Skip to content

How do I ensure my use of video conferencing calls complies with GDPR?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

  1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
  2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
  3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
  4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
  5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
  6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

Related FAQs

What is happening about court and arbitration hearings?

The courts are seeking to adapt to our new circumstances and have urgently been looking to introduce new ways of working. The courts have been testing out different ways of holding court hearings. The advice is changing almost daily and some courts have been developing local practices. Going forward the court, the parties and their representatives will need to be more proactive about all forthcoming hearings.

Everyone involved in the case is to consider as far ahead as possible how future hearings should best be undertaken and work collaboratively. It will normally be possible for all short, interlocutory, or non-witness, applications to be heard remotely. Some witness cases will also be suitable for remote hearings. The parties just need to ensure that everyone involved can use the technology suggested.

The courts have been looking at and held remote hearings using, non-exhaustively, BT conference call, Skype for Business, court video link, BT MeetMe, Zoom and ordinary telephone call. Bundles for the hearing will be prepared and circulated electronically.

If the hearing cannot be held remotely because the parties do not have the requisite technology or the length of the hearing combined with the number of parties or overseas parties, representatives and/or witnesses make it undesirable to go ahead with a hearing in court at the current time, then it may be that the case will need to be adjourned. We are hearing of trials being adjourned and that they will not be re-listed before at least September.

HMCTS has advised that several priority courts will remain open during the coronavirus pandemic to make sure the justice system continues to operate effectively. It publishes a daily operational update from the courts and they aim to update it by 9am. The link is https://www.gov.uk/guidance/hmcts-daily-operational-summary-on-courts-and-tribunals-during-coronavirus-covid-19-outbreak.

Also, the courts have circulated a civil listing priority list with Priority 1 listing work which must be done and which includes injunctions, any applications in cases listed for trial in the next three months, any applications where there is a substantial hearing listed in the next month and all Multi Track hearings where parties agree that it is urgent.

In the Priority 2 list, which consists of hearings which could be done, are enforcement of trading contracts, trial involving the survival of a business or the insolvency of an individual, small and fast track trials where the parties say they are urgent, and appeal in these kinds of cases.

Similarly, in arbitration proceedings, the parties and arbitrators are being encouraged to utilise technology to make sure that hearings take place. We have heard of Zoom being used very successfully for multi-party proceedings.

Are there any exceptions to the obligation to return deposits?

The CMA sees only limited circumstances in which a full refund would not be given. The CMA accepts that where public health measures prevent a business from providing a service or the consumer from receiving it, the business may be able to deduct a contribution to the costs it has already incurred in relation to the specific contract in question.

This view reflects a relatively complex area of law under which parties are released from obligations under a contract if performance of that contract becomes impossible or illegal. This is called “frustration” of the contract. Under a law passed during World War II, a party to a contract that is frustrated who has incurred expenses is permitted, if the court thinks fit, to retain an amount up to the value of those expenses out of any money they have been paid by the other party.

The CMA’s view, however, is that this will not happen often, and that deductions from deposits will be limited.

How do I access the Coronavirus Job Retention Scheme?

The scheme is being administered by HMRC under a new online portal that has been set up. It applies to businesses, charities, recruitment agencies, individuals who employ a nanny, administrators (where there is a reasonable likelihood of re-hiring the workers) and public authorities.

All employers with a UK payroll can apply as long as you have:

  • Created and started a PAYE payroll scheme on or before 28 February 2020
  • Enrolled for PAYE online (which can take up to 10 days)
  • A UK bank account.

To make a claim you will need:

  • The number of employees being furloughed
  • The start and end date of the claim
  • The name and National Insurance Numbers for each furloughed employee
  • Your employer PAYE reference number
  • To be registered for PAYE online
  • The Self-Assessment Unique Taxpayer Reference, Corporation Tax Unique Taxpayer Reference or Company Registration Number as appropriate for your entity
  • Your UK bank account details and sort code
  • Your name and contact number
  • Your organisation’s registered name
  • Your organisation’s billing address
  • The full amounts you are claiming for including:
    • Employee wages
    • Employer national insurance contributions
    • Employer minimum pension contributions

For claims for those who are flexibly furloughed you will also need:

  • the number of usual hours the employee would work during the claim period
  • the hours the employee has worked or will work during this period
  • you will also need to keep a record of the number of furloughed hours that the employee has or will be furloughed for.

