Employers warned about data protection risks due to remote working

Global law firm DLA Piper has warned Irish employers about their data protection obligations in light of the huge shift to remote working and has recommended organisations organise training and reissue policies around information security and confidentiality to ensure workers are aware of their obligations while working from home.

Similarly, businesses who look to introduce new systems and methods to monitor attendance and productivity during this period should consider that employee monitoring applications come with onerous requirements under GDPR and will require data protection assessments to be carried out.

As well as technical and IT security issues, there is a range of practical considerations that employers need to be mindful of in order to maintain standards of data protection and confidentiality. For example, employees living in shared accommodation required to participate in conference calls should be provided with headsets to ensure that sensitive information is not overheard by housemates, as well as laptop privacy filters.

Similarly, paper should be minimised when working remotely and if individual workplace assessments deem necessary, additional security equipment such as shredders or filing cabinets should be provided to those remote workers who are routinely accessing high-risk categories of data.

Employers may now find themselves increasingly communicating with remote workers through new channels such as personal mobiles numbers or via messaging apps. These bring their own challenges in terms of whether staff have appropriate security on personal devices and to also ensure that there is no inappropriate use of messaging apps on work devices.

Organisations may also be required to communicate with the HSE in relation to contact tracing and data sharing. The HSE considers privacy and patient confidentiality as central to ensuring the accuracy of reported cases of COVID-19 and encouraging those with a suspected case of COVID-19 to come forward. Under GDPR, employers are justified in asking employees to inform them of a diagnosis, but their diagnosis should not be shared with other members of staff – individuals should be informed on an anonymous basis where appropriate.

Highlighting the range of considerations that employers should be aware of, Ciara McLoughlin, Partner and Head of Employment, Ireland said: “The means by which we communicate and connect during this time must be carefully considered. Most remote workers are operating outside of their usual environment, so simple mistakes with bigger consequences can be made because employers have not had the foresight to have appropriate information security and confidentiality policies in place. For example, many professionals have bought printers for their home and may end up causing issues if confidential material is not disposed of properly.”

“Some employers are also dealing with confirmed cases of staff with COVID-19 and may breach those employee’s privacy after doing what they thought was the right thing and telling their colleagues. Rather than making decisions like this on the fly, it is vital that organisations assess potential weak points and how they would manage scenarios like a colleague testing positive for Coronavirus.”

John Magee, Partner and Head of Data Protection, Privacy and Security, at DLA Piper Ireland said: “The transition to large-scale remote working has been undertaken under pressure and at speed. While most businesses and their IT teams deserve huge praise for completing this transition remarkably well, the potential for gaps to arise is obviously high. By ensuring that security is maintained over personal data, organisations can ensure that they reduce the risk of issues occurring and continue to serve their staff, customers and communities.”