¹ Over the weekend, some enterprising spammer bothered my inbox with a message to say that they were offering "virtual Christmas parties", and that perhaps decoded.legal might like to make a booking to "boost staff morale and increase employee engagement".

Personally, I can think of nothing worse, but I accept I'm a grumpy sod who would rather not spend an evening at home looking at the live stream equivalent of the multi-tiered opening to "The Muppet Show" while pretending to have Organised Fun. Humbug.

But it did get me pondering about some of the things you'll want to think about from a legal point of view if you are planning on inflicting a virtual Christmas party on your lucky employees.

The virtual Christmas party supplier contract

Has the supplier done this before?

Now, I may be doing lots of experienced "virtual party" planners a disservice. Perhaps virtual Christmas parties have been A Thing for ages now, and people have simply not invited me. I can't blame them.

But if they are something new, being offered by some enterprising people trying to fill a gap caused by the pandemic, it's plausible that some might be a bit beta.

Whether you're a fee-paying guinea pig or not, here are some top tips.

Be clear about what you are buying

If you are indeed that guinea pig, then there's a chance that your virtual Christmas party might not go as smoothly as you'd hope.

There's probably more to go wrong for a start, since it doesn't just rely on everyone turning up to the right place at roughly the right time, and eating whatever is put in front of them.

The main route to avoiding this is in the pre-contractual phase, getting recommendations for suppliers who've done this successfully before, or asking potential suppliers for feedback from satisfied customers.

But if you can't do that — or even if you can — make sure that what you are expecting to receive aligns with what the supplier is responsible for delivering, as set out in the contract. (You are planning on having a contract, right?)

What you need to cover off will, inevitably, depend on what you are buying, but some aspects to consider are:

• Are they providing the video conference platform, or are you?

  • If you need login information, when are they going to send it to you, so you can get it out to your staff partygoers?
  • If it requires specific software (is there really any excuse for this?), make sure you test it beforehand, and clear it with your IT and IT security people before you sign that contract.

• Goodness knows what the "entertainment" might be, but how much is down to you, and how much are they doing? What is on offer, for how long, and when does it start?

• Are they sorting out music (and so the licensing of it, for a virtual Christmas party), or do you need to find a DJ who is willing to do a virtual Christmas party?

• What about food (and, dare I say it, drink)? Does everyone get a voucher, or permission to incur expenses up to a certain amount, to order whatever food they want, or is your supplier going to coordinate the simultaneous, or else just before-the-event, delivery of refreshments to all invitees?

• Who is the named person who will be responsible for your event, and how can you contact them "out of band" (i.e. not using the party platform itself) before and during the party, if you need to discuss something?

Can you use payment terms as a safety net?

If this is a step into unchartered territory for them, can you agree a split payment, so that they get some money upfront, but the remainder only after successful delivery of the event?

Protecting yourself if it goes wrong

Most contracts will plan for the worst case scenario, and deal with what should happen if things go wrong.

What you'll want will depend on the risk. If you've got a split payment, and the deliverables are sufficiently clear that you will be able to tell without subjectivity whether the agreed deliverables were provided or not, then you might need nothing further.

If you've had to pay everything up front, you're probably looking for a refund, the quantum of which will depend on the severity of the breach. Again, being able to show clearly how the contract was breached will be important.

Also important will be ensuring that the supplier actually has the funds to pay out a refund. If they're a new company and are bust, whatever the contract might say, you're probably out of luck.

Of course, a party which goes catastrophically wrong could be more entertaining than the actual party you were planning and, since everyone is at home anyway, there's at least the fallback of just dropping off the call and doing whatever they'd have been doing anyway. You won't want to be left out of pocket for a damp squib, but it might be less bad than a failed event at a tarted-up conference venue on a business park.

Data protection and the virtual Christmas party

Most organised parties entail the processing of personal data — lists of names for the table plan, menu choices, and so on — but your virtual Christmas party may have some additional considerations.

Home address information

If you are going to be shipping food and drink to the attendees, you'll need their home addresses, and you'll probably need to give this to the virtual event organiser, and they'll probably need to pass it on to their suppliers, and so on.

Even though your staff are likely to have given this to you already, that's probably for HR purposes, so you cannot assume that they'll be fine with you re-using it for this purpose (and, of course, that might not be where they are when they join the party).

You'll need to find a lawful basis for your processing, and you'll need to meet your transparency obligations to your staff.

Protecting personal data contractually

This will depend on whether the supplier is acting as a controller or a processor. This is a case-by-case thing, but I'd have thought you're probably buying their services because of their skill and expertise, and that, ultimately, they're the ones deciding what needs to happen with the data you give them — so, if I had to take a stab in the dark without knowing the specifics of any given situation, I'd err on the side of them being an independent controller.

If I'm wrong, and they're a processor, you'll need to have a valid processing agreement in place.

If they're a controller, then you've more flexibility, but you'll still need to cover this off.

If any part of the service entails transferring personal data outside the EEA, to a country which is not on the list which the European Commission has decided are "adequate", that adds another degree of complexity entirely.

Avoid processing special category data

Not unique to virtual Christmas parties but, if you've organised parties before for any number of people, you'll be familiar with the usually-thankless chore of getting people's orders ahead of time and communicating them to the venue.

If you're lucky, people will pick from the list you give them without too many modifications, but some will need their dietary preferences accommodating.

The key from a data protection point of view is to keep it simple: you need to know what you need to do, and not why.

If there's no need to know, or tell the supplier, that Belinda from Accounts is pesca-pescatarian because she has a particular health condition, or that Armijn wants a raw vegan option because they're an ethical vegan, then don't ask.

And if you do need to process special category data, you'll need to satisfy at least one of the conditions set out in Article 9(2) GDPR, in addition to having a normal lawful basis for processing it.

Event recording (urgh)

I very much doubt that recording the audio and video stream of your virtual Christmas party is a good idea but, since many video platforms offer a recording capability, if you're tempted to switch it on, ensure you can demonstrate you've thought it through.

Make sure that you've done a robust data protection impact assessment, and that you've told everyone what you're doing.

Just don't be surprised if no-one turns up.

A virtual work event is still a work event

Even if your virtual Christmas party is happening this year in cyberspace, rather than Event Room B, it's still a work event.

I'm speculating, but it's possible that employees enjoying your party from the comfort of their own home may be tempted to behave differently than if they were there in person. Although it's probably less fun to photocopy your bum if you have to use your own scanner.

I'm not an employment lawyer, so other than reminding you that an employer can be vicariously liable for the actions of employees at a work function — including actions which are definitely not part of their employment contract, such as unwanted attention / sexual harrasment, or Doing Inappropriate Things On Video — I'll leave that to others better placed to comment.

Alternative options

Save your money.