Skip to content

How do I ensure my use of video conferencing calls complies with GDPR?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

  1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
  2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
  3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
  4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
  5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
  6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

Related FAQs

VIDEO: Commercial law implications of the Corporate Insolvency and Governance Bill

Partners Damien Charlton and Jane Garvin look at the provisions of the Bill which impact on a supplier’s rights under a contract when their customer enters an insolvency procedure. They also outline other changes to insolvency procedures that the new law will introduce.

This webinar is part of a series designed for in-house lawyers.  If you would like to register to receive invitations to future events for in-house legal counsel, please email damien.charlton@wardhadaway.com.

Read more about this
I pay child maintenance and half of my children's private school fees to my ex-partner but I have been placed on Furlough, with no top-up from my employer, so my income has dropped significantly. Is there anything I can do?

a. You should first try and discuss this with your ex-partner, either directly or through a Solicitor, to see whether an amicable agreement can be reached.

If you contribute to private school fees voluntarily, it is a matter for you and your ex-partner to resolve the issue with the school, depending whose name is on the bills. You may need to speak to the children’s school to see whether they can offer any reductions or remedies in relation to those payments. If you contribute to the school fees as part of a Court Order, you will need to ensure you do not breach the Order and you may need to consider applying for a variation of the Order if you can no longer afford the payments or reach a compromise agreement with your ex-partner.

You can use the Child Maintenance Service (CMS) calculator (https://www.gov.uk/calculate-child-maintenance) to recalculate your child maintenance obligations using your amended income. This recalculation can then be used in your discussions and you can formally instruct the CMS to verify that calculation if you and your ex-partner cannot reach an agreement about it. If you have already formally involved the CMS, they do carry out an annual review of child maintenance payments, however, they will also recalculate payments outside of the review period where there has been a change in income of 25% or more. We expect the CMS will be experiencing a high volume of enquiries at the present time so anticipate there may be delays in them assisting.

The position on child maintenance payments included in a Court Order are slightly more complicated and how you approach this will depend on how much time has passed since the date of the Order.

Read more about this
I lease commercial premises. Can my landlord forfeit my lease?

As part of the Coronavirus Bill there is some good news for tenants in so far as it included the following:

  • All commercial tenants in England, Wales and Northern Ireland missing rent payments are to benefit from a government ban on forfeiture of their lease.
  • Landlords then will be prevented from terminating leases and “evicting” commercial tenants.
  • The above provisions rules will apply not only to principal rent, but to “any sum a tenant is required to pay”, leaving the burden of supplying services and insuring the premises on landlords. The bill will last until 30 June 2020, with an option for the government to extend this deadline.

Whist this is helpful to any Tenant planning not to pay rent or other payments due under their lease insofar as they will not suffer forfeiture and be evicted, it should be noted that the contractual obligation to continue paying rent and all other costs due under the lease remains and Landlords will still be able to take action to recover any payments due under the lease that are in arrears.

Read more about this
Is there anything I need to put in place for their return? What are my responsibilities?

The basics of health and safety law requires that employers take “all reasonably practicable steps” to ensure workers’ safety and that a suitable and sufficient assessment of risk is undertaken. It is the individual assessment of Covid-19 risk in each workplace that will be central. Employers will be required to conduct a robust risk assessment and then, following the hierarchy of controls, put robust processes and safeguards in place to address those risks.

UK government guidance and HSE advice is continually evolving, which in practice means that any risk assessment will need to be reviewed very regularly as that guidance develops. There is flexibility for individual businesses within the overall government framework and there will need to be a process of evaluation to ensure that the measures in place continue to meet the requirements.

The starting point of avoid, eliminate and control means looking at individuals continuing to work from home where possible (the fewer the number of people back in the workplace the lower the risk), and if not look at risk management, which leads to administrative controls – i.e. changing work practices before ending up at PPE. PPE is generally seen as control of last resort but in practice – facemasks, disposable gloves and constant prompts to wash hands for example.

In terms of changing working practices, employers should be thinking about:

  • the workspace and how this is laid layout
  • how do we make sure it is kept clean and hygienic
  • how do we keep people apart
  • how can we use toilets, canteens or other shared spaces/facilities safely
  • how do we promote and enable higher levels of workplace hygiene
  • if we are going to rely on PPE – can we get it, and is it suitable
  • what about limiting customer interactions
  • will there be enough first aiders on site
  • can we manage fire safety, deliveries etc
  • what about higher risk workers
  • should work tools and equipment be allocated on an individual basis to employees.

These decisions need to be recorded and clearly communicated to staff members.

Read more about this
VIDEO EXPLAINER: Removing healthcare workers from the front line – the dos and don'ts

Specialist healthcare lawyers from Ward Hadaway ran a free webinar looking at the practical and legal considerations if required to treat healthcare workers from a BAME background or other vulnerable groups differently in the fight against the Covid-19 pandemic.

Read more about this