Workers using Zoom to attend virtual meetings while working from home could sue their employers if they object to how the web conference tool uses their personal information.
Zoom, which is now worth $40bn (£31bn), has risen from the pandemic as one of the hottest technology companies with millions around the world logging in to conduct both business and social meetings.
Employees who feel obliged to use the software, which shares personal data with other companies, may be entitled to a payout.
James Castro-Edwards, Partner at law firm Wedlake Bell LLP said: “There is a big risk an employee could ask for compensation.”
“If a workforce was forced to use Zoom to communicate and it transpired that personal data was going to places that they hadn’t agreed to they could claim they had been distressed.”
Last week it emerged that Zoom app notified Facebook when someone opens the app, providing their device model, their location and a unique identifier generated by the device, that companies could be used to target a person with advertisements, according to a Vice investigation.
Zoom's fine print does not mention Facebook, but that it shares data with "third parties". It removed the piece of code that allowed it to send information to the social network on Friday.
Can workers consent if they fear losing their jobs?
Workers could reasonably argue that this would leave them "distressed", which may entitle them to compensation, Castro-Edwards said.
It is a scenario that is already playing out for British Airways, which was hacked in 2018. Lawyers claim that those impacted can sue for "distress or inconvenience", with some firms claiming they could retrieve £5,000 in compensation for Britons whose details were stolen.
“With a big number of people that is an enormous sum”, Castro-Edwards said.
A Zoom spokesman said that it "takes its users’ privacy extremely seriously", however, "we were recently made aware that the Facebook SDK was collecting unnecessary device data".
Employers should also be wary of video conferencing tools that allow anyone on a stream to record the video and audio.
Rules for recording on Zoom
Castro Edwards said in the UK, employers must explain when someone is being recorded, and why, which is why call centres let you know if they are recording for training purposes.
Skype, another video tool, also allows participants to record. The legal grounds for consent are unclear because regulators have previously ruled that there is an imbalance between employees and employers since the latter may fear losing their job if they do not agree to share information or use certain software.
"This information may include personal data. Meeting hosts are responsible for notifying you if they are recording a meeting, and you will generally hear a notice or see an on-screen notification when recording is in progress."
Under European data protection law, which the UK remains beholden to, employees have a right to ask for all the data a company holds on them including emails, letters, instant messaging, CCTV film and Zoom data.
What about GDPR?
If video streaming tools that process employee data are investigated by European regulators, who are known for fundamentalist interpretation of the law and in depth probes, larger institutions that ask employees to use the tools may be at risk of investigation.
Rafi Azim-Khan, head of data privacy at Pillsbury Law, said that Zoom was a "neat service" but warned that use of recording and screen sharing features without a proper legal basis could open companies up to "serious risk of regulator fines or lawsuits".
He said: "If people are using a platform like this and working from home, you have to think about what is the nature of what they are recording: chit chat, daily gossip or work?"
"If it is work, it could be trade secrets or sensitive pricing information or employee discipline issues or even hospital patient data."
"You have to think about the nature of the content being captured and that could give rise to not just privacy law issues but breach of trade secrets, confidentiality and potential defamation."
An "obvious concern" is if confidential recordings end up somewhere outside of the workplace, he advised.
"If the employer had insisted that the employee used a system like this, or a school told teachers to use it and then there is some exposure of sensitive information, I can see some liability being foisted on the shoulders of the school or the company or the business."