{"id":79967,"date":"2020-07-27T10:05:03","date_gmt":"2020-07-27T09:05:03","guid":{"rendered":"https:\/\/www.pbctoday.co.uk\/news\/?p=79967"},"modified":"2020-07-27T10:05:03","modified_gmt":"2020-07-27T09:05:03","slug":"data-privacy-construction","status":"publish","type":"post","link":"https:\/\/www.pbctoday.co.uk\/news\/planning-construction-news\/data-privacy-construction\/79967\/","title":{"rendered":"Keeping up with data laws in construction"},"content":{"rendered":"

Construction and building sites are often attractive targets for thieves but now, the industry also has to contend with cyber-crime and data breaches. Helen Davenport, Jocelyn Paulley and Michael O\u2019Shea of Gowling WLG<\/a> discuss how to avoid being an easy target<\/h2>\n

Many people may not consider construction to be a high-risk target for cyber attacks and data theft compared with other industries, which may cause companies to be laidback when it comes to security, ultimately making them easy pickings for cyber criminals.<\/p>\n

Cybercrime has become increasingly sophisticated over the years and the threat is often difficult to predict. It is paramount that companies invest more in their security measures<\/a>, not only for defending against breaches but for also spotting when they are happening.<\/p>\n

The consequences of lack of good security and vigilance should not be underestimated. It could affect the business\u2019s reputation if a breach is made public, cause financial losses and ruin profit margins, risk confidential or commercially sensitive information\/assets being made public and also affect the lives of employees. Organisations that fail to comply with data privacy laws risk being fined by the data privacy regulator, the ICO<\/a>, up to a maximum of \u20ac20m or 4% of global turnover, whichever is the greater.<\/p>\n

Now, more than ever before, firms are relying on digital systems and infrastructure to allow organisations to continue to function. Over the course of the pandemic and lockdown, many employers and employees have had to abruptly get to terms with working from home. For some, that has been a new experience and for others, at least, a significant change in working pattern. For many employees, and employers, the right infrastructure and measures might not be in place or if they are, they may not have been properly tested. Further, when working from home, away from other colleagues and the workplace environment, and perhaps distracted by children or other family members, people may be less vigilant and, for example, may click on a link they would have thought twice about in the office.<\/p>\n

Cyber criminals do not care and the National Cyber Security Centre<\/a> has observed a surge in Covid-19 related scams and attacks. We have seen further examples of firms and suppliers suffering breaches (some of which were accidentally caused by staff), which illustrates the<\/p>\n

need for organisations to have appropriate technical and organisational measures to ensure personal data is processed securely<\/a>.<\/p>\n

Organisations also have to remain vigilant and make sure employees do not let their guard down because they may be working remotely. To help mitigate against the risks, companies should review their cyber security procedures and consider if additional measures should be introduced. These steps should be a top priority for firms that deal with high levels of sensitive data, which construction firms may well often do.<\/p>\n

As a consequence of the lockdown, many construction companies will have had to work with new suppliers to ensure that materials and demand is met \u2013 this can also open up cyber security risks. It is important to have the right approach to suppliers and partners who you share personal data and other business data with as it could be hacked through their systems. Changes in business partners can also make phishing and other cyberattacks harder to detect.<\/p>\n

Data protection for employees returning to work<\/h3>\n

As well as managing the risk of a potential increase in cyber-attacks, construction firms have to contend with ensuring that they are complying with data protection<\/a> laws when processing employee data. With the government gradually starting to ease lockdown restrictions and giving the green light for different types of businesses to return to work, employers will have obligations to ensure the health and safety of employees while at work, which may include collecting extra personal data, but they have to do this in a way that complies with data protection laws.<\/p>\n

For some organisations, it may be appropriate to collect more personal data, such as information for track and trace, as one way to maintain the health of the workforce. This means that any internal Covid-19 risk assessments and plans must comply with the requirements under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.<\/p>\n

Organisations should think about implementing the following measures if new personal data, particularly health data, will be collected as part of creating a safe work environment when employees return:<\/p>\n