Meeting the data challenge of working from home

By Forbes Solicitors

06 May 2020

daniel-milnes-2.jpg

Before the UK went on lockdown, ‘work from home wherever possible’ was one of the earliest messages from the Government to try and delay the spread of COVID-19. For businesses not used to remote working, this presented a number of challenges surrounding IT equipment, networks and infrastructures. These were all very practical considerations, focused on enabling connectivity and accessibility to minimise operational disruption and ensure employees could actually work from home.

With these conundrums solved, businesses are now increasingly turning their attention to information security and data protection. Popular video conferencing platform Zoom has hit the headlines following reports of virtual meetings being hijacked by rogue users. This highlights a key data protection challenge of remote working but isn’t the only major risk companies need to be mindful of, they also need to effectively manage the trend of employees using their own devices for work purposes.

Video conferencing and virtual meetings

Companies using online platforms to host virtual meetings have two data privacy challenges to contend with. They need to consider the security of information shared during the video conference and also need to be mindful about how the online hosting company handles the personal information of employees.

The European Union’s General Data Protection Regulation (GDPR) provides a regulatory framework for how personal data is collected, handled, stored and retained for future use by organisations and is applied with modifications in domestic law across Brexit by the Data Protection Act 2018 (DPA). Part of this Regulation means that individuals, such as employees, have a right to know which organisations hold their personal information, why and how it is being used.

If companies opt to use a platform such as Zoom and request that employees join video conferences, a business could find it becomes liable for how the video conferencing provider uses and shares employees’ personal information. If a member of staff was dissatisfied with this or felt compromised because of this, they could potentially bring a claim for damages against their employer. The legal position here depends on the relationship between the employer and the provider and whether the provider is a “processor” or a “controller”. This is a significant distinction, because controllers are more regulated and have more duties under the GDPR and DPA. Processors have an independent duty to maintain appropriate data security, so an insecure provider could face enforcement action by the Information Commissioner’s Office (ICO)

The hijacking of Zoom video conferences has involved ‘Zoombombing’, where rogue users join virtual meetings and broadcast shock messages and pornographic content. The disruptive and offensive nature of this aside, this so-called ‘Zoombombing’ may expose a serious vulnerability, if rogue access is not being caused by users leaking access details.

Malicious users could join video conferences to access confidential business information and depending on how they gain access, the company which organised the conference could find itself liable for a data breach in relation to personal information or a claim for breach of confidentiality, as could the platform provider.

Businesses using video conferencing platforms need to ensure, at the very least, that hosting providers offer true end-to-end encryption and use unique passcodes for each participant for each session. They should also carry out some due diligence or even a Data Protection Impact Assessment before committing to use of the platform and apply some normal common sense about what they say and what they show during the conference. 

Using personal devices

Given the large numbers of remote workers, many organisations are permitting staff to work remotely on their own personal devices (commonly known as ‘Bring Your Own Device’ or BYOD). 

With this in mind, companies need to ensure they have a BYOD policy or conduct a review of existing policies. A policy will need to consider the suitability of a member of staff’s device, which should include an employee confirming that their device’s operating system is up to date and that relevant security updates have been downloaded. 

An update from Google in March 2020 confirmed that it had patched a vulnerability update to protect millions of Android phones, which were at risk of being exploited by hackers. If an employee hasn’t downloaded this patch and was using their phone to access work networks, their device could provide a gateway for hackers to commercial and personal data.

While business owners and managers may believe the employee is liable, because it’s their device and subsequent failing to download an update, this is unlikely to be the case. A company retains responsibility for the security of information processed through personal devices where they are used for work purposes with the knowledge of the employer. The recent Supreme Court judgment in the Morrisons data breach case repeated the established legal rule that, where the employee is acting for the employer’s business, then in many cases the employer will be liable for what the employee does or fails to do, even if it goes outside or against instructions.  

Businesses must also ensure that within their BYDO policy there is provision to deal with the loss, theft or failure of an employee’s device.  A device’s geo-locations should be switched on and a capability to remotely wipe data, if it is lost or stolen, should be installed if possible.

BYOD policies need to also address the practical elements of home device use, such as not having content replicated over their devices in the home, and not leaving devices accessible or visible from outside.

Finally, businesses must consider how to deal with BYOD for employees entering furlough or leaving their employment.  They may need to ensure employees do not access work information and networks during a period of furlough and make provision to retrieve stored documents and delete relevant information from the device, should the employee leave the business.

