The Association of
Adult and Child Online Safety Specialists

The coronavirus pandemic has prompted organisations such as charities, community groups and businesses to deliver their services online. This can include live online interaction with service users including children, young people or vulnerable adults.

We know this is a challenging time for many organisations and you’ll be keen to ensure that you can continue delivering your vital services.  It’s amazing that we can harness technology to provide continuity of service to those who need it most.  However, it is vitally important to ensure that children, vulnerable users and your staff and volunteers are protected online.

So, what’s the issue?   It’s about recognising potential risk, and making informed decisions about how to mitigate or manage that risk.   Let me give you some examples to illustrate:

• A volunteer has an online 121 video meeting with a vulnerable adult, and witnesses a domestic abuse incident. The volunteer doesn’t know what to do and they’re upset.
• One of your employees uses a messaging app to keep in contact with a vulnerable child. The child’s parent later complains about the conduct of your employee on the app.  The parent says they didn’t know their child was underage for the app.  Your employee denies any wrongdoing.  Your organisation is unable to check the content of the messages because they were encrypted.
• You have a staff meeting on a video conferencing platform. One member of staff is not dressed appropriately.  The meeting is automatically recorded by the platform.  Staff share confidential case documents in the chat window of the platform.  You don’t know if any of this information is stored securely.
• You choose a video conferencing platform because it’s popular and easy to use. It’s urgent to get online now so the service is rolled out quickly, and supposedly temporarily.  A year later, you’re still using this platform but now a service user complains they’ve been refused insurance because information about their engagement with your service was sold by the platform to their insurance company.   They say you’ve breached your duty of care by assuming they consented to use the platform when they accepted your meeting invitation.  It turns out that the platform’s terms and conditions state it’s for personal use only.  Are you liable?
• And finally – You have equipped a vulnerable adult with a device so they can engage with your service online. The adult is addicted to gambling and start using the device to gamble online.

These are just some examples of the risks that your organisation, members of staff, volunteers and service users can face online.   So as a first step, you must ensure that you’ve completed a risk assessment, considering both safeguarding and data protection.  This isn’t the time to be experimenting.  The decisions you make now may well form the basis of future service delivery so it’s important to get it right and not put service users or staff at risk.  In your risk assessment, highlight the main challenges and ensure that you are mitigating them as far as possible – for example if you are a provider of services to vulnerable young people and you need to continue to engage with them on a 1:1 basis digitally you will need to ensure that you apply a high level of protection to the young people and your staff.

AACOSS is the Association of Adult and Child Online Safety Specialists.  We’ve put together a short list of things to think about, to ensure that you are keeping your service users, staff and volunteers safe online at this time.  Going forward you’ll want to develop your approach but these are the immediate areas that we think you may want to consider.  All members of AACOSS have individual specialisations and we’re available for questions and support during these uncertain times, you can contact us individually via the AACOSS website.

So what are some of the main risks? Generally the risks of harm can fall into 3 categories:

• Content – firstly we’ve got content – this can be content that can be viewed that is age inappropriate, violent or sexual in nature
• Contact – then we’ve got contact – this can be either peer to peer or adult to child and can involve bullying or grooming
• Conduct – finally there’s conduct – this can be individuals sharing inappropriate content or misusing your platform

The level of harm that a user can experience by engaging with you online will vary depending on the type of service that you are offering, how you engage, their own background, abilities and experience. This all needs to be considered when you are planning your approach so I’d like to give you 9 things to include in your risk assessment:

1. Policies – Your organisation will already have a duty of care and obligations in relation to child or adult protection and you need to update your safeguarding policy in response to the pandemic. You may be able to get an updated policy from your professional body or your network. In addition you should ensure that your code of conduct for staff, including volunteers is updated to reflect appropriate behaviour online.
2. Connectivity and digital skills – consider the extent to which service users without wi-fi or devices will be disadvantaged. Not everyone is able to afford the required technology and even if they do, this may be a shared device. Equally some service users will have no broadband at all and might be constrained by their mobile data plan. Service users or their carers may not have the digital skills needed to access your service, or they may not appreciate some of the risks of being online, so consider how you can help to upskill them.
3. Data and privacy – Staff, volunteer and service users’ data must be held safely and securely according to data protection legislation. For example, is data being held on a personal computer or device, or in the cloud, and who else has access to it?
4. Platform – When deciding on which platform to use, you may be focusing on which ones are most popular with your service users, weighing up the costs or looking for something that’s easy to use. We would ask you to start with thinking about the safeguarding risks.  Your umbrella body or professional network may recommend a platform that has already been risk-assessed and you may have access to this already. You also need to think about the age restrictions as some of the apps and platforms you will want to use may not be appropriate.  We don’t recommend using the free social media apps like Houseparty, Facebook and the personal version of WhatsApp for a variety of reasons such as age restrictions, data protection, personal information harvesting or because the terms say it can only be used for personal use.  You may decide to ignore these issues, but consider the risks – not only in terms of child protection, but also your reputational risk.  And would your insurance apply if you’ve used a platform against its terms?

   Whichever platform you choose, ensure it has robust privacy settings to protect private conversations.  Don’t share details such as the meeting password on social media, where possible send passwords by secondary means such as text message rather than an additional email. Can staff and volunteers set up a professional profile on the platform and keep it separate to their personal use?  Think about equality of access – what do you do if staff, volunteers, service users or carers do not give their consent to use that platform? Practice on the platform and make sure staff and volunteers familiarise themselves with it before they start using it.

5. 121 conversations – Additional safeguarding measures should be put in place if you plan for 121 online conversation with a service user. You should have a clear audit trail just in case something goes wrong. Clear consent from all participants must be received before allowing phone or video calls to be recorded. Participants should be made aware of the purpose of recording the conversation, how it will be handled, stored, who will have access and when it will be deleted or removed.
6. Involving parents and carers – If you are working with children and young people, it’s a good idea to gain parental consent unless this will put them at increased risk. You will want to consider contacting parents/carers first to gain their consent about any contact with their child and you should ensure that you have a record of this.
7. Reporting and recording incidents – As mentioned in point 1, you should update your policy to reflect your revised arrangements but you should also ensure that all staff and volunteers know where to record concerns and how to escalate them if they are delivering their service online. It may also be necessary to involve third parties like police or social care depending on the incident.
8. Support for children and young people – If you’re working with children and young people make sure that you set up an appropriate reporting mechanism, for example a dedicated email address – give clear parameters for what should be reported.
9. Support for staff and volunteers – Where possible offer staff and volunteers the opportunity for a debrief so that any challenges can be managed and you can improve things where possible and offer specific support where required.

And finally, remember that some service users may not engage, some people may be coping with illness, bereavement or struggles to get food or money.  What options can you give to enable them to access your services at a time or in a way that is most convenient to them?

Summary

We can’t possibly hope to cover everything and every situation but hope that the pointers given in this video give a little clarity to the things you need to be thinking about, even if that clarity is that all of this is too difficult and there’s no way you can do it with the complete assurance that every safeguarding and data protection angle has been covered. But also remember that there needs to be a degree of flexibility and pragmatism – and that’s where your risk assessment comes in.