What type of agreements are we talking about?
To respond to the crisis businesses might need to exchange information to a greater extent than they would usually. They might need to discuss capacity and to coordinate supply chains (both upstream and downstream). They might need to purchase or sell jointly to ensure vital supplies are maintained. In general agreements or collaboration which:
- Avoid a shortage, or ensure security, of supply
- Ensure a fair distribution of scarce products
- Continue essential services
- Provide new services such as food delivery to vulnerable consumers
Related FAQs
The Information Commissioner’s Office (ICO) announce new guidance in light of coronavirus.
The ICO is providing new guidance to organisations regarding data protection and coronavirus, which can be accessed here: https://ico.org.uk/for-organisations/data-protection-and-coronavirus/
The ICO has stated the following:
“Data protection is not a barrier to increased and different types of homeworking. During the pandemic, staff may work from home more frequently than usual and they can use their own device or communications equipment. Data protection law doesn’t prevent that, but you’ll need to consider the same kinds of security measures for homeworking that you’d use in normal circumstances.”
Whether you work from home or in the office, you still need to comply with data protection laws. While you need to process personal data with the same care you use in the office, the home working environment throws up specific data protection concerns particularly in respect of data security. You should make sure you have a home working policy which deals with data protection and these data security issues.
Organisations must ensure that, for staff who can work from home, their obligations in respect of processing personal data are clearly communicated. Organisations may already have a home working policy – if this is the case, then this should be reviewed to ensure it remains relevant and up-to-date for practices during this pandemic.
As we all adjust and adapt in line with the Government’s guidance throughout this uncertain time, we must consider how we can revise current processes and implement new ones to maintain effective and compliant ways of working. We have identified several key issues that all housing providers should consider.
Protocol Compliance
Housing providers will continue to receive new disrepair claims. Throughout the disruption caused by coronavirus, landlords will still be expected to respond to these claims and comply with the Pre-Action Protocol for Housing Conditions Claims whilst doing so. We address the issue of disclosure in particular below.
Letters of claim will continue to be sent by post to your Registered Office, and the deadlines will run from the date of deemed service. Ensure you have systems to enable you to scan correspondence and forward it to the responsible officer who will handle the claim so deadlines are met.
Under the Protocol, the deadline for disclosure is 20 working days from deemed service of a letter of claim (2 working days after it is sent). So, for example, a letter dated 2 March 2020 would be deemed served on 4 March 2020 and disclosure would therefore be due by 1 April 2020. All housing providers must continue to comply with the Protocol and so landlords should begin preparing now.
Failure to meet deadlines often result in the issuing of further applications to court by tenant’s solicitors which in turn will lead to unnecessary costs orders against landlords.
Therefore, all records, particularly relating to customer contact and repair logs, should be held electronically. If required, this will allow for such documentation to be redacted for GDPR purposes remotely and disclosed to the tenant’s solicitor simply and efficiently.
Remember it is possible to request an extension to all Protocol deadlines and it is inevitable in these unusual times, this will need to be utilised, and should not be refused. Request extensions to deadlines at the earliest opportunity to enable an achievable timescale. It would be a difficult lawyer that would not agree to such a request.
With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.
- Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
- If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
- Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
- You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
- Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
- Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.
The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.
On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.
On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.
HM Treasury have no current plans to pause the collection of apprenticeship levy payments from employers, therefore levy-paying employers must continue to make payments. There is also no plan to extend the 24 month period allowed to spend levy funds.
You will need to keep a copy of the written agreement for a period of 5 years. If the hours of work change from that which you initially agree, you are likely to need something new in writing to cover each separate arrangement.
You should also keep records of how many hours your employees work and how many hours they are furloughed (i.e. not working). You must keep these records for 6 years, together with a record of the amount claimed, your claim reference number and your calculations.