What data protection principles should employers take into consideration regarding remote working? <\/p>\n
\u200bThe first thing to consider with remote working is having a secure Virtual Private Network (“VPN”) in place.\u00a0 That is an absolute must.\u00a0<\/span><\/p>\n The second thing is to have Remote working policies.\u00a0 Such policies should include guidance on physical security, especially if an organisation\u2019s processes are manual i.e. a lot of data on paper, then the employees should be provided with lockable cabinets or drawers to store the papers. Make sure to include in the policy \u2018not to leave the cabinet\/drawer\u2019s key on display\u2019, you would be surprised how many leave the key on their desk in full view.\u00a0 You should also insist that remote workers follow your lock screen and clear desk policies.\u00a0 When working from home there are other members of the household who are not authorised to access the data, so locking the screen when moving away from the desk must be applied.\u00a0 Consideration should also be given to the disposal of data, especially data on paper. It might be that the remote workers can be asked to use the employer\u2019s disposal facilities at the place of work, it might be that the employee is provided with a shredder and\/or confidential disposal bin. Or it could be that due to the geographical distance of the remote worker, it\u2019s not possible for them to use the employer\u2019s disposal facilities and therefore the employer might have to arrange for an approved waste disposal by 3rd parties to collect directly from the employee\u2019s home address. <\/span><\/p>\n If the employee is able to allocate a room in their home specifically for work they should be encouraged at the end of the day to not only shut down the computer but also to shut the door to prevent unauthorised access by other members of the household.\u00a0 If on the other hand, the employee’s working station is in a more communal area, such as the lounge or kitchen, then they need to be more vigilant as those rooms tend to have more traffic and so locking the screen and putting away paper in lockable cabinets becomes even more critical.\u00a0From a work-life balance perspective shutting the door and logging off the computer may also have a positive psychological impact as it allows the individual to detach from work mode. <\/span><\/p>\n A work-life balance is important and whichever initiative the organisation is using to promote a work-life balance there is always an element of data that needs to be considered.\u00a0 Therefore, it\u2019s important for all members of staff to be aware of their surroundings and determine if anyone is listening, who shouldn\u2019t be listening, to the conversation. This could easily turn into a data breach.\u00a0\u00a0<\/span><\/p>\n Think \u2018Confidentiality\u2019<\/span><\/p>\n During the lockdown, we saw a shift in remote working and an increase in the use of telecommunication systems such as Zoom, Teams, etc. A lot of employers insisted for the employee to have the camera on forgetting that the employee was working from home. We are fortunate in this country that we have Human Rights and one of those rights is Privacy, in particular at home. This means that while the employer can insist that the employee joins a Zoom\/Teams call, they should not insist on the camera being on, as that could be a breach of privacy.\u00a0However, most telecommunication apps, if not all, have the ability to either change the background or to blur it.\u00a0 So long as the employee is able to do that then it\u2019s fine to insist that the camera be switched on.\u00a0<\/span><\/p>\n Organisations that heavily rely on telecommunication devices may wish to consider adopting a policy for telecommunication devices that captures this point to ensure that managers do not overstep the mark.<\/span><\/p>\n Privacy does not only apply in the home environment but also at work. This means that organisations need to be mindful that whilst they have a duty of care towards their staff, they also have a requirement to respect privacy.\u00a0 Employers should be mindful, when running wellbeing initiatives, that consent in an employer\/employee situation, due to the power imbalance, may not be a valid, lawful basis for processing personal data. As such it may be better to notify staff of initiatives that they can opt in or out of. It\u2019s important to build trust with the workforce and what better way to do that than by being transparent?\u00a0Let them know why you are introducing the initiative, what\u2019s in it for them, what data is going to be collected and why (bearing in mind that any mental health data is medical data), what you are going to do with that data, where you are going to store it, who you are going to share it with and how long you are going to retain it and that they can withdraw at any time.<\/span><\/p>\n One of the corporate organisations, I worked for, prior to starting my GDPR consulting business, used to provide us with a bowl of fruit every Friday, as part of the wellbeing initiative.\u00a0Some people liked it, some didn\u2019t and thought it was patronising. So why not ask your workforce what they want?\u00a0 You will have higher participation and higher chances of success.\u00a0<\/span><\/p>\n It is important to understand that mental health data is about an individual’s emotional and mental state and therefore this type of data is considered medical data.\u00a0 Under the GDPR medical data is defined as \u2018Special Category data\u2019.\u00a0Art. 9 states that \u201cthe processing of Special category data shall be prohibited,\u201d\u00a0unless certain conditions are met. One of these conditions is explicit consent.\u00a0 When it comes to consent, we need to watch out because for consent to be valid, it needs to be Freely Given.\u00a0 In an employer\/employee scenario, due to the power imbalance, the freely given criteria cannot be met, and therefore consent may not be valid by itself. For the criteria of Freely Given to be achieved the only way is through the voluntary approach of opting in or out of an initiative.\u00a0 <\/span><\/p>\n Cristina Vannini-Goodchild is the owner of CVG Solutions Ltd a multi-award winning GDPR consulting agency and is also the owner of the \u2018Why such a Fuss\u2019 podcast which features on <\/span><\/i>Spotify<\/span><\/i><\/a>, <\/span><\/i>Amazon Music<\/span><\/i><\/a>, and<\/span><\/i> Alexa<\/span><\/i><\/a>. Cristina is a fully qualified CIPP\/E and C-DPO data protection specialist coupled with over 25 years of C-level experience of top-tier corporations (EDS\/HP, BSi, General Motors, and Serco) in data processing and risk management. Cristina focuses on supporting small and medium-sized businesses to strengthen their reputation and increase their revenue through her own unique formula \u2018Educate, Empower and Enable\u2019.<\/span><\/i><\/p>\n","protected":false},"excerpt":{"rendered":" Data protection principles and remote working What data protection principles should employers take into consideration regarding remote working? \u200bThe first thing to consider with remote working is having a secure Virtual Private Network (“VPN”) in\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[34],"tags":[77,75,76],"sector":[],"class_list":["post-1159","post","type-post","status-publish","format-standard","hentry","category-workplace-wellbeing","tag-gdpr","tag-remote-working","tag-tips-and-advice"],"acf":[],"yoast_head":"\n