How do I ensure my use of video conferencing calls complies with GDPR?
With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.
- Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
- If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
- Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
- You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
- Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
- Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.
The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.
On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.
On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.
Related FAQs
Partner at Ward Hadaway Adrian Ballam talks to corporate finance expert and CBILS specialist Chris Silverwood (CorpFin and cashflow.co.uk) to explore the practical ins, outs, dos and don’ts of CBILS applications, answering the questions:
- How are banks making their assessments of whether a business can afford a CBILS loan when for many they cannot accurately forecast their revenues for at least the next three months?
- What are the red flags that banks are looking for when assessing whether or not to grant a request for a CBILS loan?
- What cost mitigation measures should a business have already implemented prior to applying for a CBILS loan?
- What level of information should a business provide to support a CBILS application?
- What common mistakes are businesses making when applying for funding?
- What general tips do you have for businesses seeking CBILS funding?
Click read more to view the video.
The NHS Test and Trace service is operated by the NHS in England to track and help prevent the spread of COVID-19. Where an individual displays symptoms of coronavirus they can be tested to determine whether or not they have the disease. Those with the disease will then be contacted by NHS contact tracers and asked who they have come into close contract with.
Close contact is defined as:
- Face to face (within 1 metre)
- Spent more than 15 minutes within 2 metres of another person
- Travelled in a car or on a plane with another person
The contact tracer will then contact those people with whom the individual has come into close contact and tell them to self-isolate for 14 days.
a. You should first try and discuss this with your ex-partner, either directly or through a Solicitor, to see whether an amicable agreement can be reached.
If you contribute to private school fees voluntarily, it is a matter for you and your ex-partner to resolve the issue with the school, depending whose name is on the bills. You may need to speak to the children’s school to see whether they can offer any reductions or remedies in relation to those payments. If you contribute to the school fees as part of a Court Order, you will need to ensure you do not breach the Order and you may need to consider applying for a variation of the Order if you can no longer afford the payments or reach a compromise agreement with your ex-partner.
You can use the Child Maintenance Service (CMS) calculator (https://www.gov.uk/calculate-child-maintenance) to recalculate your child maintenance obligations using your amended income. This recalculation can then be used in your discussions and you can formally instruct the CMS to verify that calculation if you and your ex-partner cannot reach an agreement about it. If you have already formally involved the CMS, they do carry out an annual review of child maintenance payments, however, they will also recalculate payments outside of the review period where there has been a change in income of 25% or more. We expect the CMS will be experiencing a high volume of enquiries at the present time so anticipate there may be delays in them assisting.
The position on child maintenance payments included in a Court Order are slightly more complicated and how you approach this will depend on how much time has passed since the date of the Order.
An employee can refuse to attend work but their refusal to do so will have to be based on a reasonable belief that their health and safety is in danger. Whether or not their refusal is reasonable will take into consideration factors such as the employee’s own health and whether they are at a higher risk of becoming seriously ill if they contract Covid-19 and the steps their employer has out in place to mitigate the danger of contracting Covid-19 at work.
In such circumstances where the employee’s belief is deemed to be reasonable, they will be entitled to stay at home and receive full pay.
If an employee is subsequently dismissed for refusing to attend work in these circumstances, they may be able to bring a claim for unfair dismissal.
If the business has areas requiring an increased workforce whilst others require a reduced workforce, staff can be retrained and redeployed across the organisation or even across a wider group of companies. This will not reduce the wage bill but will avoid the need for redundancies. Making fundamental changes to an employee’s role and duties will require their agreement following a fair selection and consultation process.