Meeting the data challenge of working from home

By Forbes Solicitors

06 May 2020

daniel-milnes-2.jpg

Before the UK went on lockdown, ‘work from home wherever possible’ was one of the earliest messages from the Government to try and delay the spread of COVID-19. For businesses not used to remote working, this presented a number of challenges surrounding IT equipment, networks and infrastructures. These were all very practical considerations, focused on enabling connectivity and accessibility to minimise operational disruption and ensure employees could actually work from home.

With these conundrums solved, businesses are now increasingly turning their attention to information security and data protection. Popular video conferencing platform Zoom has hit the headlines following reports of virtual meetings being hijacked by rogue users. This highlights a key data protection challenge of remote working but isn’t the only major risk companies need to be mindful of, they also need to effectively manage the trend of employees using their own devices for work purposes.

Video conferencing and virtual meetings

Companies using online platforms to host virtual meetings have two data privacy challenges to contend with. They need to consider the security of information shared during the video conference and also need to be mindful about how the online hosting company handles the personal information of employees.

The European Union’s General Data Protection Regulation (GDPR) provides a regulatory framework for how personal data is collected, handled, stored and retained for future use by organisations and is applied with modifications in domestic law across Brexit by the Data Protection Act 2018 (DPA). Part of this Regulation means that individuals, such as employees, have a right to know which organisations hold their personal information, why and how it is being used.

If companies opt to use a platform such as Zoom and request that employees join video conferences, a business could find it becomes liable for how the video conferencing provider uses and shares employees’ personal information. If a member of staff was dissatisfied with this or felt compromised because of this, they could potentially bring a claim for damages against their employer. The legal position here depends on the relationship between the employer and the provider and whether the provider is a “processor” or a “controller”. This is a significant distinction, because controllers are more regulated and have more duties under the GDPR and DPA. Processors have an independent duty to maintain appropriate data security, so an insecure provider could face enforcement action by the Information Commissioner’s Office (ICO)

The hijacking of Zoom video conferences has involved ‘Zoombombing’, where rogue users join virtual meetings and broadcast shock messages and pornographic content. The disruptive and offensive nature of this aside, this so-called ‘Zoombombing’ may expose a serious vulnerability, if rogue access is not being caused by users leaking access details.

Malicious users could join video conferences to access confidential business information and depending on how they gain access, the company which organised the conference could find itself liable for a data breach in relation to personal information or a claim for breach of confidentiality, as could the platform provider.

Businesses using video conferencing platforms need to ensure, at the very least, that hosting providers offer true end-to-end encryption and use unique passcodes for each participant for each session. They should also carry out some due diligence or even a Data Protection Impact Assessment before committing to use of the platform and apply some normal common sense about what they say and what they show during the conference. 

Using personal devices

Given the large numbers of remote workers, many organisations are permitting staff to work remotely on their own personal devices (commonly known as ‘Bring Your Own Device’ or BYOD). 

With this in mind, companies need to ensure they have a BYOD policy or conduct a review of existing policies. A policy will need to consider the suitability of a member of staff’s device, which should include an employee confirming that their device’s operating system is up to date and that relevant security updates have been downloaded. 

An update from Google in March 2020 confirmed that it had patched a vulnerability update to protect millions of Android phones, which were at risk of being exploited by hackers. If an employee hasn’t downloaded this patch and was using their phone to access work networks, their device could provide a gateway for hackers to commercial and personal data.

While business owners and managers may believe the employee is liable, because it’s their device and subsequent failing to download an update, this is unlikely to be the case. A company retains responsibility for the security of information processed through personal devices where they are used for work purposes with the knowledge of the employer. The recent Supreme Court judgment in the Morrisons data breach case repeated the established legal rule that, where the employee is acting for the employer’s business, then in many cases the employer will be liable for what the employee does or fails to do, even if it goes outside or against instructions.  

Businesses must also ensure that within their BYDO policy there is provision to deal with the loss, theft or failure of an employee’s device.  A device’s geo-locations should be switched on and a capability to remotely wipe data, if it is lost or stolen, should be installed if possible.

BYOD policies need to also address the practical elements of home device use, such as not having content replicated over their devices in the home, and not leaving devices accessible or visible from outside.

Finally, businesses must consider how to deal with BYOD for employees entering furlough or leaving their employment.  They may need to ensure employees do not access work information and networks during a period of furlough and make provision to retrieve stored documents and delete relevant information from the device, should the employee leave the business.

It is currently unclear how long government instructions to work from home wherever possible will last. This has left many businesses prioritising how to adapt their operations to keep them running. As part of this, companies should take the time to consider the new risks working remotely can present to data protection and information security. Addressing challenges will safeguard operation now and create a foundation for more agile and secure working in the future.

