After a year of working from home, employees across the UK are getting used to travelling into the office again. No longer is the morning commute a short trip from the bedroom to the kitchen table, home office or garden shed. We’re back in the office two or three days a week and many of us are commuting again on public transport.
Transport for London (TFL) has recently reported large weekly increases in passengers using its services at peak times, with up to a 17% increase on trains and 39% on buses. With busy buses and packed trains, and restrictions around home working easing, the risk of leaving work property like laptops or memory sticks under seats or sitting in stations is likely to increase.
Phil Parkinson, Head of Commercial Law at Blacks Solicitors has broken down everything employers need to know in the event an employee loses their work property on their commute to the office…
The risks
Documents and communication stored on business property such as laptops can contain sensitive information related to clients, patients, or employees, while a lost access card or key fob risks unauthorised access to your premises.
Property left unaccounted for can pose major data breach risks, increasing the chances of unauthorised persons having access to an organisation’s confidential information. Data breaches can lead to legal claims and reputational damage, but a variety of proven methods can reduce risks and ensure employees can work safely remotely.
As a minimum security measure, hardware like laptops and removable media such as memory sticks must be properly encrypted to minimise the level of risk in case of misplacement. This ensures that confidential information is inaccessible to an unauthorised individual who has access to any lost business property. However, some organisations may wish to consider cyber insurance to additionally bolster protection.
Cyber security
For any organisation, robust cyber security is vital to ensuring employees can access and work with sensitive data safely and risk free. But with mass remote working and hybrid office days more widespread than ever, security measures must account for business property held off site without the reliability of a secure office.
Moving to a cloud based system or utilising a VPN are common ways for organisations to provide safer off-site system access. It is useful to note that the Information Commissioner’s Office (ICO) published some insightful guidance on what organisations should take into account, which specifically examines issues related to rapidly adopting remote working systems.
Failing to establish suitable security for your organisation can not only result in significant fines from the ICO, but also expose responsible parties to direct claims from data subjects whose personal data has been compromised, and risk reputational damage.
Legal implications for employees
Depending on the circumstances, the employee could be subject to both criminal and civil proceedings as both individuals and organisations have responsibilities under data protection law. It is therefore imperative that employers ensure employees have undertaken the relevant training, both for new starters and annually thereafter, and have logs in place to evidence this.
Employers should ensure that they have appropriate policies in place which cover business property loss or data breach scenarios, and streamlined breach reporting procedures cascaded to all employees. Appropriate disciplinary action should also be included within employment contracts to enable employers to take appropriate action where work property is lost.
Summary
Despite the multiple benefits of remote and hybrid office working, the significant growth during the pandemic has exposed organisations to increased security risks, either from the potential of lost business property or improper data safety practices from employees logging in at home. Ensuring your hardware is properly encrypted, delivering appropriate and up-to-date safety training to employees, and establishing suitable cyber security measures can all reduce risks to your organisation and prepare employers as best as possible for the worst case scenario.
