The ethnic vote memo that plunged Premier Christy Clark’s government into controversy last week was circulated on her staff’s private email addresses, a practice experts say raises serious security concerns.

Clark’s former deputy chief of staff Kim Haakstad sent the Multicultural Strategy Action plan from her Gmail account to seven people in January 2012. The recipients’ accounts were hosted on sites including Telus.net, Me.com and Shaw.ca.

But Richard Rosenberg, president of the Freedom of Information and Privacy Association, warned that web-based private email accounts have historically been vulnerable to hackers.

“The skills of people who break into these things have always been ahead of the skills of the programmers,” Rosenberg said.

“These systems do not produce the privacy you might expect, and therefore people should be somewhat careful.”

B.C. Privacy Commissioner Elizabeth Denham agreed, adding that sending government information on private emails is also potentially illegal.

Provincial law states that British Columbians’ personal information can only be stored in Canada, but if a government employee sends such data using Gmail, for instance, it will reside on a U.S. server.

“That opens up personal data to other countries’ law enforcement,” Denham said.

Critics have suggested Clark's staff may have used personal emails to avoid scrutiny from the public, in case a Freedom of Information request were filed. Denham said government business conducted over private email is still subject to FOI requests, though it can significantly hinder the process.

“It’s really difficult to search. It’s really difficult for a government agency to demand that employees turn over government documents that may have been communicated that way,” Denham said. “It’s very poor record-keeping policy.”

Related: Read the Multicultural Strategy Action plan here

Deputy Premier Rich Coleman insisted the use of private email for government business is not common.

“I use my government email for government business and I use my personal email for personal business, because I don’t think they should mix,” Coleman said Thursday.

The Privacy Commissioner released a report Monday urging the Clark government to write down major decisions and actions in order to provide a proper historical record. The report noted that 45 per cent of all Freedom of Information requests sent to Clark’s office in 2012 turned up no paper trail.

Denham said she will decide next week whether to launch a new investigation into whether the government has purposefully kept records minimal to deter public inquiry.

With files from CTV British Columbia’s Mi-Jung Lee and The Canadian Press