What can I do to make sure my home-working people are doing so safely?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

If your 30-day visa to travel to the UK (vignette) has expired or is about to, you can request a replacement free of charge until the end of 2020 by contacting the Coronavirus Immigration Help Centre. This can be granted with new and extended validity dates to allow travel once you are able to.

As the pandemic progresses, more and more people will be forced to self-isolate and, inevitably, both tenants and staff will be affected. Put plans in place to mitigate the impact that this may have, particularly regarding staff shortages. The most important focus here should be communication.

The Covid-19 outbreak will affect the pace of everyday life and delays will be expected. Rather than allowing the pandemic to take over completely, it is important to maintain open communication with tenants as much as possible and inform them of any front-facing challenges that you may face.

The Protocol does envisage that delays may occur and allows for some degree of flexibility. Whilst all efforts should be made to conduct inspections where practical and possible, it should be expected by all parties that timescales will be extended during this crisis. It is fundamental, however, that all changes made to standard practice are communicated and explained to tenants to manage expectations.

Similar flexibility should be afforded to tenants. As households are required to isolate it will not always be possible to gain access to properties as would usually be expected and required. Likewise, vulnerable people will wish to protect themselves and their families and may refuse access on this basis. During this period, a degree of understanding must be exercised and concessions made.

Inspections may be delayed if anyone in the household has  symptoms. A questionnaire should be prepared for those visiting properties to assess so far as possible the risk; Personal Protective Equipment should be issued to those visiting, and government guidelines followed.

In some circumstances, visitors and customers are required to wear face coverings, such as those travelling on public transport, shoppers and museum visitors. The government guidance states that:

• businesses must remind people to wear face coverings where mandated; and
• premises where face coverings are required should take reasonable steps to promote compliance with the law.

As part of their duty of care to employees and to uphold a relationship of mutual trust and confidence, employers should consider how employees can ensure that visitors and customers comply with the rules and provide their staff with guidance. They must also seek ways to protect their employees both from the risks of those customers not wearing face masks and potential abuse from customers or visitors who decline to wear a face covering. This may include having signs in place requiring customers and visitors to wear a mask and allowing staff to refuse to serve customers if they do not follow the rules.

However, it is ultimately the responsibility of the police, security and public transport officials to remove customers from premises where they are not complying with the rules on face coverings.

The police and Transport for London have been given greater powers by the government to take measures if the public do not comply with the law relating to face coverings without a valid exemption, such as refusing to wear a face covering. This includes issuing fines which have now been increased to £200 for the first offence (and £100 if paid within 14 days). Transport operators can also deny access to their public transport services if a passenger is not wearing a face covering, or direct them to wear one or leave a service.

The Cabinet Office has published a helpful Procurement Policy Note (“PPN”) on relief available to suppliers due to Covid-19 (available here). This can include making advance payments to suppliers, if necessary. The PPN sets out actions that public sector bodies should take (until at least 30 June 2020) to ensure continuity of service and to ensure that its suppliers can resume normal contract activity once able to.

The actions public sector bodies should be taking include:

• Informing its suppliers (that they believe are at risk) that they will continue to be paid as normal until the end of June 2020 (even if service delivery is currently interrupted). Risk might include supply chains collapsing and/or significant financial implications for a supplier
• If a contract involves a payment by results mechanism, basing payments on previous months (e.g. the average monthly payment over the previous 3 months), and
• Ensuring that invoices submitted by suppliers are paid immediately to maintain cash flow in the supply chain and help to protect jobs.

If you are a supplier to a public sector body, you must act transparently and on an open-book basis, making cost data available to your public sector clients. You must also continue to pay your employees and subcontractors / suppliers. Suppliers to the public sector must not expect to make profits on any undelivered elements of a contract. The PPN makes clear that, should suppliers be found to be taking undue advantage, or failing to act transparently, a public sector body can take action to recover payments made to that supplier.

The PPN requires public sector bodies to urgently review their contract portfolios and take steps to support suppliers who they believe are “at risk”. However, no definition of “at risk” is given in the document.  We would suggest that if you are a supplier and you have yet to hear from a public sector client, you should seek to get in touch with them as soon as possible, particularly if you have concerns about your supply chain, staff retention and/or are experiencing financial difficulties currently. Given the requirement for transparency, you may be required to provide evidence, so it may be helpful to have any relevant documentation ready to send, if necessary, as this may help ensure a decision is made by the public sector client more promptly, particularly as the public sector body may have a number of contracts to consider.