chapter 1

Question 1

what is Data Security

Answer 1

Set of practices and processes deployed to
protect data and data resources, including
confidentiality, integrity, availability, etc

Question 2

what is Data Privacy

Answer 2

Data privacy is a branch of data security
concerned with the proper handling of
personal or private information, including
consent, notice, regulatory obligations, etc.

Question 3

what is personal data

Answer 3

–> Any information related to an
individual that can be used to
directly or indirectly identify the
person

–> Data that has been de-identified,
but can be used to re-identify a
person remains personal data

Question 4

what is not considered personal data

Answer 4

–> Data that has been rendered
anonymous in such a way that the
individual is not or no longer
identifiable, is no longer considered
personal data

Question 5

what are the 4 Personal Data – Building Blocks

Answer 5

Any information

Relating to

Identified or identifiable

Natural person

Question 6

what does the Any information building block say

Answer 6

Any type of information about the
person, includes objective information,
subjective information, sensitive information, information in any medium.

Question 7

what does the “Relating to” building block say

Answer 7

Information that is about the individual.
Data that is related to the individual
because of it’s content, it’s purpose, or
the result of processing the data.

Question 8

what does the “Identified or identifiable” building block say

Answer 8

Information that can distinguish an
individual from other people within the
group.

Information that makes it
possible to identify the individual.

Question 9

what does the “natural person” building block say

Answer 9

A real physical human being, in contrast
to an artificial or fictitious person

Question 10

examples of personal data

Answer 10

name

email address

phone number

IP address

home address

identification number

cookie-ID

Question 11

examples of data which comes under special category

Answer 11

criminal records

racial or ethnic origin

health and genetic data

religious or philosophical beliefs

biometric data

trade union membership

political opinion

Question 12

examples of data which is NOT personal data

Answer 12

company registration number

general email address

anonymised data

information about legal entities

Question 13

Pseudonymization vs Anonymization

Answer 13

Pseudonymization (used where a level of traceability remains):

–> Data still considered personal because a connection to the individual can be re-established with additional information or effort.

–> Used to reduce the privacy risk, but not enough to remove personal data status.

Anonymization:

–> Data not considered personal because no identifiable information remains.
Individuals cannot be re-identified, even if other data is combined.

–> Complies with data protection regulations, as no privacy risk exists.

Question 14

what are the 7 principles of data privacy

Answer 14

Lawfulness, fairness, and transparency

Purpose limitation

Data minimization

Accuracy

Storage limitation

Integrity and confidentiality

Accountability

Question 15

what is Lawfulness, fairness, and transparenc

Answer 15

• Process personal data lawfully, fairly, and
  transparently
• Collection methods must be legal, with clear privacy policies and purposes
• Articulate why they want your personal data and how they intend to use it

Question 16

what is Purpose limitation

Answer 16

• Collect personal data for a clear and specific purpose
• Companies have to use personal data in the way that they promised to apply it
• Purpose of any data collection must be specific, clear, and limited to a relevant scope

Question 17

what is Data minimization

Answer 17

• Make sure that the processing of personal data is adequate, limited to what is necessary, and relevant
• Helps contain exposure and personal damage in the event the company’s data is compromise

Question 18

what is Accuracy

Answer 18

• Keep collected personal data accurate and up to date
• Maintain the personal data and take reasonable action to erase or rectify inaccurate or incomplete information

Question 19

what is Storage limitation

Answer 19

• Personal data should only be stored as long as needed and then either deleted or anonymized
• Personal data should not be retained or be reuse beyond its original stated purpos

Question 20

what is Integrity and confidentiality

Answer 20

• Implement appropriate technical and organizational security measures to protect the collection and processing of personal data
• Companies need systems in place to protect against unauthorised access and to ensure redundancy

Question 21

what is accountability

Answer 21

• Data collectors are responsible for, and be able to demonstrate compliance with all of the principles
• Data collectors must show that they are taking reasonable action to meet the six previous principles