You will need the above information ready before you access the system to make a claim. You will also need to have calculated the amounts claimed in advance as the application needs to be completed in one session. You can currently save one draft of the application and it must be completed within 7 days of starting it.

The Government has issued a step-by-step guide for employers who wish to make a claim under the scheme which can be found using the link below. It contains useful information about calculating the payments claimed. You will need to register for a Government Gateway ID and password if you do not yet have one in order to access the portal.

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/880099/Coronavirus_Job_Retention_Scheme_step_by_step_guide_for_employers.pdf

If you use an agent who is authorised to act for you for PAYE purposes, they will be able to make a claim on your behalf. If you use a file only agent (who files your RTI return but doesn’t act for you on any other matters) they won’t be authorised to make a claim for you and you will need to make the claim yourself. A file only agent can assist you in obtaining the information required to make a claim (listed above). If an agent makes a claim on your behalf you will need to tell them which bank account you would like the grant to be paid into.

For claims for fewer than 100 employees you will need to input the details separately for each employee. If claiming for more than 100 employees you can upload a file with the information instead. The file should include the following information for each furloughed employee: name, National Insurance number, claim period and claim amount, payroll/employee number (optional). You will also need to include details of hours normally worked, actual hours worked and hours furloughed for those who are flexibly furloughed.

The need to demonstrate the impact of coronavirus on your business is not one of the criteria listed above about who can make a claim, so the government does not appear to intend to set a specific test to determine if a business is “severely impacted by coronavirus”. You are not required to explain the impact of Coronavirus on your business when submitting your claim.

HMRC will retain the right to audit any claim retrospectively. You must keep records for 6 years including:

  • the amount claimed and claim period for each employee
  • the claim reference number
  • you calculations for each claim
  • details of hours usually worked and hours actually worked for flexibly furloughed employees.

You must tell your employees that you have made a claim under the scheme, and you must continue to pay their wages during this time.

How do I determine contractor status?

You must exercise reasonable care in assessing status and making a status determination, considering what the position would be if the contractor was engaged directly by the end user client instead of via a PSC.

Status is usually determined by looking a number of factors and how they apply to the contractor’s working arrangements. This is a difficult exercise that is usually carried out by employment and tax lawyers and it is full of grey areas. We have a toolkit that can help you navigate this process which Paul will tell you more about at the end of the session.

The key factors used to determine status  are:

  • Control:
    • How much control does the end user client have over the contractor in terms of working arrangements (hours, place of work) and how the work is carried out? Or is the individual contractor able to determine how and when they work and without direct supervision of the end user client?
  • Personal service:
    • Is the contractor required to perform the services personally without the right to send a substitute? If there is a right to appoint a substitute is this subject to end user client approval?
  • Mutuality of obligation:
    • Is the end user client obliged to provide the contractor work with a mutual obligation on the contractor to accept that work?
Can I apply a Force Majeure clause?

If a contract contains a force majeure clause this may become operative due to the coronavirus pandemic and related emergency legislation. Such clauses exist to ensure that if some unforeseen event prevents a party from being able to perform their obligations under a contract, either on time or at all, they will be excused from their obligations and not be held liable for non-performance.

The clause must actually be written into the contract to have effect – a force majeure clause cannot be implied into a contract. Whether it can be relied on by a party will depend on the wording of the clause itself as it may only be applicable in certain limited circumstances.

You should seek legal advice at an early stage if you think that force majeure is relevant, because a number of potentially complex issues must be addressed, many of which will turn upon the exact wording of the force majeure clause in the contract in question:

  • Has a force majeure event actually arisen?
  • What notification process do you have to follow to rely on the provision?
  • What mitigation steps do you have to take?
  • What is the effect of the force majeure event – is the contract suspended, or can it be terminated (which might not be what you want)?