More than Stayin’ Alive – Homeworking and Data Confidentiality

Many of our clients in the industrial, tech and biotech sectors have been able to adapt to life under lockdown. Some of them have managed to organize go-live events, others have put out training and townhall webinars. The agility shown has been impressive to observe. But that agility has not been without pain, as those on one form or another of reduced, or no-hours working will readily point out.

After the first month of lockdown, we wanted to draw your attention to a couple of business organization points that may not, understandably, have received the due care needed while your team was keeping your company alive. The two points are these:

• HR dimensions of homeworking
• Managing data confidentiality

Many companies have little or no reliable established data policy regarding the conditions in which their employees are currently working at home. For instance, does your company reimburse for data consumption on employee cell phones? Employment law, including health and safety, working time regulations, etc., continues to apply in the prevailing hybrid context of homeworking. It is a mistake to imagine that a laissez-faire attitude that ordinarily worked well for senior management pre-lockdown, will be sufficient when far broader categories of personnel are now homeworking.

We recommend to set up a system to cover at least the following:

• Brief team managers on working time obligations to ensure awareness, and alignment of management objectives to those obligations
• Draft, send and track receipt of a simple homeworking set of rules and good practices adapted to your company, and to each country in which you have employees. Send to each employee in the official language of their country, not just English.

We have identified two separate areas for review under the heading of data confidentiality. Firstly, confidentiality of personal data, which is subject in Europe to GDPR requirements. Then confidentiality of commercial, confidential data.

The homeworking setup puts a company’s data management processes under stress at the following points:

• Family members can see documents and hear discussions (telephone, on the family printer, Skype etc.) very easily.
• Data circulates outside Company-administered and secured data networks.
• The half-at-home, half-at-work working environment may lead to behavior that compromises office-grade security practices.

Concerning personal data, companies should remember that the GDPR and local legislation require data processors to respect principles of data integrity and data confidentiality. In a homeworking context, companies must be able to demonstrate they have taken actions that are reasonable and proportionate to the risk to personal data security. Again, this means setting the policy, then implementing it through written communication, training, helplines etc.

As regards confidentiality of commercial confidential data, the stress points and solutions are broadly comparable. Why not use the lockdown to send out a short webinar to employees on the subject? Companies should also consider reinforcing technical measures to compensate for homeworking, including the use of encrypted documents and emails, VPN servers, and the avoidance of communication solutions not judged to be sufficiently secure for confidential business purposes.

At a best guess, homeworking is here to stay for many months, while COVID-19 continues to impact our lives. Its popularity is on the rise as employees who were not ordinarily eligible for homeworking learn to adapt and enjoy measure its benefits. For this reason, companies must review and update current management processes to ensure they still respect their obligations to employees, and cover their commercial data risks correctly.