As explained in our recent blog post, though patently subordinate to more pressing concerns, the COVID-19 outbreak has various privacy and data protection ramifications. Certain of these are being demonstrated in a very tangible way via the adoption of home working practices at an unprecedented scale and speed for many organisations.
We are all navigating unchartered waters as business and society faces up to the impact of COVID-19. We very much hope you and your loved ones remain in good health.
Please be assured that Fieldfisher is continuing to work with clients to navigate COVID-19 related issues and on business as usual needs. Do get in touch with us if you would like to chat anything through.
Against this backdrop, this post's purpose is narrow – to recap briefly on four practical privacy and employment compliance topics concerning staff working from home.
1. Security – this topic prompts the lion's share of privacy / operational risk and so will likely merit most attention from organisations. Issues to consider include the following: (i) permitting staff to use personal devices for work purposes and thus the need for Virtual Private Networks ("VPN") and back-up processes / networks; (ii) ensuring that devices are patched and up-to-date with virus protections – particularly given the apparent rise in phishing communications following the outbreak; (iii) avoiding the access of sensitive information (from a commercial or data protection perspective) on personal devices, including through the deployment of sandboxing / compartmentalisation tools; (iv) not using public WiFi networks, which may be accessible from home; (v) disposing of confidential information in a secure manner (e.g. shred or store in an appropriate location until you can dispose safely); (vi) securely transporting information and devices from and to the office (e.g. locked rucksack); (vii) avoiding confidential work calls in a shared space (e.g. video conferences in the proximity of flatmates / friends); and (viii) avoiding printing documents where possible and ensuring loose papers are tidied away.
2. Policies – Acceptable Use, Bring Your Own Device and Remote Working Policies will likely need to be updated to reflect these unique circumstances. For instance, will you allow staff to use ordinarily prohibited third party messaging tools / features for emergency communications or if e-mail goes down? If so, will you allow staff to "opt-in" or "opt-out" of the use of such tools? Will you explain the bolstered security measures which have been put in place (e.g. two factor authentication) and why they're proportionate? Will you deploy the same monitoring tools (e.g. for information security and to detect serious misconduct) as those used on workplace-based corporate devices and systems? These policies should enshrine the steps taken above in relation to security. Amendments to other staff policies will also be necessary (e.g. those relating to the use of dependents' contact information and the return of confidential information and company property on termination).
3. Awareness-raising – at the risk of stating the obvious, policies must be communicated to staff. Key changes to the documents should be flagged in bite-sized form where possible and you'll also want to ensure that staff review, acknowledge and agree to the updated policies (e.g. via click and accept buttons). Allied to policies should be some awareness-raising via intranet / e-mail communications / team meetings about the main privacy risks of home working. Potentially premature at the moment but if widespread home working continues then training on the updated policies should be provided (though you might want to expedite training for individuals handling high volume and highly sensitive information). Enforced home working represents a significant change to the lifestyles and routines of staff which will prompt questions and the need for reassurance from their employers (e.g. in order to work, am I allowed to transfer documents from my work laptop to my personal device? Will my employer be monitoring my productivity levels whilst home working?) Organisations should try to pre-empt these concerns via some private or staff-facing FAQs.
4. Taking care of employees' health and safety – when it comes to remote working, complying with obligations to take reasonable care of employees' health and safety can be a challenge even in normal circumstances. The urgency with which these measures have had to be put in place in response to COVID-19 (in many cases for the first time) magnifies this. We would expect the Health & Safety Executive, and most employees, to give employers the benefit of the doubt when it comes to enforcement or claims, but it will still be important to answer the following questions: how will you keep in touch with, and provide appropriate supervision to, homeworkers? Can they safely carry out the work they are expected to do from home? Are extra control measures necessary to protect employees? Do employees have appropriate equipment (e.g. a keyboard, mouse, ergonomic chairs, monitors and video conferencing facilities)? It would be relatively straightforward for employers to issue sensible workstation checklists / assessments and ask employees to return them, in order to identify any obvious gaps. As above, it may become important to provide specific training as home working continues.
Of course, extended periods of isolation and social distancing are likely to take their toll on the mental wellbeing of employees. Employers should remain vigilant and adopt an approach, which helps their employees to feel involved and valued. Beyond that, employers still have the same anti-discrimination obligations, including the requirement to put in place reasonable adjustments for anyone suffering from a mental (or physical) condition amounting to a disability.
Finally, employers may have to deal with the additional complexity of supporting employees who are combining working from home with caring responsibilities (e.g. for children and elderly relatives). Given closures of schools, nurseries and caring facilities, countless employees will be forced to work and care, and the best employers will play an active role in helping their people find the right balance.
