BeReal risks data breaches – are your policies REAL-ly secure?

BeReal risks data breaches – are your policies REAL-ly secure?

That BeReal is putting organisations at risk of data breaches is certain. The evidence is quite literally out there.

This new platform is giving people a peek into the real lives of their friends. But what if they are at work? What if they capture some information in the workplace that should not be shared? You, as the data controller would potentially be liable for a data breach.

How watertight are your social media policies and how safe is your organisation from this phenomenon that is taking so called generation Z by storm. (People born approx. 1997-2012).

Let’s unpick this.

Firstly, what is BeReal?

According to their main strapline – it is not another social network. What it is, is a photo sharing app. The idea is that you and all of your friends get a notification from the BeReal app at the same time that gives you two minutes to share a photograph of what you are doing at that exact time. Simply pick up your phone and take a ‘real’ photo there and then. Your friends can then comment and react.

The app was launched late in 2019 but it is this year that it has really taken off with a reported 27 million downloads worldwide – 4.8 million of these in the UK.

Social media channels such as Twitter have been full of people commenting on how much confidential information they are zooming in on, on the BeReal images.

Policies Policies Policies

There is more than one area to consider here. The first and biggest though, I would suggest, is that you have a policy in place that ensures that personal phones are not permitted to be used in the workplace. IF this is not possible for you (I know for some firms the staff use their own phones for work purposes – which I don’t recommend but that is a blog for another day) then alternative policies must be put in place.

1. Ideal = no personal phones in the workplace
2. No loading of BeReal or similar social media apps on organisation’s devices
3. Belt and braces or backup to the above = confidentiality agreement – stating that nothing will be shared
4. GDPR training – ensure the staff know that if they so much as transmit an email address or ANYTHING that can identify an individual, they are breaching the GDPR and putting the company at risk.
5. In the short term, remind your staff that if any of the following is shared publicly it could be classed as a potential data breach:a. Personal names
   b. Addresses
   c. Images of people
   d. Phone numbers
   e. Financial information
   f. Medical information
   g. Folders with ID references on desks
   h. Personal data on screens
   i. Names and personal details on dry-wipe boards
   j. Other personal information

Working from home

This makes the situation even more difficult to police because of course the staff member will have their mobile phone with them. Here it will be imperative that you have both a confidentiality agreement and the GDPR training in place.

Company devices

On the other side of the equation, I would also suggest an acceptable use policy regarding company devices to ensure that BeReal is not used on company phones or tablets.

Consider what happens to the images.

Are you a user of BeReal? If you are, please take heed of the above and do not take any pictures in the workplace, or during work activities, you are putting too much at risk for the sake of a tiny bit of social interaction (when you should be concentrating on your job).

But potentially even more concerning is what kind of profile BeReal is building up about you and your friends. The more images you snap, the bigger the overall picture of your daily life is being built up. BeReal is collecting this data, including your location data unless you have opted out.

Does your business have a robust policy for dealing with this? Does BeReal risk data breaches in your organisation? Would you like a second opinion, or do you need some help with your GDPR training and implementation? If so, then please take advantage of your complimentary thirty-minute Zoom consultation.