How do I ensure my use of video conferencing calls complies with GDPR?
With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.
- Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
- If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
- Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
- You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
- Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
- Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.
The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.
On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.
On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.
Related FAQs
Has there ever been a more important time for all staff to feel that they are able to raise concerns about their working environment?
It is a pertinent time to remind all staff that they should be able to raise concerns without the fear of repercussions. It is a good time to be reviewing and re-issuing your Freedom to Speak up/Whistleblowing policy to all. Likewise it is a good time to remind all staff that they should not treat others unfairly or detrimentally for raising health and safety concerns.
Both subjecting someone to a detriment because they have blown the whistle or raised health and safety concerns (and dismissing someone for the same) is unlawful.
There have always been ways for public bodies to assist without being required to notify these for approval. These continue to be available during the financial crisis, and are likely to be increasingly useful for measures which need to be introduced quickly. The measures include:
Those where it is possible to conclude that there is no effect on trade between Member States – for example, measures which are likely to have only a limited local effect. The European Commission has concluded, for example, that measures to assist locally-focused cultural activity can be assumed to have no effect on inter-State trade.
Those where it is possible to conclude that the State is acting in a way consistent with a commercial operator (the so-called Market Economy Operator Principle) – particular care will need to be taken in the context of current economic conditions to ensure that it can reasonably be asserted that a commercial operator would act in the same way as the public body.
Measures under the General Block Exemption Regulation – this legislation allows various types of aid, or aid schemes, to be employed.
Examples include aid for SMEs, aid for research and development, aid for local infrastructure and aid to ports and airports.
De Minimis Measures – Member States are permitted to grant small amounts of aid to undertakings over three fiscal years (the current year and the previous two years). This allows undertakings to receive up to €200,000 (or €500,000 where they are providing public services).
Some commercial tenants have queried whether the current situation is a force majeure which may allow it to terminate the lease. Clauses which allow a party to terminate a lease for a force majeure event or, to put it another way, an “act of God”, are however extremely rare in modern commercial leases. Even if there is such a provision in your lease, it would need to be drafted to apply to an outbreak of disease.
On 4 May 2020, the Government launched the Bounce Back Loan Scheme (BBLS), which is intended to cut red tape to enable smaller businesses to access finance quickly during the coronavirus outbreak.
The scheme helps small and medium-sized businesses to borrow between £2,000 and up to 25% of their turnover. The maximum loan available is £50,000.
The government guarantees 100% of the loan and there are no any fees or interest to pay for the first 12 months. After 12 months the interest rate will be 2.5% a year.
The length of the loan is 6 years, but it can be repaid early without penalty. No repayments will be due during the first 12 months.
Under the scheme, lenders are not permitted to take any form of personal guarantee or take recovery action over a borrower’s personal assets (such as their main home or personal vehicle).
Businesses can apply for a BBLS loan if it:
- is based in the UK
- was established before 1 March 2020, and
- has been adversely impacted by the coronavirus.
Any business regarded as being a business in difficulty on 31 December 2019 will need to confirm that it is complying with additional state aid restrictions.
Businesses from any sector can apply, except the following:
- banks, insurers and reinsurers (but not insurance brokers)
- public-sector bodies, and
- state-funded primary and secondary schools.
Businesses already claiming under the following schemes cannot apply although it is possible to convert an existing loan under such schemes into BBLS:
- Coronavirus Business Interruption Loan Scheme (CBILS)
- Coronavirus Large Business Interruption Loan Scheme (CLBILS)
- COVID-19 Corporate Financing Facility.
There are 11 lenders participating in the scheme including many of the main retail banks, which are listed on the British Business Bank’s website (www.british-business-bank.co.uk/ourpartners/coronavirus-business-interruption-loan-schemes/bounce-back-loans/for-businesses-and-advisors/). Applicants are directed to approach a suitable lender via the lender’s website. If an applicant is declined by a lender, they can apply to other lenders in the scheme.
The lender will ask applicants to fill in a short online application form and self-declare that they are eligible. All lending decisions remain fully delegated to the accredited lenders.
An employer has a duty of care to its workforce and must take reasonable precautions to protect the health and safety of employees. Employers also have a duty of care towards anyone entering or using their place of business, such as visiting clients or customers.
This means that if an employer reasonably believes that wearing face masks at work is appropriate and necessary, it can issue an instruction to employees to this effect and employees should abide by this as far as possible.
However employers should be cautious about introducing and enforcing a policy across its business which requires its staff to wear face masks as there is the risk of unlawfully discriminating against people who are exempt from wearing face coverings or have legitimate reasons for not doing so. An employer should also consider the duty to make reasonable adjustments for disabled employees and discuss any concerns raised by employees who do not want to or feel unable to wear a mask.