhatsApp in Business Contexts

WhatsApp's widespread adoption has blurred the lines between personal and professional communication. Employees often use it for quick discussions, project updates, and even sensitive client interactions. This 'shadow IT' use, where unofficial applications are used for business purposes, bypasses official record-keeping systems and IT oversight.

The convenience of WhatsApp, with its end-to-end encryption, also creates significant difficulties for discovery and compliance. While encryption enhances privacy, it complicates access during investigations or disclosure. UK regulators, including the FCA and CMA, expect organisations to maintain comprehensive records of business communications, regardless of the platform used. Failure to do so can lead to penalties and adverse inferences.

Consider, for instance, the implications for an FCA-regulated firm. The FCA Handbook requires firms to record relevant communications. If critical business decisions or client advice are exchanged solely on WhatsApp, without capture into official systems, the firm risks non-compliance. Similarly, in internal investigations into misconduct, vital evidence may reside on these personal devices.

Regulatory and Legal Imperatives for WhatsApp Data

UK legal frameworks impose clear duties regarding the preservation and production of relevant information. CPR Part 31 and Practice Direction 57AD mandate a thorough and proportionate approach to disclosure. This extends to data held on non-traditional platforms, including personal devices used for business. The Disclosure Review Document (DRD) requires consideration of all potential sources of disclosable documents.

For regulatory investigations, the obligation is often even stricter. Regulators like the SFO or CMA can issue notices requiring the production of specific information. The Bribery Act 2010, for example, can involve scrutiny of communications related to corporate hospitality or payments, which might occur on WhatsApp. Evidential gaps here can undermine a defence of adequate procedures.

Data protection laws also apply. UK GDPR provisions govern the processing of personal data. When collecting WhatsApp data from employee devices, organisations must ensure a lawful basis for processing, transparency, and data minimisation. This requires careful consideration of privacy rights versus investigative needs.

Specific UK Frameworks and Their Relevance

• CPR Part 31 and PD 57AD: Mandate a reasonable and proportionate search for relevant documents, including those on personal devices if used for business.
• FCA Handbook: Specific record-keeping rules for regulated firms often extend to all business communications, irrespective of platform.
• Bribery Act 2010: Investigations often require access to all communications related to potential corrupt practices.
• UK GDPR: Imposes strict rules on data collection, processing, and retention, particularly when accessing data from personal devices.
• Investigatory Powers Act 2016: Provides legal mechanisms for law enforcement to intercept communications, but this is distinct from civil or regulatory disclosure.

Challenges in Preservation and Collection

Preserving WhatsApp data presents unique challenges. Unlike corporate email servers, WhatsApp data typically resides on individual mobile devices. This decentralised nature makes a traditional legal hold difficult to implement effectively.

The end-to-end encryption means data is only decrypted on the device itself. While backups can be made, they are often encrypted or stored in proprietary formats. Cloud backups (e.g., Google Drive, iCloud) add another layer of complexity, as they are often personal accounts, making access more difficult.

Organisations must act quickly once a duty to preserve arises. Spoliation of evidence is a significant risk. Employees may delete messages, uninstall the application, or reset their devices. Clear, unambiguous legal hold notices are essential, along with a defined process for device imaging or data extraction.

Key Preservation Considerations

• Legal Hold Notices: Must explicitly mention mobile devices and messaging applications, detailing the scope and duty.
• Device Custody: Establishing a chain of custody for mobile devices is paramount if physical collection is necessary.
• Remote Wipe Policies: Review existing mobile device management (MDM) policies to ensure they do not inadvertently destroy evidence.
• Backup Management: Understand how WhatsApp backups are configured - local, iCloud, or Google Drive - and the implications for access.

Practical Steps for Investigating WhatsApp Communications

A structured approach is vital when investigating WhatsApp data. This often involves a multi-stage process, integrating eDiscovery principles.

1. Identification and Scope

• Identify Custodians: Determine which individuals are likely to hold relevant WhatsApp communications.
• Interview Custodians: Ascertain usage patterns, device types, and whether business discussions occurred on WhatsApp. Document these interviews thoroughly.
• Define Scope: Establish the date range, key terms, and specific groups or individuals involved in the relevant communications.

2. Preservation and Legal Hold

• Issue Specific Legal Hold: Instruct custodians not to delete messages, uninstall the app, or reset devices. Explain the duty clearly.
• Prevent Spoliation: Consider temporary suspension of device updates or remote wipe functions if these pose a risk.
• Early Data Capture: For critical data, consider immediate forensic imaging or data extraction where legally permissible and practically feasible.

