Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

APC REVISION > Data Management > Flashcards

Data Management Flashcards

1
Q

Commissioners for Revenue and Customs Act (CRCA) 2005
(What it covers)

Information Disclosure

A

States all info held by the VOA is covered by the duty of confidentiality.
Specifies the circumstances when that information may be disclosed.
Criminal offence to disclose personal or confidential information to someone without the right to receive it.
Ensures Taxpayers info and any info held in conjunction with our statutory duties is secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Commissioners for Revenue and Customs Act (CRCA) 2005 set out in section 7

Information Disclosure

A

Functions of VOA
1 - Rating lists
2- council tax valuation lists
3 - valuation of property or matters in connection with the valuation of property.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The UK General Data Protection Regulation (GDPR) 2018

Information Disclosure

A

controls how personal information (including property personal information) about living individuals is used by organisations, businesses or the government.
Gives living individuals the right to obtain access to their personal data (find out what information organisations holds about them.)
For the VOA applies to info on employees, customers and taxpayers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The Freedom of Information Act (FOIA) 2000

Information Disclosure

A

Provides the public with access to information held by public authorities eg copies of board meeting minutes

  1. Public authorities are obliged to publish certain information about their activities.
  2. Members of the public are entitled to request information from public authorities.

Relevant to England, Wales and Northern Ireland, and by UK-wide public authorities based in Scotland.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The Environmental Information Regulations (EIR) 2004

Information Disclosure

A

Provide public access to environmental information held by public authorities in England, Wales and Northern Ireland.

  1. Public authorities must make environmental information available proactively.
  2. Members of the public are entitled to request environmental information from public authorities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Commissioners for Revenue and Customs Act (CRCA) 2005
How does it affect VOA and what section applies

Information Disclosure

A

Section 17 = sharing internally with HMRC
Section 18 = when we can disclose
Section 19 of CRCA covers wrongful disclosure and makes it a criminal offence for VOA employees to disclose information where it identifies a person or enables a person’s identity to be deduced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Commissioners for Revenue and Customs Act (CRCA) 2005
Excemptions (when you can disclose info)

A

Section 18 of the Act sets out the specific circumstances when information can be disclosed if:

1- is essential for one of our functions
2- is allowed by a specific piece of legislation (e.g. a statutory gateway under Local Government Finance Act)
3- is with the consent of the taxpayer, customer or client
4- is in the course of civil proceedings in the course of our work (e.g. Valuation Tribunal hearings).
Eg disclose rental information when dealing with a rating challenge proposal (IPP in Wales).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

UK General Data Protection Regulation (UK GDPR) 2018
How to request Data

A

Requested via writing (by email or online) or verbally. Known as a Subject Access Request (SAR) and does not have to mention UK GDPR. A verbal request for property information cannot always be answered verbally.
May need verification of the person’s link to the property
Deadline of one month to respond to a request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

UK General Data Protection Regulation (UK GDPR) 2018
Who are ‘living individuals’

A

Any person or individual
Does NOT include legal entities such as companies, or relatives of the deceased do not have the same rights. An executor has no right of access to the deceased’s data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Freedom of Information (FOI) Act 2000
How to request data

A

Requests must be made in ‘permanent form aka Written’ (such as letter, email or fax), include the requester’s name, address and clearly describe the information wanted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Freedom of Information (FOI) Act 2000
What is meant by applicant and purpose blind

A

Status or position of the requester and their reasons for asking for their information, are irrelevant to the VOA’s handling of the request.

Requests must be in permanent form with 20 working days to respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Environmental Information Regulations (EIR) 2004

How are requests for info given and what are the deadline

A

Verbally
Helps to confirm whats being requested in writting.
20 working days deadline to respond
made by another public authority is not formally treated as an EIR request unless it explicitly states that the request is made under EIR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Environmental Information Regulations (EIR) 2004

What does the term Environmental information mean

A

Broad term and includes any information that is about or impacts upon the environment, such as recycling, habitat losses and building developments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Freedom of Information (FOI) Act 2000

Breaches of FOIA 2000

A
  1. Failure to respond adequately to a request for information.
  2. Failure to adopt the model publication scheme.
  3. Not publishing the correct information and deliberately destroying, hiding or altering requested information to prevent it being released. — This is a criminal offence that both an individual and the Agency can be charged with.

