Four risks to data privacy and governance amid Covid-19

Individual risk

The way consumers operate technology has changed dramatically since the UK has been in lockdown. More than ever before, people are relying on their home broadband and even home computers for remote working, banking, communication – often using sensitive sites.

Employees using home broadband, as opposed safer office networks, open them – and in turn companies – to the risk of hackers exploiting those less robust home broadband connections and taking advantage of workplace disruption. Not only this, but there is increased adoption and deployment of cloud by organisations so that employees can access the computing infrastructures, platforms and services they need.

Companies need to ensure that their cloud storage is secure and meets necessary regulations to protect the company itself and the data in question. Responsibility also sits with employees, who should consult their IT policy to understand what they can and can’t do. When an organisation’s policy is unclear, the role of IT needs to be elevated to ensure that employees aren’t left to make their own decisions about software and security without the right support and guidance.

Compliance and regulation risk

Usually, physical hardware space is kept in the office. But with lockdown set to continue and increased use of the cloud, compliance and regulation risk comes into question, playing on the minds of the organisations affected. Companies need to be aware of local legislation that applies to them and advise their employees accordingly.

Employees should also be thinking about whether or not they are playing by the rules. Is the way I work from home and the way I access data compliant with all necessary legislation outside of the office?

All companies will have some employees using the cloud to access data they are handling. Take human resource teams, for example – are they correctly moving data within the current European Union (EU) laws and are they compliant with data regulation and compliance initiatives? The main thing here is that employees need clarity from their employer on how they should be working in their home office environment.

Physical risk

Being away from secure office locations also opens up myriad physical risks to consider. Virtual assistant artificial intelligence (AI) technology devices, routers, smart kettles, and other internet of things (IoT) technology in the home could be a data protection nightmare for any business.

As an example, people working in the legal profession in Ireland have been told not to conduct work-related calls when near virtual assistant AI technology devices, for fear of privacy and data breaches as a result of devices recording information.

Another risk to consider when working from home is who is around you. While employees trust their family members, data handled must remain confidential. Firms need to be sure employees are working in a secure and confidential way that protects the data they are handling.

Human rights risks

There are a couple of elements to consider when it comes to human rights in this context. First, looking at employee rights. Many organisations have started paying closer attention to employees’ working habits as they try to balance working with schooling and caring responsibilities.

Access to this type of technology and data on employees results in a potential infringement of human rights as people’s whereabouts could potentially be tracked 24 hours a day. Some businesses may in turn unintentionally use this data for other means, for example monitoring productivity levels throughout the day, potentially encroaching on employee privacy.  

Second, technology has made it possible for people to be monitored all the time. The epidemic we are facing could go on to mark an important point in the history of surveillance in the UK. There is talk of mobile phone companies tracking individuals’ locations and using this information to track infected patients and those around them.

The real questions to consider are: How long would this data-sharing last for? Does this violate human rights to some degree? Could it be used for tax or visa purposes later down the line? It is likely opt-outs will be implemented when developing the monitoring tools and how they will work – transparency will be of the essence to ensure no one is compromised.

When considering some of these questions, it is important to note that legislation would need to be changed and this could have serious long-term implications. Certainly, there is a short-term critical need for healthcare and physical safety of individuals, but how far should it go? The concern for some is that major changes to legislation and tracking now could end up eroding individual rights in the long term and putting the UK back years when it comes to people’s rights. Legislation and time limits will need to be considered.

Final thoughts

Organisations would be well-advised to drill down on what risks to data privacy and governance come into play for them, as we all adapt to this new way of working. It is not just about the short-term risk, but also the long-term impact to the business.

To navigate data privacy and governance risk at this uncertain time, companies must act quickly and decisively, and keep up-to-date with data protection legislation, so that they can apply it to the new circumstances and overcome the immediate threat to secure their future once the storm passes.

Pragasen Morgan is partner and privacy leader at EY UK&I. Paul Smith is associate partner in risk advisory at EY UK&I.