At 11.59 p.m. on Wednesday 25 March 2020, New Zealand moved to Level 4 on the COVID-19 alert system.

For many people in New Zealand, this means that – where they can – they will be working from home for the foreseeable future. While for many people it may already be something with which they are comfortable, for others the challenges of setting up and working from the ‘home office’ for the next four weeks may be somewhat daunting.

Not surprisingly, the Privacy Act 1993 does not expressly contemplate how personal information is to be dealt with in the context of working from home.

The usual Information Privacy Principles (IPPs) set out in the Privacy Act will apply. In particular, IPP 5 requires an agency that holds personal information to ensure that the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against:

• loss;
• access, use, modification, or disclosure, except with the authority of the agency that holds the information; and
• other misuse.

But we are operating in uncharted territory, so what security safeguards is it actually ‘reasonable in the circumstances to take’ in the working from home environment?

If you have shifted your workforce home, you are probably also wondering:

• What technical steps should I be taking to protect personal information in the possession of my employees?
• What practical steps should I be requiring my employees to take in order to protect personal information they hold?
• Have I left it too late to put protection mechanisms in place?
• What should I do if my business experiences a privacy breach?

In a recent article published by CIO magazine, privacy experts Campbell Featherstone and Hayley Miller address the privacy law implications of working from home, and set out some practical tips to help employers and employees ensure that they mitigate the risk of exacerbating an already difficult situation.

Click to read the full article.