Will I need to make an application to the court for a remote hearing?

With the loss of face-to-face meetings in the current situation, video conferencing has taken centre stage. But how do you do that in a compliant way? Here are some of the main high-level data protection issues to consider when selecting and implementing a new third party provider’s video conferencing system.

1. Make sure you do your due diligence on the security measures offered by the provider. Clearly you can’t visit them, so look at the information offered publicly by the provider and read good quality, reliable, third party sources and ask the provider questions directly. Also ask any other organisations you know that use the provider. Document all this.
2. If personal information is being sent outside of the UK/European Economic Area, make sure that transfer complies with GDPR. If it’s a US provider, is it registered in the EU-US Privacy Shield list or does it offer a model clause contract (you’re likely to need the 2010 version)? Or is the service provided from a country whose data protection laws offer equivalent protection to those in Europe? Look at the support service as well as the hosting. Document this.
3. Make sure you put a compliant processor agreement in place. The provider should offer one as part of the contract terms. Check it meets GDPR requirements.
4. You’re likely to need to update your privacy notice, particularly if you’re going to record calls. Provide participants with a short message and link to the privacy notice in the meeting invite and on any registration page.
5. Create or update other GDPR-mandated documentation – for example, depending on your use, you may need a legitimate interests assessment and to update your record of processing.
6. Finally, configure and use the system in a secure and compliant way. Look at the settings/options carefully and think through the security and compliance implications of each. That could include deciding who in the meeting can share their screen; whether or not you use passwords for participants; whether or not to record, and if you’re going to record, where to store the recording. Document your decisions and the reasons for them.

The ICO has said it understands that resources, whether they are finances or people, might be diverted away from usual compliance work during the pandemic. However the last thing you need at the moment is to create a bigger problem than the one you are trying to solve. So do the best you can, ask for help from one of our specialists if you need it, and keep the whole thing under review.

On 16 April 2020, Ian Hulme, the ICO’s Director of Assurance, posted a blog for business owners, employers and managers about how to safely roll out the latest video conferencing technology.

On 21 April 2020, the NCSC published security guidance for organisations on choosing, configuring and deploying video conferencing services.

Many charities have money that are considered restricted funds which are given to the charity or raised for a specific purpose.  The Charity Commission gives guidance on this, please see the link below. Depending on the circumstances in which these monies have been given to a charity or raised you may or may not be able to use them.

Monies raised in an appeal or specific fund raising campaign are unlikely to be available as it is likely to be impossible to get the permission of the donor to change the use.  If however you have had monies donated for a specific purpose and you can identify the donor you can use these funds for general overheads and to pay wages etc. if you receive the donor’s specific permission to do so.

Employers and employees can decide the split of the hours of work and the hours of furlough. There is no maximum or minimum requirements. You can change the arrangement, by agreement, from time to time.

When claiming for employees who are flexibly furloughed, you should not claim until you are sure of the exact hours they will work during the claim period.

The Town and Country Planning (Use Classes) (Amendment) (England Regulations) 2020 were laid before Parliament and come into force on 1 September 2020. They apply in England only.

The changes include the revocation of the following Use Classes;

• A1 – shops
• A2 – financial and professional services
• A3 – restaurants and cafes
• A4 – drinking establishments
• A5 – hot food takeaways
• B1 – business. Also revoked are the sub parts of B1;
  • B1(a) – offices
  • B1(b) – research and development of products and processes
  • B1(c ) – industrial process
• D1 – non residential institutions
• D2 – assembly and leisure

The changes include the amendment of the following Use Class;

• B2 (industry)

The changes include the introduction of the following Use Classes;

• E – commercial, business and service
• F.1 – learning and non-residential institutions
• F.2 – Local community

There are no changes to the following Use Classes;

• C1 – hotels, boarding and guest houses
• C2 – residential institutions
• C3 – dwellinghouses
• C4 – small HMO

From 1 September 2020;

