Summary

As the Covid-19 Pandemic forces more employees than ever before to work from home (“WFH”), businesses face new and different data privacy and security risks. This change is not lost on U.S. regulators, but it does not mean that businesses will get a pass on data privacy and security issues potentially caused by the shift in working conditions. In an effort to help businesses navigate these new circumstances, BCLP has prepared a series of articles on addressing data privacy and security issues in a WFH environment.

If your business regularly handles sensitive hardcopy data in the office[1], chances are that your employees working from home now have to continue handling sensitive data outside the safety of your office environment. This poses many challenges but, with some forethought, many businesses will likely find that they can continue most operations without sacrificing security.

• Consider the files. Before allowing employees to take home sensitive hardcopy data, ask yourself a few questions:
  1. Is this a file that the business can live without? While your company and employees will take steps to avoid losing the file, the reality is that once the file leaves the office, the chances of it being lost, destroyed, or stolen go up. Your company should carefully balance the needs of the business against the risk of harm the loss of the file might cause.
  2. Why is this sensitive information? Considering this will help a company better assess whether certain files should be taken home and what risks may be associated with the file leaving the office. For example, if the file is sensitive because it contains sensitive personal information, the risks related to the loss of the data are higher than the risk of destruction (presumably the data could be recreated from the subjects of the file).

• Some employees that require sensitive data may use public transport; if your company allows those employees to take sensitive files home with them, it may be worthwhile to pay for a taxi or rideshare to assist the employee in traveling to and from the office with the sensitive files in a quick and relatively lower risk manner. Also, caution employees that drive not to stop on the way home with the sensitive files in their vehicles. A briefcase or backpack might get stolen if the employee’s vehicle is left unattended for a period of time.
• In-home security. Employees need to realistically assess how securely they can store files at home. Does the employee live with multiple individuals? Does the employee have a locked or otherwise secured area to keep files when not in use? Are the files of a type that might hurt the company if they were destroyed? Those types of files may not be a good fit at home for an employee with several young children and no place to store the files.
• Minimizing data handling. Keep in mind that it may be a good idea to cut down on handling sensitive data for a period of time. Some tasks that require working with large quantities of sensitive data may be best delayed until the employee is able to access a secure area in the future.
• Secure destruction. Check out our article on securely destroying both physical and digital files for tips on how best to tackle the end-of-life cycle for sensitive data.

This article is part of a multi-part series published by BCLP to help companies understand and cope with data security and privacy issues impacted by the Covid-19 Pandemic.

1. Check out our article on handling sensitive electronic data as well:https://www.bclplaw.com/en-US/thought-leadership/work-from-home-cybersecurity-basics-handling-sensitive-electronic-data-united-states.html