Data Management

Question 1

What are the 7 principles of Data Protection Act 2018? (AKA 7 principles of GDPR)

Answer 1

Lawfulness, fairness, transparency

Accuracy

Accountability

Purpose limitation

Storage limitation

Data minimisation

Integrity and confidentiality

(LAAP SDI)

Question 2

Examples of personal data under GDPR that could apply to property companies?

Answer 2

Data relating to:

investors, fund managers, valuations, compliance, background checks by HR etc

IF CV

Question 3

When did GDPR come into effect

Answer 3

25 May 2018

Question 4

What is GDPR?

Answer 4

EU General Data Protection Regulation

Question 5

What is the purpose of GDPR?

Answer 5

Protect citizens personal data

Question 6

To what organisations does GDPR apply?

Answer 6

All organisations of more that 250 employees

Question 7

What are penalties for GDPR breaches?

Answer 7

4% of annual global turnover or £17.5million pounds.

Question 8

How are data breaches typically discovered?

Answer 8

Access logs, reported thefts, lost equipment or data security incident
(ATLS)

Question 9

Examples of data held by surveying practices?

Answer 9

Payroll and HR

Customer data for marketing

Emails and corrspondance relating to clients and employees

(CEP)

Question 10

What Act implemented GDPR in the UK?

Answer 10

Data Protection Act (2018)

Question 11

Disadvantages of the systems you use?

Answer 11

Rely on data input completed by others - human error

External systems - firm is not in control of security

Not user friendly and lots of staff training required!

(HES)

Question 12

What is the purpose of Data protection Act 2018?

Answer 12

Aims to create single data protection regime for anyone doing business in EU and to empower individuals to take control of how their data is used by third parties.

Aswell as governing personal data covered by GDPR, it covers all general data that was covered previously under 1998 Act

Question 13

What are the 8 individual rights under GDPR

Answer 13

Right to be informed

Right of access

Right of rectification

Right to erasure

Right to restrict processing

Right to data portability (to use for own purposes)

Right to object

Right to automated decision making and profiling (as undertaken by insurance companies)

I,A,R,E R D,O,D

Question 14

What are some of the data security technologies you could use?

Answer 14

Disk encryption

Back-ups off site

Password protection

Anti-virus software protection

Firewalls and disaster recovery procedures

(FAB DP)

Question 15

RICS best practice points for complying with GDPR?

Answer 15

Conduct data review

Anonymise data where possible

Encrypt everything where possible

CAE

Treat commercial data in same way as personal data, even though not covered by GDPR

Question 16

What is ‘right to be forgotten’ under GDPR?

Answer 16

Under Article 17 of GDPR, individuals have right to have personal data erased in certain circumstances

Data no longer necessary

Data been processed unlawfully

Question 17

What is SAR?

Answer 17

Subject Access Request:

It demands that the individual be given all the information that a company holds on them.

Question 18

What is the ‘right to access’ under GDPR?

Answer 18

Individuals have the right to obtain confirmation that their data is being processed, and access to their personal data

Question 19

When would you report a data breach?

Answer 19

Need to report within 72 hours of becoming aware of breach

If breach high risk, then need to notify individual without delay

Question 20

What is data portability?

Answer 20

Right for data subject to receive personal data concerning them which they have previously provided, and have it transmitted to another controller.

Question 21

What is data protection officer?

Answer 21

An individual appointed to monitor internal compliance and advise on an organisations data protection obligations

Only required if organisation is public body, authority or carrying out certain type of processing activity

Question 22

What is privacy by design?

Answer 22

data protection through technology design

Question 23

What are the obligations imposed by GDPR?

Answer 23

Knowledge of data you store.

Need to be able to (Provide information on how data is used) and the rights of individuals regarding their data

Need to be able to (Demonstrate data is being managed in compliant manner).

Must be able to (Delete every instance of an individuals data) - in compliance with ‘right to be forgotten’

(Must keep data in format that allows portability) to another data processor, should the need arise

Question 24

What is a Freedom of Information Act ?

Answer 24

Act of parliament that creates a public right of access

Allows an individual to request access to information held by a public body

Public body is required to provide that information (within 20 working days) in requested format

They can charge a fee for this

Question 25

What is an information barrier and how should it be enforced?

Answer 25

1. Different surveyor should act for each client.
2. They must be physically separated preferably in different
   buildings or on different floors with separate support teams.
3. All information regarding the instruction should be securely stored.
4. The firms compliance officer must oversee all actions.

Question 26

Who regulates GDPR in the UK?

Answer 26

Information Commissioners Office