What are the responsibilities of employers and employees when discussing confidential or sensitive information on video or telephone calls, or handling it while working from home? Here’s what you need to know:
What are my responsibilities as an employer?
Under their contract of employment, all staff should be obliged not to disclose their employer’s confidential information to third parties or misuse it. This means reminding employees that their confidentiality obligations do not end because they are working from home.
Employers should make sure that policies on managing information and data protection are appropriate and well thought through and then understood and followed by all employees.
How can I ensure employees know how to handle sensitive data?
Employees who are working from home may be handling sensitive and confidential information and it’s important that your policies and guidelines for handling these are as robust as they are for people working from the workplace.
Employees need to have been issued with a Data Handling Policy, from day 1, wherever they work, to tell them how to process and protect personal data. Before they start working from home, it’s a good idea to remind them of the policies that relate to home working. For business information, you should have a Confidentiality Policy and contract clause in place which defines what confidential information is. Make sure employees are very clear on their responsibilities and that the usual data protection rules still apply.
How can I safeguard telephone and video calls?
We expect video conferencing to be widely used even after the pandemic, so make sure you have clear and up-to-date policies and guidelines around the use of videoconferencing if you don’t already. This should ensure that employees are only using software that is approved by their employer.
It is not unreasonable for staff to use programmes on work devices such as Microsoft Teams or Zoom for personal calls outside of work hours – think of all the family quizzes in lockdown! While working, telephone and video calls can be overheard by family, flatmates and neighbours, so employees should make sure their connection is secure and that they cannot be overheard discussing any sensitive information. If there is a risk of this happening, they should let their employer know so that the meeting can be held at a more appropriate time or in a different environment.
What about GDPR?
If you decide to record a video call, in which employees are involved, be mindful that any such recording is likely to fall within “personal data” under the GDPR. In order to comply with the GDPR’s requirements, all employees need to be aware of the fact that they are being recorded and given a legitimate reason why it is happening. Ideally, this should be clearly stated in your business’ guidelines and policy on the use of videoconferencing. Rules should also be developed around when employees can or cannot record calls themselves, seeking consent for recording and who that recording can be shared with.
How can I protect staff working on their own devices?
You need to be sure that effective controls are in place to protect employees’ access to online intranets and work files. Discuss these with your IT provider and ensure home-based systems are sufficiently secure.
Employees also are responsible for making sure nobody else in the household has access to sensitive files – on paper or on electronic devices. It’s good practice to keep a written record of any papers, files or tech equipment taken home by employees as a precaution.
There is also a risk when remote working. Taking laptops to cafes or public places could put private information at risk if you are working on public WIFI or if your computer screen can be seen over your shoulder. Be mindful of working around people outside of your organisation not just family members.
Whether they are work or personal devices, employees should be logging out of computers at the end of the day, particularly if they are shared.
For more in-depth advice from the Reality HR team see our Homeworking Toolkit.