It is currently unclear how long government instructions to work from home wherever possible will last. This has left many businesses prioritising how to adapt their operations to keep them running. As part of this, companies should take the time to consider the new risks working remotely can present to data protection and information security. Addressing challenges will safeguard operation now and create a foundation for more agile and secure working in the future.

Latest news

1

Forbes makes Manchester move Forbes Manchester

Forbes makes Manchester move

15 Apr 2024

2

Blackpool approves plans for pair of apartment complexes New South Promenade Apartments Visuals

Blackpool approves plans for pair of apartment complexes

12 Apr 2024

3

Distinguished engineer takes senior role at Lancaster University Rebecca Lingwood

Distinguished engineer takes senior role at Lancaster University

11 Apr 2024

4

International building supplies firm to open new plant in Preston New Kerakoll Group Premises Visuals

International building supplies firm to open new plant in Preston

11 Apr 2024

5

What to consider before you invest Charles Higham

What to consider before you invest

18 Apr 2024

Hwc 2024 Email Signature 980x120
Background image for hub sign up block

LBV Hub

Reach 50,000 members of the Lancashire business community

Post your news
Post your events
Post your offers
Company profile
Social reach
Magazine coverage
Sign-up
Events
Health and Wellbeing Conference 2024
Hwc 2024 Social Media 1200px 1
Networking
23 Apr 2024

Health and Wellbeing Conference 2024

Crow Wood Hotel, Burnley , BB12 0RT

08:30 - 13:00

Help to Grow Management Course
HTG2.png.png
LBV Hub Seminars
15 Apr 2024 - 17 Jul 2024

Help to Grow Management Course

Preston Campus , Preston , PR1 2HE

09:30 - 14:00

Cyber Secure 360: Safeguarding Your Digital World
CyberSecure 360 LBV-32.png.png
LBV Hub Seminars
18 Apr 2024 - 18 Apr 2024

Cyber Secure 360: Safeguarding Your Digital World

Accrington Stanley, Accrington, BB5 5BX

08:30 - 12:00

Business Networking in Burnley - BNI Kudos
EVENT LISTING BNI Kudos.png.png
LBV Hub Networking
18 Apr 2024

Business Networking in Burnley - BNI Kudos

Prairie Sports Village, Windemere Avenue, Burnley, BB10 2FU

06:45 - 08:30

Business Networking in Preston- BNI Brunch
EVENT LISTING SIZING Brunch .png.png
LBV Hub Networking
19 Apr 2024

Business Networking in Preston- BNI Brunch

Samlesbury Preston Hotel, Preston New Road, Preston, PR5 0UL

09:30 - 11:00

The Pro Club
Untitled design (6).png.png
LBV Hub Networking
19 Apr 2024

The Pro Club

Fraser House, Lancaster, LA1 4XQ

09:30 - 12:30

Business Networking in Blackburn - BNI Infinity
EVENT LISTING BNI Infinity.png.png
LBV Hub Networking
19 Apr 2024

Business Networking in Blackburn - BNI Infinity

Hampton by Hilton, 2 Frontier Ave, Blackburn, BB1 3AL

06:30 - 08:30

St Catherine’s Corporate Skydive
Corporate SkyDive.jpg.jpg
LBV Hub Fundraisers
21 Apr 2024

St Catherine’s Corporate Skydive

Black Knights Parachute Centre, Lancaster, LA2 0YD

12:00 - 16:30

Business Networking in Blackburn - BNI Vista
EVENT LISTING SIZING Vista.png.png
LBV Hub Networking
23 Apr 2024

Business Networking in Blackburn - BNI Vista

Hampton by Hilton, 2 Frontier Ave, Blackburn, BB1 3AL

06:45 - 08:30

Business Networking in Chorley - BNI Endeavour
EVENT LISTING SIZING Endeavour.png.png
LBV Hub Networking
23 Apr 2024

Business Networking in Chorley - BNI Endeavour

Oak Royal, Bury Lane, Chorley, PR6 8SW

06:30 - 08:30

HR Complete Training Programme: Equality and Diversity
Picture1.png.png
LBV Hub Webinar
23 Apr 2024

HR Complete Training Programme: Equality and Diversity

Online (Zoom)

09:30 - 11:00

Emergency First Aid at Work
Chamber Logo1.png.png
LBV Hub Seminars
23 Apr 2024

Emergency First Aid at Work

FGH Training, 3rd Floor, Storey House, White Cross Business Park, Lancaster, LA1 4XQ

09:00 - 16:00

Advertise with us

Reaching 50,000 members, our print, digital and event platforms offer a fantastic way to raise your business profile and help you grow.

Find out more Lbv115 Online Graphic
Subscribe now

Weekly news bulletin