This page was last updated on 25 June 2020.
The following is a Q&A for employers, individuals and employees on guidance regarding the easing of lockdown and the return to work.
Return to the Office
Cyber
What data issues should I be cognizant of as teams return to office working?
Businesses have made efforts to secure home workers, but it is no secret that exceptions have been made; organisations have quite rightly relaxed corporate restrictions around things such as the use of personal IT, and the movement of corporate data, recognising that exceptions to policies are preferable to a paralysed workforce. The clearest example of the consequences of this necessary relaxing of controls will be found in the spread of confidential data, and businesses will now need to agree how this data is brought back onto corporate systems.
It is inevitable that data will have spread beyond corporate remits. Personal email accounts, file sharing applications and even instant messaging clients are likely to have been used. This presents two challenges; firstly, repatriating data - getting this data back under corporate control as the return to work progresses, and secondly dealing with the issues this data may bring back in the form of malicious code in files.
What should we be doing to facilitate this move of data back to internal systems?
For staff that have not taken the opportunity to migrate data back proactively prior to a return to the office, organisations may well find their users unable to access materials that were generated outside of the corporate perimeter while working from home. Organisations may need to consider amnesty periods; timeboxed periods where platforms typically blocked within the organisation are opened to allow the retrieval of data to work devices.
Careful messaging will be needed around this activity; if restrictions are going to be restored in the future, staff need to be alerted to the time the access will be available, and the reasons for this temporary permission to access sites that are typically blocked for data protection purposes. Staff must be made aware; this temporary access is a period for data retrieval, not permission to maintain data on external systems.
Beyond our anti-virus software, what steps should we take to protect the business against this potential threat?
Businesses need to be ready for a potential increase in security incidents. All potential controls should be in place to protect user endpoints as well as any data flowing in via web connections, but it is likely that some malicious documents and files will still arrive; anti-virus software is not a panacea. Teams will need to be ready to deal with malware outbreaks as staff return, and organisations may wish to factor this into their resourcing plans, particularly where some staff may have been furloughed.
Factoring in both the likelihood of malware incidents and support calls, IT and cyber security teams need to ensure teams are ready and staffed to deal with these first weeks post-distancing. Businesses that adjusted team numbers to account for drops in support calls during the distancing will need to review resourcing carefully ahead of the return to offices if quality of service and appropriate levels of security are to be maintained.
Are there any long term cyber considerations for mixed home and remote working?
The COVID-19 pandemic brought around huge changes in the way we work, and potentially will work for the future. Many organisations are looking to return to normal, but questions remain about what a 'new normal' will look like.
The opportunity for remote and flexible working, as well as a new way of delivering services is now more viable than ever. We recommend that organisations challenge the return to the old normal and embrace new strategies.
Remotely managing cyber security incidents, collecting forensic information at a distance and managing cyber security risks have all continued during the crisis and should continue afterwards. Teams are likely to maintain a level of home working, which means the challenges of home working may persist.
Data
What are business owners' duties towards data collection?
The Government's announcement on 23 June of the easing of lockdown restrictions confirmed that, from 4 July, pubs, restaurants and hairdressers in England will be able to reopen, providing they adhere to COVID Secure guidelines.
The guidance issued on the same day says "We will work with industry and relevant bodies to design this system in line with data protection legislation, and set out details shortly". This, however, leaves very little time – little more than a week – for businesses to receive these details and make preparations.
This is potentially a tremendous challenge, both practically, and legally, for a sector which relies, in very large part, on "passing trade". Although Johnson's speech went on to say that the Government "will work with the sector to make this manageable", we anticipate that many business will be unused to, and unprepared for, collecting personal data (and this will potentially be very sensitive data) in this way. Although we also anticipate a degree of regulatory forbearance (as we have previously noted, the Information Commissioner has generally been taking a lenient approach to companies' data protection compliance during the pandemic) businesses emerging from drastic shutdown measures will keen to be exposed to as little legal, regulatory or reputational risk as possible. Already, some civil society groups are warning of a "privacy minefield", and it is quite likely that complaints and claims against non-compliant businesses could follow.
