Should my apprentice continue their training during the coronavirus outbreak, even if they’re furloughed?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

The Cabinet Office has published a helpful Procurement Policy Note (“PPN”) on relief available to suppliers due to Covid-19 (available here). This can include making advance payments to suppliers, if necessary. The PPN sets out actions that public sector bodies should take (until at least 30 June 2020) to ensure continuity of service and to ensure that its suppliers can resume normal contract activity once able to.

The actions public sector bodies should be taking include:

• Informing its suppliers (that they believe are at risk) that they will continue to be paid as normal until the end of June 2020 (even if service delivery is currently interrupted). Risk might include supply chains collapsing and/or significant financial implications for a supplier
• If a contract involves a payment by results mechanism, basing payments on previous months (e.g. the average monthly payment over the previous 3 months), and
• Ensuring that invoices submitted by suppliers are paid immediately to maintain cash flow in the supply chain and help to protect jobs.

If you are a supplier to a public sector body, you must act transparently and on an open-book basis, making cost data available to your public sector clients. You must also continue to pay your employees and subcontractors / suppliers. Suppliers to the public sector must not expect to make profits on any undelivered elements of a contract. The PPN makes clear that, should suppliers be found to be taking undue advantage, or failing to act transparently, a public sector body can take action to recover payments made to that supplier.

The PPN requires public sector bodies to urgently review their contract portfolios and take steps to support suppliers who they believe are “at risk”. However, no definition of “at risk” is given in the document.  We would suggest that if you are a supplier and you have yet to hear from a public sector client, you should seek to get in touch with them as soon as possible, particularly if you have concerns about your supply chain, staff retention and/or are experiencing financial difficulties currently. Given the requirement for transparency, you may be required to provide evidence, so it may be helpful to have any relevant documentation ready to send, if necessary, as this may help ensure a decision is made by the public sector client more promptly, particularly as the public sector body may have a number of contracts to consider.

The Competition and Markets Authority (CMA) has issued a number of guidance documents about the application of competition law rules during the coronavirus outbreak. In general, the competition law rules are being relaxed in very specific circumstances.

In the event that the contractor is displaying one or more of the above signs, then it is worth considering the following actions to protect the employer’s position as far as possible:

• Closely monitor the financial and on-site performance of the contractor in order to assess the likelihood and timing of potential insolvency
• Ensure all bonds, guarantees and collateral warranties have been obtained under the building contract, and if not take steps to obtain them immediately
• Consider the terms of any guarantees to ensure that the guarantor’s obligations are not inadvertently discharged
• Bonds may require adjudication to have been commenced (or even completed) prior to insolvency so as not to be stayed pursuant to insolvency laws
• Carry out an audit of the on-site plant, equipment and materials, and evidence this (for example with photographs and written records)
• Ensure that copies of all relevant documentation have been obtained, for example drawings, specifications and anything required to comply with CDM requirements. If not, take steps to obtain these
• Review the payment position under the building contract, including whether any over payments have been made to the contractor which should be reclaimed, what retention is held or has been released, whether any payment notices may be necessary, and whether there are rights of set-off which should be exercised
• Check whether the involvement of any third party is required, for example funders, landlords, tenants or purchasers who may have rights in relation to the building contract and how it is administered
• Review the terms of the building contract relating to contractor insolvency – hopefully the parties will be fully aware of the building contract terms and have been administering it correctly to date, but if it has been hiding in a draw then now would be a good time to dust it off and ensure familiarity with the relevant provisions!

In general. there is often a stick or twist decision.  If the employer chooses to financially support the contractor (for example by agreeing different payment arrangements), this may help to keep the contractor solvent and more likely to complete the project, but it also exposes the employer to greater risk if the approach is not successful.  Conversely, withholding payments  from the contractor may make insolvency a self-fulfilling prophecy.  The precise advantages and disadvantages of the approach will be dependent on the specific circumstances of each case.

The government has also confirmed it will match donations to the National Emergencies Trust as part of the BBC’s Big Night In fundraiser on 23 April – pledging a minimum of £20 million.