VIDEO: SRA Standards and Regulations

On 4 May 2020, the Government launched the Bounce Back Loan Scheme (BBLS), which is intended to cut red tape to enable smaller businesses to access finance quickly during the coronavirus outbreak.

The scheme helps small and medium-sized businesses to borrow between £2,000 and up to 25% of their turnover. The maximum loan available is £50,000.

The government guarantees 100% of the loan and there are no any fees or interest to pay for the first 12 months. After 12 months the interest rate will be 2.5% a year.

The length of the loan is 6 years, but it can be repaid early without penalty. No repayments will be due during the first 12 months.

Under the scheme, lenders are not permitted to take any form of personal guarantee or take recovery action over a borrower’s personal assets (such as their main home or personal vehicle).

Businesses can apply for a BBLS loan if it:

• is based in the UK
• was established before 1 March 2020, and
• has been adversely impacted by the coronavirus.

Any business regarded as being a business in difficulty on 31 December 2019 will need to confirm that it is complying with additional state aid restrictions.

Businesses from any sector can apply, except the following:

• banks, insurers and reinsurers (but not insurance brokers)
• public-sector bodies, and
• state-funded primary and secondary schools.

Businesses already claiming under the following schemes cannot apply although it is possible to convert an existing loan under such schemes into BBLS:

• Coronavirus Business Interruption Loan Scheme (CBILS)
• Coronavirus Large Business Interruption Loan Scheme (CLBILS)
• COVID-19 Corporate Financing Facility.

There are 11 lenders participating in the scheme including many of the main retail banks, which are listed on the British Business Bank’s website (www.british-business-bank.co.uk/ourpartners/coronavirus-business-interruption-loan-schemes/bounce-back-loans/for-businesses-and-advisors/). Applicants are directed to approach a suitable lender via the lender’s website. If an applicant is declined by a lender, they can apply to other lenders in the scheme.

The lender will ask applicants to fill in a short online application form and self-declare that they are eligible. All lending decisions remain fully delegated to the accredited lenders.

Parties still need to comply with the various Protocols that apply and will be expected to exchange information in the usual way. Court proceedings can be issued electronically.

• Employee pensions contributions are often paid by way of salary sacrifice arrangements.
• Use of such arrangements may reduce the amount of wage an employer can claim under the Coronavirus Job Retention Scheme, as the reimbursement is calculated by reference to an employee’s actual pay as at 28 February 2020, hence post sacrifice pay.
• Using the Coronavirus Job Retention Scheme does not in itself bring a salary sacrifice arrangement to an end, but where an employer wishes to maximise the amount of an employee’s pay that will be covered by the CJRS, the employer and employee(s) concerned may agree to terminate the salary sacrifice arrangement as part of furlough. HMRC has recently announced that the Covid-19 pandemic will be considered a “life event” (i.e. one of the permitted reasons to break a salary sacrifice arrangement mid-term), if the employment contract is updated accordingly.

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

There has been a significant amount of press coverage talking about institutional racism within the NHS not only in terms of the treatment of patients but also in terms of the low representation of ethnic minority staff in management positions. Whilst tackling that issue is beyond the brief here, it is important to recognise that sub conscious bias can, regrettably, play a part in decision making processes. An Employment Tribunal will explore a alleged discriminator’s conscious and sub conscious decision making and working in an environment which has not set out sufficient controls to avoid such sub conscious stereotyping places someone at a greater risk of being discriminated against.

In the context of the issues we are addressing here, i.e. risk assessments around BAME staff, as we have stated above, it is essential that BAME staff are represented at all levels in the discussion. Trusts need to be mindful that BAME are underrepresented in management positions.

BAME staff need to be included in the dialogue and need to have a safe place where they can challenge decisions that are being made in relation to them. There needs to be accountability in the processes applied. Meaningful conversations need to happen and concerns should not be dismissed.