Insights
Estonia
Blog
Law firm that takes care of its clients

Five recommendations for the employer on how to organise teleworking

Taking into account a significant impact from the coronavirus (Covid-19) – large-scale transition to working from home – we have put together recommendations for the employer on what to do in the ongoing emergency situation in order to ensure effective, secure and lawful teleworking. Put briefly, the applicable laws and regulations, including applicable data protection rules, require employers to adopt a set of internal rules that would ensure compliance with the requirements established by the employer, effective continuation of work and the employer’s right to verify whether work is being performed.

 width=

Adopt a clear set of rules on when the employee must provide health information to the employer

The first question pertains to when the employee should be asked to telework. In today’s crisis, it’s the coronavirus that is forcing employees to work from home. However, asking people to work from home is not a suitable solution for all employers. If the employer also has need for employees at the place of work, the employer must assess whether to send the employee home or allow them to work. In making that assessment, the employer’s use of employee health data is inevitable. Data protection law imposes numerous requirements on how and under what circumstances can the employee be asked to provide their health data. You can read more about it here. In addition to asking about the employee’s health, it might also be necessary to enquire about the employee’s travel information and collect information regarding their family’s health. Furthermore, in case of on-location work, it might even be necessary to take the employee’s temperature, carry out tests or use the organisation’s cameras to oversee compliance with the “no handshakes policy”.

Regardless of the legal basis for the employer’s request for health information, it must be clarified as to when the employee is required to submit information about their state of health to the employer. The most pertinent solution is to impose a requirement to notify one’s direct supervisor when the employee shows symptoms of an illness, a person close to the employee exhibits symptoms, or the employee has come into contact with a person showing symptoms in Estonia or abroad. In the rules, it is relevant to reference the Health Board’s website, which lists the symptoms of the illness and mandatory rules of conduct.

It is important to inform the employees about the employer’s subsequent use of the collected health data.

 data-lazy-src=

Establish a teleworking procedure for the employees.

The following is an example list of aspects that the employer should cover in the company’s teleworking procedure:

  • Is the employee obligated to telework at a specific location/in a specific room?
  • Is the employee obligated to inform the employer of their teleworking location? The aforementioned information could be important to the employer for reasons of cybersecurity;
  • Is the employee only allowed to use devices provided by the employer, or is the use of personal devices also permitted?
  • Is the employee permitted to use an open internet connection for processing work-related information, or are they obligated to use a virtual private network (VPN)?
  • Does the information exchange between the employee’s location and the employer’s server have to be encrypted?
  • What are the cyber hygiene requirements applicable to teleworking? If the employer has established an information security policy and other relevant policies, employees should be reminded of such policies (the Wi-Fi connection used for teleworking, automatic screen-lock of the computer, storing paper documents at the teleworking location, prohibition of storing electronic documents on the device).
  • How is the employee’s occupational health and safety ensured (minimum mandatory working requirements)? data-lazy-src=

 data-lazy-src=

If you have any legal questions pertaining to the emergency situation brought on by the coronavirus COVID-19, or you need assistance with drawing up the rules described in our recommendations, carrying out an assessment of legitimate interests or a data protection impact assessment, do not hesitate to contact us!