On Wednesday 25 March, Fieldfisher is hosting a webinar entitled "COVID-19: What are the employment and data protection law concerns?" For further information and to register your attendance, please click here.
We are all navigating unchartered waters as business and society faces up to the impact of COVID-19. We very much hope you and your loved ones remain in good health.
Please be assured that Fieldfisher is continuing to work with clients to navigate COVID-19 related issues and on business as usual needs. Do get in touch with us if you would like to chat anything through.
Against this backdrop, this post's purpose is narrow – to recap briefly on four practical privacy and employment compliance topics concerning staff working from home.
1. Security – this topic prompts the lion's share of privacy / operational risk and so will likely merit most attention from organisations. Issues to consider include the following: (i) permitting staff to use personal devices for work purposes and thus the need for Virtual Private Networks ("VPN") and back-up processes / networks; (ii) ensuring that devices are patched and up-to-date with virus protections – particularly given the apparent rise in phishing communications following the outbreak; (iii) avoiding the access of sensitive information (from a commercial or data protection perspective) on personal devices, including through the deployment of sandboxing / compartmentalisation tools; (iv) not using public WiFi networks, which may be accessible from home; (v) disposing of confidential information in a secure manner (e.g. shred or store in an appropriate location until you can dispose safely); (vi) securely transporting information and devices from and to the office (e.g. locked rucksack); (vii) avoiding confidential work calls in a shared space (e.g. video conferences in the proximity of flatmates / friends); and (viii) avoiding printing documents where possible and ensuring loose papers are tidied away.
2. Policies – Acceptable Use, Bring Your Own Device and Remote Working Policies will likely need to be updated to reflect these unique circumstances. For instance, will you allow staff to use ordinarily prohibited third party messaging tools / features for emergency communications or if e-mail goes down? If so, will you allow staff to "opt-in" or "opt-out" of the use of such tools? Will you explain the bolstered security measures which have been put in place (e.g. two factor authentication) and why they're proportionate? Will you deploy the same monitoring tools (e.g. for information security and to detect serious misconduct) as those used on workplace-based corporate devices and systems? These policies should enshrine the steps taken above in relation to security. Amendments to other staff policies will also be necessary (e.g. those relating to the use of dependents' contact information and the return of confidential information and company property on termination).
3. Awareness-raising – at the risk of stating the obvious, policies must be communicated to staff. Key changes to the documents should be flagged in bite-sized form where possible and you'll also want to ensure that staff review, acknowledge and agree to the updated policies (e.g. via click and accept buttons). Allied to policies should be some awareness-raising via intranet / e-mail communications / team meetings about the main privacy risks of home working. Potentially premature at the moment but if widespread home working continues then training on the updated policies should be provided (though you might want to expedite training for individuals handling high volume and highly sensitive information). Enforced home working represents a significant change to the lifestyles and routines of staff which will prompt questions and the need for reassurance from their employers (e.g. in order to work, am I allowed to transfer documents from my work laptop to my personal device? Will my employer be monitoring my productivity levels whilst home working?) Organisations should try to pre-empt these concerns via some private or staff-facing FAQs.
4. Taking care of employees' health and safety – when it comes to remote working, complying with obligations to take reasonable care of employees' health and safety can be a challenge even in normal circumstances. The urgency with which these measures have had to be put in place in response to COVID-19 (in many cases for the first time) magnifies this. We would expect the Health & Safety Executive, and most employees, to give employers the benefit of the doubt when it comes to enforcement or claims, but it will still be important to answer the following questions: how will you keep in touch with, and provide appropriate supervision to, homeworkers? Can they safely carry out the work they are expected to do from home? Are extra control measures necessary to protect employees? Do employees have appropriate equipment (e.g. a keyboard, mouse, ergonomic chairs, monitors and video conferencing facilities)? It would be relatively straightforward for employers to issue sensible workstation checklists / assessments and ask employees to return them, in order to identify any obvious gaps. As above, it may become important to provide specific training as home working continues.
Of course, extended periods of isolation and social distancing are likely to take their toll on the mental wellbeing of employees. Employers should remain vigilant and adopt an approach, which helps their employees to feel involved and valued. Beyond that, employers still have the same anti-discrimination obligations, including the requirement to put in place reasonable adjustments for anyone suffering from a mental (or physical) condition amounting to a disability.
Finally, employers may have to deal with the additional complexity of supporting employees who are combining working from home with caring responsibilities (e.g. for children and elderly relatives). Given closures of schools, nurseries and caring facilities, countless employees will be forced to work and care, and the best employers will play an active role in helping their people find the right balance.
On Wednesday 25 March, Fieldfisher is hosting a webinar entitled "COVID-19: What are the employment and data protection law concerns?" For further information and to register your attendance, please click here.