Data Management Flashcards
What legislation can you name that applies to data protection in the UK?
The data protection act 2018.
UK General Data Protection Regulation (GDPR).
What is the Data Protection Act 2018?
The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR).
Controls / stipulates how personal information if used by organisations, businesses and the government.
These parties must follow data protection principals which stipulate that information is:
1. Used fairly, lawfully and transparently.
2. Used for specified, explicit purposes.
3. Used in a way that is adequate, relevant and limited to only what is necessary.
4. Accurate and, where necessary up to date.
5.Kept for no longer than necessary.
6.Handles in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.
The act also strengthens the protection for sensitive information such as race, political opinions, religious beliefs etc.
Gives individuals rights to be notified of a data hack, request information an organisation has about them and request a copy of the information that they have (with exceptions - if it relates to prevention, detection or investigation of a crime or national security etc.).
What happens if a firm is in breach of the Data Protection Act 2018?
£17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher.
Act does stipulate some exceptions to breach; processing for journalistic and academic purposes to allow freedom of expression and a right to privacy.
What does the Data Protection Act 2018 recommend organisations to do to keep data safe?
Carry out a data protection impact assessment to determine risks inside and outside of an organisation.
Employ an independent data protection officer to monitor internal compliance (actually compulsory for public organisations).
What is personal data?
Personal data refers to any information which can be connected to an identifiable living individual such as a name or ID number. It can also include biometric data which is generated through specific processing related to the physical, physiological or behavioural characteristics of an individual, enabling easy identification from DNA, fingerprints or facial recognition software.
What is processing?
Processing relates to any operation which is carried out on personal data, including recording, storing, altering or disclosing it to others as well as its restriction, erasure or destruction.
What is an identifiable living individual under the Data Protection Act 2018?
An identifiable living individual is defined within the Act as someone who can either directly or indirectly be identified by particular reference to an identifier, such as their name, ID number of location data, for example an IP address
What is a controller under the Data Protection Act 2018?
An individual who decides how and why data will be processed, either operating alone or in conjunction with others. Before data is processed, the controller is responsible for considering the impact the proposed processing could have on the rights and freedoms of the individuals who’s information will be affected.
What is a processor under the Data Protection Act 2018?
They report to the controller, a processor is responsible for processing personal data on their behalf, although they retain accountability for any information they process and could be found liable if a data breach occurs.
Under the Data Protection Act 2018 how quickly should an organisation release a copy of data upon request of an individual?
As soon as possible but no later than a month after receiving the request for information
What authority enforces information rights in the UK?
ICO - Information Commissioners Office
What principals does the UK GDPR set out?
Lawfulness, fairness and transparency – leave the individual fully informed
Accuracy – where necessary kept up to date, erase inaccurate personal data without dela
Data minimisation – collect the minimum data you need
Storage limitation – Retain the data for a necessary limited period and then eras
Purpose limitation – must inform your clients about the purpose of the data collection
Accountability – Record and prove compliance
Security - Integrity and confidentiality – Keep it secure, locked filing cabinet or fire wall
How have you changed the way you managed data during COVID 19 and home working?
Only use company owned work equipment and storage of hard copies of files is limited to the office.
Regular updates for passwords etc.
Log into secure intranet - no files downloaded locally.
How do you ensure the data that you hold on your clients is kept secure and confidential?
Limit access to sensitive data use smart passwords to resident details Firewalls and antivirus protection dedicated server stay on top of security updates.
Why do you keep company data for 12 years?
It is a requirement of our PII insurance that all contracts under deed are kept for a minimum of 12 years and under hand for 6 years. I am aware of the limitation act to claims which can be brought about up to 15 years after the act of negligence.
