How do I ensure my use of video conferencing calls complies with GDPR?
With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.
- Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
- If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
- Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
- You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
- Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
- Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.
The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.
On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.
On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.
Related FAQs
Whilst it is acknowledged that doctors may be working in unfamiliar circumstances or surroundings, or in clinical areas outside their usual practice. Doctors should consider the best course of action to take in these circumstances by utilising the following:
- What is within their knowledge and skills
- What support other members of the healthcare team could offer
- What will be best for the individual patient given available options
- The protection and needs of all patients they have a responsibility towards
- Minimising the risk of transmission and protecting their health.
The Act was obviously subject to much debate and criticism as the Bill passed through Parliament. It is difficult to properly assess any gaps until after the necessary secondary legislation has been published and comes into force (along with the remainder of the Act), but some of the likely issues include:
- The impact on the insurance market, and the (lack of) availability and increased cost of insurance in light of the provisions of the Act
- How the introduction of retrospective claims will affect the market, both in relation to how parties might go about trying to prove matters which are 30 years old, but also the lack of certainty for those potentially on the receiving end of these claims which they previously had by virtue of the Limitation Act provisions
- Whether the definition of higher risk buildings is correct, or will require some refinement.
The Martlet v Mulalley case provides some useful observations and clarifications, for example that designers cannot necessarily rely on a ‘lemming’ defence that they were simply doing what others were doing at the time, that ‘waking watch’ costs are generally recoverable, and commentary on certain specific Building Regulations. The judgment however made clear that much of the case turned on its specific facts, so it is useful from the perspective of providing some insight as to how the Courts will deal with cladding disputes in future, rather than setting significant precedents to be followed.
A break or pause in learning can be initiated where the interruption to learning due to Covid-19 is greater than four weeks. This must be reported as a formal break in learning. In such circumstance the funding to the training provider will be suspended for the duration of the break. Previously, the rules only allowed an apprentice to initiate this break in learning but this has been expanded to give employers and training providers the right to initiate this. Training providers should continue with their monthly IRL submissions to the ESFA. During breaks in apprenticeships it is not necessary for the apprentice to comply with the minimum of 20% on the job training requirement but this will resume when the break ends.
Given the impact the Coronavirus is going to have upon the commercial property market, landlords will undoubtedly, as a matter of good commercial sense, will have to seriously entertain approaches from tenants seeking a rent suspension – notwithstanding there is no entitlement to the same under their lease.
Some landlords may decide it is better to waive or suspend rental payments over the short term rather than face their tenants going out of business and leaving them with an empty building in a flat or dead market.
A measure falling short of a rent suspension would be for the tenants to negotiate with their landlord’s monthly payments of rent rather than quarterly and for those monthly payments to be in payments arrears, rather than in advance.
The guidance has confirmed that all remaining employment rights and terms continue while an employee is furloughed. Holiday will continue to accrue during furlough however you may reach agreement with employees on reducing entitlement provided that it does not fall below the statutory minimum of 5.6 weeks per year.