3. Collection

• Consent and Policy: Obtain explicit consent from custodians to access personal devices, or rely on clear corporate policies regarding device use.
• Forensic Collection: Use specialised forensic tools to extract WhatsApp data from mobile devices. This ensures data integrity and metadata preservation. Tools can extract chat databases, media, and associated metadata.
• Cloud Extraction: Where legally permissible, access cloud backups (iCloud, Google Drive) with appropriate legal authorisation or consent. Note that these backups may be encrypted.
• Official Account Data: In some cases, WhatsApp may provide data under specific legal orders, but this is rare for general investigations.

4. Processing and Review

• Decryption and Parsing: Forensic tools decrypt and parse the extracted WhatsApp data into a reviewable format.
• Normalisation: Convert proprietary WhatsApp formats into standard eDiscovery formats (e.g., CSV, JSON, PST) that can be loaded into review platforms.
• Metadata Extraction: Extract crucial metadata such as sender, recipient, timestamp, and message type.
• Early Case Assessment (ECA): Use search terms, date filters, and custodian filters to quickly narrow down the dataset.
• Review: Conduct a thorough review using eDiscovery platforms, applying relevant search terms, de-duplication, and threading where possible.

5. Analysis and Disclosure

• Contextual Review: Review messages within their conversation threads to maintain context.
• Privilege Review: Identify and redact privileged communications.
• Reporting: Generate reports of relevant communications, ensuring defensible audit trails.
• Production: Produce WhatsApp data in an agreed format (e.g., PDF, native file with load files) for disclosure or regulatory submission. Ensure metadata is preserved where required.

Integrating WhatsApp into the eDiscovery Workflow

Addressing WhatsApp communications requires integration at every stage of the eDiscovery Reference Model (EDRM).

Identification

This phase must explicitly include mobile devices and messaging apps as potential data sources. Initial interviews and questionnaires should query the use of WhatsApp for business purposes. Understanding organisational policies regarding personal device use for work is critical. This informs the scope of data sources for subsequent steps.

Preservation

A legal hold must extend to WhatsApp data on personal or corporate mobile devices. This involves clear instructions to custodians not to delete messages or tamper with devices. Consider implementing technology to remotely preserve data if company-issued phones are in use, or providing clear instructions for personal device backups.

Collection

This is arguably the most challenging phase. It requires forensic expertise to extract data defensibly. Mobile forensic tools are essential for comprehensive and forensically sound data acquisition from devices. This ensures the integrity and admissibility of the data. Consent or legal authority is paramount for accessing personal devices.

Processing

Extracted WhatsApp data, often in complex proprietary formats, needs processing into a reviewable state. This includes decryption, parsing, and normalisation into standard eDiscovery formats. Metadata extraction - such as sender, recipient, date, time, and message type - is crucial for efficient review and analysis.

Review

Review platforms must be capable of displaying WhatsApp conversations in a clear, linear, and contextual manner, akin to how they appear on a device. Reviewers need to see the full thread, associated media, and reactions. Standard search terms, conceptual analytics, and AI-assisted review can be applied to large WhatsApp datasets.

Analysis

Analysts examine the reviewed data for patterns, relationships, and key insights. This may involve charting communication flows, identifying key individuals, or constructing timelines of events. The context provided by sequential messages is vital for accurate analysis.

Disclosure/Production

Finally, relevant and non-privileged WhatsApp communications are produced in an agreed-upon format. This typically involves producing PDFs of chat logs, often with accompanying load files that include metadata. The production must be defensible and meet the requirements of the court or regulator, including the use of appropriate redactions.

Organisational Policy and Prevention

The best defence against WhatsApp-related eDiscovery challenges is a proactive organisational policy. Clear guidelines on acceptable use of messaging applications for business purposes are essential. These policies should differentiate between corporate-issued devices and personal devices used for work.

Organisations should consider whether to permit WhatsApp for business at all. If permitted, a policy must dictate how business communications are to be retained. This might involve requiring employees to forward relevant messages to official record-keeping systems (e.g., email, CRM) or using enterprise-grade messaging platforms with built-in archiving capabilities.

Regular training for employees on these policies and their eDiscovery obligations is also critical. Ignorance of policy is rarely an accepted excuse in regulatory matters or litigation.

Key Policy Elements

• Acceptable Use Policy: Clearly define which communication platforms are approved for business use.
• Device Policy: Differentiate between corporate and personal devices and outline expectations for each.
• Data Retention Policy: Specify how business-related WhatsApp messages should be captured and retained.
• Employee Training: Educate staff on policies and their duty to preserve information during legal holds.
• MDM Solutions: Implement Mobile Device Management for corporate devices to enforce policies and facilitate data collection.