Yearly Archives: 2020

Alongside all the other practical challenges of the easing of lockdown restrictions is the question of what additional requests organisations may need to make of their employees to provide a safe working environment.  This may include asking employees if they are experiencing any COVID-19 symptoms, requiring them to undergo testing in certain circumstances, and requiring them to provide for details of other employees, clients and suppliers with whom they may have been in contact. Requests such as these will necessarily involve processing personal data and employees will perfectly reasonably want to be reassured that the protections and requirements of the GDPR and Data Protection Act 2018 are being observed.It is therefore timely that the ICO has issued a 6 step guide to employers on these issues, as part of a toolkit of advice to businesses dealing with data protection during the Coronavirus lockdown.In brief, the 6 steps are:1.  Only collect and use what personal data is necessary;2.  Keep it to a minimum;3.  Be clear, open and honest with staff about their data4.  Treat people fairly, to avoid discrimination;5.  Keep people’s information secure; and6.  Staff must be able to exercise their information rights.While much of this may seem like a statement of the obvious, it is exactly these basic messages that need to be restated and reinforced at a time when a disorganised unlocking of lockdown can result in serious harm to individuals if sensitive health data is treated in a cavalier fashion.  The ICO has behaved exactly as we should wish a responsible regulator to behave: no scaremongering, no heavy handed application of rules or guidance, just reassuring common sense advice and policies that should not cause any difficulty to any business.

Babylon Health is one of the largest and most successful players in the rapidly growing telemedicine sector, having secured funding last year to expand into the US and across Asia. However, they are now under scrutiny after their GP video appointment app suffered a data breach. The breach has resulted in video recordings of some patients’ consultations with doctors being accessible by other patients. One user noticed this and immediately alerted Babylon Health of this issue.Although Babylon Health has said that only a small number of users could see other users’ consultations, the full extent of the data breach will only be known after there has been a complete investigation. The severity of a data breach does not only depend on the volume but also on the categories of data that have been compromised. In this case, it relates to patient information including data relating to health, which is treated as sensitive by the GDPR and the Data Protection Act and hence requires a higher degree of protection. One would therefore expect that Babylon Health has implemented enhanced security measures for the provision of their services. Instead, the breach, which resulted from a software error as opposed to a malicious cyber-attack, demonstrates that this may not be the case which is all the more worrying.Babylon Health’s quick response might plead in their favour, but they are nonetheless at risk of a significant fine issued against them by the ICO, given the sensitive nature of the personal data that has been compromised. If it turns out however to be a minor breach, there is still reputational damage as some users will now be reluctant to use Babylon Health’s GP video appointment app, as is highlighted in the article.