In order to encourage their customers to provide accurate information, businesses will need to make sure they do their best to build up a level of trust. Ensuring that customers are told clearly and in simple terms why their data is being collected, what the business plans to do with it, and then only doing that, is key to good data protection practice.
Return to School
Which children are able to go back to school?
Whilst many schools have remained open throughout the lockdown for vulnerable children and children of key workers, from 1 June children in Reception, Year 1 and Year 6 were permitted to return. Pupils in Years 10 and 12 have been allowed back to school for some face-to-face support from 15 June, to help them prepare for exams. The Government has further confirmed that, where schools have capacity, they may welcome more children back, in group sizes of no more than 15, before the summer holidays. It will be up to individual schools to decide which additional children to invite back.
Can parents decide to keep children at home?
Yes. The Government "strongly encourages" eligible children to return to school when they are able to do so, unless they are self-isolating or shielding, but it is not compulsory. Parents will not be fined for children not returning to school, even if they are able to do so – although this could change, particularly once the school summer holidays have ended
What happens if parents cannot agree whether a child should return to school?
Such differences of opinion may not only be between separated parents but also with parents living together. However even where children spend the majority of their time with one parent, that parent should discuss important matters in relation to their upbringing with the other parent. In the current circumstances a return to school may well be considered one such matter.
If at all possible, parents should in the first instance discuss their concerns directly to try and agree, or explore whether alternative arrangements can be made. For example, if one of the concerns is about the child travelling on public transport, solutions could be developed to help make the concerned parent feel more at ease, such as the other parent picking the child up and driving them for the time being. If there are issues around the safety measures the school has put in place, then these should be discussed with the school, involving both parents. It may also be the case that children can return to school and then be withdrawn if parents are concerned about the safeguarding measures in place.
There may be particular considerations for some parents, such as siblings who will not be returning to school, or households where there may be adults or children with underlying health conditions which put them at greater risk. Balanced against that will doubtless be factors such as the impact of missing school on the child's education and socialising with their peers, as well as their mental well-being.
If parents do not feel able to have these discussions directly, or need the assistance of a third party, then a mediator can assist in facilitating the conversation and exploring different options.
However ultimately, if parents are unable to agree then an application can be made to the court for a Specific Issue Order (which is an order to determine a specific question which has arisen or may arise in connection with any aspect of parental responsibility for a child), or a Prohibited Steps Order (which prevents someone from exercising their parental responsibility in respect of the disputed matter). Which application is appropriate will depend upon whether the parent wishes for the child to return to school in the face of opposition from the other parent, or is seeking to prevent the child from returning to school. In respect of both orders, the child's welfare will be the court's paramount consideration. Factors which will be taken into consideration in determining the outcome include the child's physical and emotional need, but also, importantly in such cases, their educational needs.
Clearly, court proceedings should always be a last resort, and the outcome will depend upon the particular facts of each case. Applications can be made on an urgent basis, although it will be up to the individual judge to decide whether a case is suitable to be heard remotely.
Arrangements between separated couples
My ex and I have a child but are separated. Can our child move between us?
The Government's guidance published in March stated that, as an exception to the COVID-19 restrictions, children with separated parents are permitted to move between both households. This position has been maintained as restrictions have been relaxed.
From 13 June, it has been possible to form a "support bubble" with one other household if a parent lives alone or with dependent children. All members of the support bubble are permitted to act as if they live in the same household. If a child's parents are separated, they do not have to form a support bubble in order for the child to spend time indoors in each household. Even if each parent forms a support bubble with a third party, the child can move between both households.
If anyone in either household is showing any of the symptoms of COVID-19, then the Government guidance must be followed – the person who has symptoms must stay at home for 7 days and all members of their household must stay at home for 14 days. If the parents are both in separate support bubbles, all households would need to isolate if anyone in the group becomes symptomatic.
Practical arrangements may need to change. If you usually collect your children from their school and they have not yet returned to school, you may need to collect them from the other parent's home instead. Parents will need to work together insofar as is possible to ensure that children can still see both of their parents during this time. You should avoid using public transport to facilitate children's travel from one home to another unless absolutely necessary.