Summary

As the Covid-19 Pandemic forces more employees than ever before to work from home (“WFH”), businesses face new and different data privacy and security risks. This change is not lost on U.S. regulators, but it does not mean that businesses will get a pass on data privacy and security issues potentially caused by the shift in working conditions. In an effort to help businesses navigate these new circumstances, BCLP has prepared a series of articles on addressing data privacy and security issues in a WFH environment.

Working from home increasingly blurs the lines between work and play, both physically and technically. Devices that were previously reserved for work-related excel spreadsheets and drafting corporate documents may now double as education platforms and entertainment centers as family members hop onto a computer to complete classes, play games, or connect through social networks. When family members have access to an employee’s work computer, the employee no longer has full control over what is uploaded and downloaded from the device. This can ultimately make the company more vulnerable to security incidents.

The Federal Trade Commission (“FTC”), in its advice regarding kids and computer security provides the following tips (many of which can be used for all individuals sharing a computer, regardless of age)^[1]:

• Have a family discussion about computer security. Among other things, employees should discuss:
  • Downloads. Kids should never download anything without parental permission. This applies to games, photographs, movies, music, etc. Show your kids what different types of download buttons look like (g., “Download Here” or “Click to access your free game!”). Before an adult downloads anything to the device, check the privacy policy and terms of use to figure out what information the download will have access to.
  • “Talking to strangers.” Phishing attempts are all too common and may arise in the form of questions from strange people or contacts requesting personal information. These requests can come through email, instant messaging, pop-up messages, or text messages. Especially with regards to phishing attempts, look for “teachable moments.” If you receive a phishing message, or see a scam, show it to your family members and explain how you recognized it as a scam.
  • Help family members create complex passwords that they can easily remember. Memory-tools such as songs or stories allow people to remember long passwords through association. Remind them not to use the same password for more than one online account.
• Secure your computer:
  • Parental Controls. Turn on parental controls to block outgoing content and filter out websites that frequently drop malicious tools. For more information about parental controls, see the FTC’s guidance on parental controls.^[2]
  • Anti-malware Protection. Download and install Anti-malware Protection software. Any time a user opens a file they’ve downloaded, the software will scan it and make sure the file is safe.
  • Activate settings that require a password before any software or application can be downloaded and do not provide your children with the password. Check the privacy policy and your privacy settings to see what information the app or software can access before going through with a download.
  • Separate User Accounts. Create separate accounts for each family member that uses a shared computer. The accounts of other family members should be separate from your work account. You should only conduct work through your work account. Both work and family accounts should be password protected. Only one administrator account should have full privileges; all other accounts should have limited permission and should only be able to access the user’s own files (not files associated with other accounts).

This article is part of a multi-part series published by BCLP to help companies understand and cope with data security and privacy issues impacted by the Covid-19 Pandemic.  You can find more information on specific data privacy and security issues in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

[1] https://www.consumer.ftc.gov/articles/0017-kids-and-computer-security

[2] https://www.consumer.ftc.gov/articles/0029-parental-controls