What if I get the status wrong?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

Employees will be reluctant to take unpaid leave or a sabbatical but when faced with the alternative prospect of redundancy may give it some serious consideration. This would remove the cost of that employee from the employer’s business for an agreed period of time. This is an option which can be offered to employees but again, imposing it without agreement creates significant risk.

There have always been ways for public bodies to assist without being required to notify these for approval. These continue to be available during the financial crisis, and are likely to be increasingly useful for measures which need to be introduced quickly. The measures include:

Those where it is possible to conclude that there is no effect on trade between Member States – for example, measures which are likely to have only a limited local effect. The European Commission has concluded, for example, that measures to assist locally-focused cultural activity can be assumed to have no effect on inter-State trade. 

Those where it is possible to conclude that the State is acting in a way consistent with a commercial operator (the so-called Market Economy Operator Principle) – particular care will need to be taken in the context of current economic conditions to ensure that it can reasonably be asserted that a commercial operator would act in the same way as the public body.

Measures under the General Block Exemption Regulation – this legislation allows various types of aid, or aid schemes, to be employed.

Examples include aid for SMEs, aid for research and development, aid for local infrastructure and aid to ports and airports.

De Minimis Measures – Member States are permitted to grant small amounts of aid to undertakings over three fiscal years (the current year and the previous two years). This allows undertakings to receive up to €200,000 (or €500,000 where they are providing public services).

In most circumstances the answer will be no. It would be an infringement of their human rights. It could also be a criminal assault.

However where there is a high risk to employees of exposure to COVID-19, such as care homes and healthcare environments, you might be able to make it a requirement of their role to have the vaccine.

First, consider whether you need to have a blanket requirement covering all employees or whether only certain groups who work in the most high risk areas require the vaccine.

You will need to do a thorough risk assessment balancing the amount that the risk of exposure would be reduced against the interference with the employee’s human rights. Consideration will need to be given as to whether insisting on the vaccine is proportionate to the risk and whether other less invasive steps could be taken instead, such as maintaining social distancing, wearing a mask, washing hands.

Any requirement for employees to be vaccinated should be communicated clearly to employees and trade unions together with a clear explanation for why it is necessary.

Many policies will only provide business interruption cover if it arises from property damage. The FCA has acknowledged that insurers are entitled to reject claims in relation to such policies, notwithstanding the success of the FCA’s test case in the Supreme Court, and which was generally favourable to policyholders [Insert a link here to our update on the test case]. In other cases the policy wording will be less clear and businesses may legitimately feel that their insurer is wrongly withholding payment.

One route of challenge to an insurer’s decision is via one of the well-publicised class actions. Another route of challenge is by a complaint to the Financial Ombudsman Service (FOS). This service is open to consumers and small and medium-sized businesses, ‘micro-enterprises’, charities and trusts. The service will be an attractive option for many businesses, as it is free and relatively quick (although it remains to be seen how the service keeps up with an increase in demand as a result of the pandemic). You will need to have complained to your insurer before bringing a complaint with the FOS.

Further details can be found here.