Our lawyers Mag. Melanie Gassler-Tischlinger and Dr. Georg Huber, LL.M., CIPP/E, were interviewed by the magazine “netzwerk tirol” about what has to be considered from a legal point of view in corona times for external and internal crisis communication.
Conference calls, online meetings, emails: Communication in times of crisis
Melanie Gassler-Tischlinger and Georg Huber are attorneys at law at the Innsbruck law firm Greiter Pegger Kofler & Partner. netzwerk tirol held a discussion with them on the question of what should be considered from a legal point of view in corona times for the communication of companies to the outside world, but also with employees.
Has communication in companies changed due to the Corona crisis?
This question can be answered clearly with yes. In many companies, employees work from home. Personal face-to-face meetings hardly ever take place anymore. As a result, companies are increasingly resorting to other options, in particular video conferences, webinars, but also electronic communication to promote online shops.
Particularly people with health risks are no longer allowed to come to work. Is an employer allowed to unilaterally order such persons to work via home office?
In principle, home office must be agreed. It is unproblematic if the employment contract already contains a corresponding provision. If it is agreed that the employee can also be transferred to other places, e.g. to his place of residence, a unilateral order is usually possible.
In view of the developments in recent weeks, one could certainly also argue that employees who are fit for work can be obliged to use a home office simply because of their duty of loyalty, provided that this is possible and reasonable.
In some cases, employees in home office use their private smartphones and computers for work (“Bring-Your-Own-Device” – BYOD). In this case, we recommend that agreements be concluded on the operational use of these devices.
Back to the topic of video conferencing. There is a boom here, but is it all legal?
Despite Corona, the use of services for video and online conferences or webinars, such as Zoom, Skype or GoToMeeting, must comply with the provisions of the General Data Protection Regulation (GDPR). This should be taken into consideration when choosing a “conference tool”. Personal data is processed in the course of such conferences.
The basic rule is: if the functionality is the same, you should rather prefer service providers based in the EU and choose those services that provide privacy-friendly settings. The latter include, for example, encryption and no profiling of the conference topics. Furthermore, it should only be possible to record the meeting with the consent of the participants.
In the case of service providers outside the EU, the data protection level according to GDPR must be respected. Providers from the USA should be certified under the Privacy Shield, for example (this is the case with the large providers such as Skype, Zoom, Microsoft Teams etc.).
As service providers are usually processors within the meaning of GDPR, it is imperative that a controller-processor contract be concluded with them. Most providers provide for the conclusion of such agreements in the course of registration. Strictly speaking, it is also necessary to check the information provided by service providers on their technical and organisational measures (e.g. pseudonymisation, etc.) and their subcontractors. This is rather difficult in practice.
Once you have decided on a tool, you should consider each time you use it whether you really need the respective functions and whether there are not more data protection-friendly ways of achieving the intended purpose. Is it necessary to record the entire conference? Or could one simply record the most important information for later retrieval?
Of course, the information and documentation requirements of GDPR apply, as well. Participants must be informed in particular about the purpose, nature and extent of the processing of their personal data. Here it is advisable to supplement this information in the regular data protection declaration and to refer to it via a link in the invitations to an online meeting.
Are there any special regulations in employment law on the subject of online meetings?
If there is a works council in the company, the choice of service should be agreed with the works council.
The use of such tools becomes critical when they are used to monitor employees. Video surveillance at the workplace, control of home office with monitoring software and other measures can affect or even violate personal rights and consequently the human dignity of the employee.
Measures that affect human dignity require the consent of the employee.back