How can workers get to work safely?

We hope that all organisations will come out of lockdown successfully. However, the current economic crisis means that many organisations will face very difficult trading conditions.

Employment costs are one of, if not the, largest cost to your organisation. These costs will have an effect on your financial well-being – and many organisations are now considering how to reduce employment costs. That said, your workforce is also your most important asset and as we get back to business, you will need your workforce to run the organisation, produce your goods, deliver your services and deal with your customers.

As a result, many organisations are facing a very difficult situation – how to reduce or flex the cost of the workforce whilst also maintaining an ability to service customers. This difficulty is enhanced by the uncertainty of when the pandemic will be controlled and the threat of lockdowns end.

Where a couple is not married, they have limited rights in relation to each other’s assets and these mainly relate to rights over property assets. There is complex Trust law which governs whether or not your partner could claim an interest in your property and it generally relates to where someone has invested in renovations on the property or promises have been made. If this is something you are concerned about, you and your partner could enter in to a Cohabitation Agreement. These Agreements can set out various matters, including who will pay the bills and where each of you would live if you separated. Most importantly, they can record your intentions about who owns the property and exclude any rights your partner would have against your property.

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

As the pandemic progresses, more and more people will be forced to self-isolate and, inevitably, both tenants and staff will be affected. Put plans in place to mitigate the impact that this may have, particularly regarding staff shortages. The most important focus here should be communication.

The Covid-19 outbreak will affect the pace of everyday life and delays will be expected. Rather than allowing the pandemic to take over completely, it is important to maintain open communication with tenants as much as possible and inform them of any front-facing challenges that you may face.

The Protocol does envisage that delays may occur and allows for some degree of flexibility. Whilst all efforts should be made to conduct inspections where practical and possible, it should be expected by all parties that timescales will be extended during this crisis. It is fundamental, however, that all changes made to standard practice are communicated and explained to tenants to manage expectations.

Similar flexibility should be afforded to tenants. As households are required to isolate it will not always be possible to gain access to properties as would usually be expected and required. Likewise, vulnerable people will wish to protect themselves and their families and may refuse access on this basis. During this period, a degree of understanding must be exercised and concessions made.

Inspections may be delayed if anyone in the household has  symptoms. A questionnaire should be prepared for those visiting properties to assess so far as possible the risk; Personal Protective Equipment should be issued to those visiting, and government guidelines followed.

The basics of health and safety law requires that employers take “all reasonably practicable steps” to ensure workers’ safety and that a suitable and sufficient assessment of risk is undertaken. It is the individual assessment of Covid-19 risk in each workplace that will be central. Employers will be required to conduct a robust risk assessment and then, following the hierarchy of controls, put robust processes and safeguards in place to address those risks.

UK government guidance and HSE advice is continually evolving, which in practice means that any risk assessment will need to be reviewed very regularly as that guidance develops. There is flexibility for individual businesses within the overall government framework and there will need to be a process of evaluation to ensure that the measures in place continue to meet the requirements.

The starting point of avoid, eliminate and control means looking at individuals continuing to work from home where possible (the fewer the number of people back in the workplace the lower the risk), and if not look at risk management, which leads to administrative controls – i.e. changing work practices before ending up at PPE. PPE is generally seen as control of last resort but in practice – facemasks, disposable gloves and constant prompts to wash hands for example.

In terms of changing working practices, employers should be thinking about:

• the workspace and how this is laid layout
• how do we make sure it is kept clean and hygienic
• how do we keep people apart
• how can we use toilets, canteens or other shared spaces/facilities safely
• how do we promote and enable higher levels of workplace hygiene
• if we are going to rely on PPE – can we get it, and is it suitable
• what about limiting customer interactions
• will there be enough first aiders on site
• can we manage fire safety, deliveries etc
• what about higher risk workers
• should work tools and equipment be allocated on an individual basis to employees.

These decisions need to be recorded and clearly communicated to staff members.