Latest news

1

Supermarket stays put in blow to town's £250m masterplan Blackburn Aerial

Supermarket stays put in blow to town's £250m masterplan

28 Mar 2024

2

Modern Milkman acquires American counterpart article placeholder listing image

Modern Milkman acquires American counterpart

28 Mar 2024

3

Tips for surviving Lancashire's pothole plague

Tips for surviving Lancashire's pothole plague

28 Mar 2024

4

The Pikes wines launched to support Lake District mountain rescue THE PIKES BLOG BANNER.jpg.jpg

The Pikes wines launched to support Lake District mountain rescue

28 Mar 2024

5

Fundraising success sees Stanley Women compete in Dallas Cup The Accrington Stanley Under 18s team which are currently in Dallas.jpg.jpg

Fundraising success sees Stanley Women compete in Dallas Cup

28 Mar 2024

Hwc 2024 Email Signature 980x120
Background image for hub sign up block

LBV Hub

Reach 50,000 members of the Lancashire business community

Post your news
Post your events
Post your offers
Company profile
Social reach
Magazine coverage
Sign-up
Events
Health and Wellbeing Conference 2024
Hwc 2024 Social Media 1200px 1
Networking
23 Apr 2024

Health and Wellbeing Conference 2024

Crow Wood Hotel, Burnley , BB12 0RT

08:30 - 13:00

Business Networking in Preston - BNI Brunch
EVENT LISTING SIZING Brunch .png.png
LBV Hub Networking
29 Mar 2024

Business Networking in Preston - BNI Brunch

Samlesbury Preston Hotel, Preston New Road, Preston, PR5 0UL

09:30 - 11:00

Business Networking in Blackburn - BNI Infinity
EVENT LISTING BNI Infinity.png.png
LBV Hub Networking
29 Mar 2024

Business Networking in Blackburn - BNI Infinity

Hampton by Hilton, 2 Frontier Ave, Blackburn, BB1 3AL

06:30 - 08:30

Business Networking in Chorley - BNI Endeavour
EVENT LISTING SIZING Endeavour.png.png
LBV Hub Networking
02 Apr 2024

Business Networking in Chorley - BNI Endeavour

Oak Royal, Bury Lane, Chorley, PR6 8SW

06:30 - 08:30

Business Networking in Blackburn - BNI Vista
EVENT LISTING SIZING Vista.png.png
LBV Hub Networking
02 Apr 2024

Business Networking in Blackburn - BNI Vista

Hampton by Hilton, 2 Frontier Ave, Blackburn, BB1 3AL

06:45 - 08:30

Business Networking in Preston - BNI Diamond
EVENT LISTING BNI Diamond.png.png
LBV Hub Networking
03 Apr 2024

Business Networking in Preston - BNI Diamond

The Marriot Hotel, Garstang Road, Broughton, PR3 5JB

07:15 - 09:00

Business Networking in Lancaster - Eden Business Network
EVENT LISTING Eden Business Network.png.png
LBV Hub Networking
03 Apr 2024

Business Networking in Lancaster - Eden Business Network

The Borough, 3 Dalton Square, Lancaster, LA1 1PP

18:30 - 20:30

Business Networking in Accrington - BNI Zeus
EVENT LISTING SIZING Zeus.png.png
LBV Hub Networking
03 Apr 2024

Business Networking in Accrington - BNI Zeus

The Mill House, Corn Mill Yard, Accrington, BB5 5HX

06:45 - 08:30

Business Networking in Burnley - BNI Kudos
EVENT LISTING BNI Kudos.png.png
LBV Hub Networking
04 Apr 2024

Business Networking in Burnley - BNI Kudos

Prairie Sports Village, Windemere Avenue, Burnley, BB10 2FU

06:45 - 08:30

Business Networking in Lancaster - BNI Castle
EVENT LISTING BNI Castle.png.png
LBV Hub Networking
04 Apr 2024

Business Networking in Lancaster - BNI Castle

Vale of Lune RUFC, Powder House Lane, Lancaster, LA1 2TT

06:45 - 08:30

Business Networking in Blackburn - BNI Infinity
EVENT LISTING BNI Infinity.png.png
LBV Hub Networking
05 Apr 2024

Business Networking in Blackburn - BNI Infinity

Hampton by Hilton, 2 Frontier Ave, Blackburn, BB1 3AL

06:30 - 08:30

Business Networking in Preston - BNI Brunch
EVENT LISTING SIZING Brunch .png.png
LBV Hub Networking
05 Apr 2024

Business Networking in Preston - BNI Brunch

Samlesbury Preston Hotel, Preston New Road, Preston, PR5 0UL

09:30 - 11:00

Advertise with us

Reaching 50,000 members, our print, digital and event platforms offer a fantastic way to raise your business profile and help you grow.

Find out more Lbv115 Online Graphic
Subscribe now

Weekly news bulletin