- 18 January 2023
- Privacy and Data Protection
In recent years, there has been a very significant movement from office-based to remote working, driven initially by the increasing attraction as an employee retention tool of flexible working and, of course, accelerated in a truly unforeseeable way by the COVID-19 pandemic. Even though no longer subject to legal constraints on movement and where work can be carried out, many businesses have continued using a distributed workforce, and, for a sizeable number, remote working is now the norm rather than the exception.
Remote working, with its advantages, also carries risks, a significant one being cybersecurity and, in particular, data protection compliance. The fact that a data breach takes place away from office premises when an employee is working in an internet café, in their house or wherever will not in any way relieve their employer – be they a data controller or a data processor – from the significant financial and reputational repercussions of that breach.
So, what should organisations do to reduce the cybersecurity and data protection risks of home working to the same (well, hopefully, in a well-run business) low level as with office-based working? These are some areas to consider:-
First and foremost, businesses must ensure all relevant policies are up-to-date and reflect changes in working practices – for example cybersecurity and confidential information policies – and that these are reviewed and revised frequently.
However, there is no point in having state of the art policies unless employees are aware of and follow these, and the key to this is, of course, regular employee training. For the Information Commissioner’s Office (ICO), this is a key employer obligation.
Systems and Equipment
Ideally, a corporate virtual private network (VPN) should be in place to prevent, to a high degree, unauthorised access to sensitive and confidential data and information. Through a VPN, employees’ connections from remote working locations to the organisation’s servers can be encrypted, allowing safe and secure network access. For obvious reasons, use of public Wifi without a VPN is very inadvisable and there are risks of unauthorised access even with home Wifi which are significantly reduced by use of a VPN.
It is not always economically feasible for an organisation to issue all its remote working employees with company-issued laptops but this is the safest solution. If employees are allowed to use their own devices, it is important that their own data and the organisation’s data are kept separate and that (through proper training) they understand the risks of inadvertently moving the organisation’s data into their personal storage, which is quite easily done when using a single device. Password security is particularly important when personal devices are being used and many employers use – wisely – multi-factor authentication (for example, having to add a passcode provided by text message after entering the password) for additional security.
Businesses must ensure all relevant policies are up-to-date and reflect changes in working practices, and that these are reviewed and revised frequently.
It is important that employees understand that working remotely will never be as secure as an office environment and adapt their behaviours accordingly. Much of this is common sense. A few key messages:-
- Don’t mix work and personal emails – because when this happens, the possibility of a security breach increases significantly. Recent high profile incidents (for example, Suella Braverman using personal email six times for work emails) emphasise the dangers of this!
- When at work, you are with work colleagues who are under confidentiality constraints. In another remote working location, even at home, you are not. Don’t drop your guard and keep a ‘work head’ on – so avoid discussing sensitive matters in earshot of others, be particularly careful with phone and video calls, don’t leave sensitive documents lying around on your printer or elsewhere and so on.
- Confidential waste is still confidential waste, even at home. It does not go out with your cardboard recycling! If you cannot have it destroyed properly and irretrievably, it needs to go back to the office for shredding.
Remote working is here to stay and, with correct planning and management and applying the above principles, associated cybersecurity and data protection risks can be reduced to typical business risks.
It is also recommended that organisations who have employees who work remotely consult the ICO guide on this issue.
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.
About this article
SubjectRemote working: How to stay Data Protection-Compliant
ExpertisePrivacy and Data Protection
Published18 January 2023
Read, listen and watch our latest insights
- 06 February 2023
Redundancy and settlement agreements – What you need to know
In this podcast Ciara Duggan and Sana Nahas members of the employment team at Clarkslegal will guide you through the tricky topic of redundancy and settlement agreements, covering what redundancy means for both employers and employees, as well as how settlement agreements work in practise.
- 30 January 2023
Deborah Scales comments on ‘the proposed Mental Health First Aid Bill’
In People Management, Deborah Scales, Associate at Clarkslegal, discusses the reasons why people professionals would likely welcome a change in set law as a “relatively swift and cost-effective” way to help the workplace.
- 25 January 2023
Government’s response to menopause recommendations in the workplace
The UK Government has recently rejected calls for the menopause to be made a ‘protected characteristic’ and for a large-scale pilot of menopause leave.
- 24 January 2023
Melanie Pimenta comments on ‘positive action’ and what it means for employers
In Personnel Today, Melanie Pimenta, Senior Solicitor at Clarkslegal, discusses ‘positive action’ and what it means for employers.
- 20 January 2023
Deborah Scales comments on employee who handed keys in and said ‘I’m done’ did not resign and was unfairly dismissed
In People Management magazine, Deborah Scales, Associate at Clarkslegal LLP, comments on a recent tribunal ruling in which a factory supervisor who handed in her keys in an “anxious state” and said “I’m done” did not resign and was unfairly dismissed.
- 13 January 2023
Key employment cases to look out for in 2023
Last year we witnessed various cases and important decisions affecting the employment legal landscape, including, Rodgers v Leeds Laser Cutting Limited (the first COVID-19-related unfair dismissal case to go to the Court of Appeal); Harpur Trust v Brazel (the Supreme Court case relating to holiday pay for part-time workers); and Tesco Stores Limited v USDAW and Ors (relating to firing and rehiring practices), to name a few.