How do I ensure my use of video conferencing calls complies with GDPR?
With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.
- Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
- If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
- Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
- You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
- Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
- Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.
The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.
On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.
On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.
Related FAQs
The Regulations do not require any prior agreement between an employer and employee that it was not reasonably practicable for holiday to be taken for it to be carried over.
However, if an employee requests holiday then an employer must have ‘good reason’ for refusing it due to coronavirus. The term ‘good reason’ is not defined so the Government will expect employers, employees and (if necessary on any dispute) the Courts to apply common sense.
The Regulations are not confined to key workers so could, in principle, be used by employers for a wider range of employees.
The Government guidance suggests that the following factors should be taken into account when considering whether it was reasonably practicable to take the leave in the relevant year:
- Whether the business has faced a significant increase in demand due to COVID-19 that would reasonably require the worker to continue to be at work and cannot be met through alternative practical measures.
- The extent to which the business’ workforce is disrupted by COVID-19 and the practical options available to the business to provide temporary cover of essential activities.
- The health of the worker and how soon they need to take a period of rest and relaxation.
- The length of time remaining in the worker’s leave year.
- The extent to which the worker taking leave would impact on wider society’s response to, and recovery from, the effects of COVID-19.
- The ability of the remainder of the available workforce to provide cover for the worker going on leave.
It remains the case that anyone who has symptoms, however mild, or is in a household where someone has symptoms, should not leave their house to go to work. Those people should self-isolate, as should those in their households.
Read more about thisTo qualify for a grant under the scheme you must pay your furloughed staff the wages you are claiming for. Failure to do so may result in a HMRC investigation and/or claims from furloughed staff for unlawful deductions from wages and possibly constructive dismissal claims.
Normal benefits including non-monetary benefits should continue during furlough unless the individual has agreed in writing to reduce or remove a benefit during this time.
Employers are expected to apply for one or more of the financial support schemes available to be able to continue to pay staff.
Read more about thisUnder their obligations arising from Regulation 36 of the Gas Safety (Installation and Use) Regulations 1998, landlords must service domestic gas appliances on an annual basis and provide tenants with a record of the service within 28 days of that service. Failure to comply can result in prosecution by the Health and Safety Executive (HSE) or downgrading by the Regulator.
We know how important this is. But how can you comply with your obligations during the Covid-19 epidemic?
The latest restrictions on leaving the home, currently allow registered gas engineers to undertake essential work, whilst taking the appropriate precautions advised to avoid spreading or contracting the virus in a new setting.
Read more about thisPartners Damien Charlton and Jane Garvin look at the provisions of the Bill which impact on a supplier’s rights under a contract when their customer enters an insolvency procedure. They also outline other changes to insolvency procedures that the new law will introduce.
This webinar is part of a series designed for in-house lawyers. If you would like to register to receive invitations to future events for in-house legal counsel, please email damien.charlton@wardhadaway.com.
Read more about this