• Small retail shops (not more than 280 sq metres net sales area) selling essential goods including food and at least 1 kilometre from another shop will cease being an A1 use and will become a F.2 (local community) use;
• Other A1 shops will become an E (commercial, business and service) use;
• A2 uses will become an E (commercial, business and service) use;
• A3 uses will become an E (commercial, business and service) use;
• A4 uses will not be in a Use Class, they will be sui generis, ie not in any use class;
• A5 uses will not be in a Use Class, they will be sui generis, ie not in any use class;
• B1 uses (included B1(a), B1 (b) and B1 (c) will become an E (commercial, business and service) use;
• B2 uses will either be B2 uses or will be Class E uses.
• Clinics, health centres, creches, day nurseries and day centres (previously D1 uses) will become an E (commercial, business and service) use;
• Schools, non residential education and training centres, museums, public libraries, public halls, exhibition halls, places of worship, law courts (previously D1 uses) will become an F.1 ( learning and non-residential institutions) use;
• Cinemas, concert halls, live music performance venues, bingo halls and dance halls (previously D2 uses) and will be sui generis, ie not in any use class;
• Gyms, indoor sport, recreation or fitness not involving motorised vehicles or firearms principally to visiting members of the public (previously D2 uses) will become an E (commercial, business and service) use;
• Hall or meeting place for the principal use of the local community (previously D2 uses) will become an F.2 (local community) use;
• Indoor or outdoor swimming baths, skating rinks, outdoor sports or recreation grounds (not involving motorised vehicles or firearms) (previously D2 uses) will become an F.2 (local community) use.

Changes of use within a Use Class do not constitute development. That being the case, provided the Order is applicable, its operation not having been restricted by planning condition, Agreement or Article 4 (1) Direction for example, planning permission would not be required, development as defined not happening.  If legally binding confirmation is required that planning permission is not required this can only be obtained by way of a successful application for a Certificate of Lawfulness. In the absence of such, there is some risk.

It remains the case that planning permission may be required for operational works to buildings. It also remains the case that other consents and permissions may be necessary for example licenses. Furthermore amendments to leases may be required if the property is rented.

The Regulations additionally include transitional arrangements because of permitted development rights for changes of use in the Town and Country Planning (General Permitted Development) (England) Order amongst others.  To respond to this Regulations introduce a ‘material period’ which is defined as meaning the period beginning 1 September 2020 and ending 31 July 2021. It is expected during the material period the Orders giving permitted development rights for changes for use which do constitute development will be amended / updated to reflect the new use classes.

Click here to view the Regulations.

The above is based on our understanding of the new Regulations at the time of issue and in advance of planning practice guidance being issued.

Employers will be collecting and sharing health information. Health information is sensitive and higher data protection standards apply. Here are a few key pointers.

• Update privacy notices to cover the new collection and sharing of employees’ information and provide these to the workforce. Be transparent and fair.
• Identify the legal basis and condition for use of this information and put any required paperwork in place. The ICO guidance will help. For some conditions such as the employment condition, an Appropriate Policy Document (APD) will be required. The ICO has an APD template.
• Only use the information for the purpose of managing the workforce during the pandemic.
• Only collect or share information if it’s necessary – if it’s a targeted and proportionate way of achieving your purpose.
• Make sure any health information collected and shared is accurate – there may be serious consequences if it’s not.
• Work out how long the information must be kept for. Keep a record of that period and act on it at the appropriate time.
• Security is very important – there may be malicious actors trying to trick employers and employees. Make sure employees know how to identify a genuine NHS Test and Trace contact. Keep the information secure. Use the ICO’s data sharing checklists** and keep a record of the disclosures made and why. Control external disclosures – only certain authorised members of staff should make them.
• Make sure individuals can still exercise their data protection rights – that’s also very important. Keep data protection records up-to-date and ensure any exports of personal information outside the UK are compliant.
• Before introducing employer-led testing like taking temperatures, thermal imaging or other potentially intrusive tests, work out if a data protection impact assessment (DPIA) is required. It will be if the intended processing is ‘high risk’. If it is, then carry out a full DPIA. It will help address the issues systematically and mitigate risks.
• All this demonstrates ‘accountability’ – it shows affected individuals and the ICO that the employer is complying with data protection requirements.

If you need further help, please visit the ICO’s data protection and coronavirus information hub or ask our data protection team.

** Please note that this link is to the ICO’s existing checklists and data sharing code of practice. We will update the link to the ICO’s new checklists after they are published.