Other breaches of the Act are unlawful but not criminal. The Information Commissioner’s Office (ICO) cannot fine you if you fail to comply with the Act, nor can we require you to pay compensation to anyone for breaches of the Act. However, you should correct any mistakes as soon as you are aware of them.

The ICO may issuing decision or enforcement notices,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

FOIA, EIR, CRCA, GDPR

Time limits for response time & penalties

A

CRCA no time limit, depends on business area. Penalties are a criminal sanction with maximum penalty of two years imprisonment, an unlimited fine or both, or VOA disciplinary action
UK GDPR one month from date of receipt, requests forwarded to the Information Rights and Ministerial Correspondence Team (ICO)
ICO’s remit does not cover CRCA
FOIA and EIR no later than 20 working days after receipt by the VOA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who is responsible for Disclosure

Specific Teams in VOA

A

Everyone
**Information Asset Owner (IAO) ** accountable for decisions made regarding the creation, capture, maintenance, management, disposal and disclosure of information.
Information Law and Disclosure Team (ILD)
advice and guidance on the disclosure of VOA information
Security Team specialist advice and support on the security of Agency information and assets and govern the process of transferring information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Commissioners for Revenue and Customs Act (CRCA) 2005
Key Acts

A

**Section 17 Use of Info **- allows sharing of information held for one function with another function (across HMRC and VOA).
Section 18 Confidentiality - circumstances when HMRC and VOA **may **disclose information outside HMRC and VOA
Section 19 Wrongful Disclosure- means it is a criminal offence to disclose info
Section 20 & 21 - when information can be disclosed where it is either in the public interest or is to a prosecuting authority. Very restricted.
Section 22 and 23 GDPR & FOIA - rights to information under Data Protection and Freedom of Information and sets out how these requests should be treated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What regulation governs laws on data protection and privacy?

A

UK General Data Protection Regulation 2020

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the GDPR consumer rights?

A

A - Access
C - Consent
C - Correction
E - Erasure
P - Data Portability
ACCEP
(Accep your rights)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the 7 principles of data protection

A
  1. Lawfulness, fairness, transparancy
  2. Accuracy
  3. Data minimisation
  4. Purpose limitisation
  5. Accountability
  6. Security
  7. Storage limitation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

8 individual rights under GDPR

A
  1. Right of Access
  2. Right to object
  3. Right to rectify
  4. Rights relating to automated decision making and profiling
  5. Right to be informed
  6. Right to data portability
  7. Right to erasure
  8. Right to restrict processing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Who are the key persons

A
  1. Controller
  2. Processer
  3. Data protection officer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Consequences of a data breach under GDPR/Data protection

A

$20mil/ £17.5mill or 4% turnover whichever is highest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Tell me about the limitation act 1980

A

that sets out rules for how long someone can take legal action to recover money they are owed.
6-15 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are Official documents?
Data on people and property, no personal sensitive information.
26
What are Sensitive documents?
Personal sensitive information e.g. health, trade information.
27
What does GDPR stand for?
General Data Protection Regulation.
28
What rights does Article 5 of GDPR set out?
The right to be informed, right to access, right to erase, right to correct and right to withdraw consent.
29
What best practices should be encouraged in managing data?
Cross reference computer with hard copy, back up IT systems, write once, read many times, keep an audit trail, ensure electronic signature cannot be altered.
30
What is encryption?
A means of securing data by encoding it mathematically such that it can only be read by those with the correct key or cipher.
31
What is a firewall?
A network security device that monitors traffic to or from your network and allows or blocks traffic based on a defined set of security rules.
32
What is a blockchain?
A digitally distributed, decentralized, public ledger that exists across a network.
33
How do you extract data from a source regularly used in your role?
Internal database – CDB for rental information, set parameters for data to refine prior to download, use filters on excel to refine the data.
34
What is an electronic document management system (EDMS)?
A software package designed to manage electronic information and records within an organisation’s workflow.
35
How do you ensure that data is kept securely?
Permission levels, back up systems, sensitive tag.
36
How do you validate information?
Cross check with another source, call to get further information, adopt a common sense approach.
37
What are the pros of primary data sources?
Greater control (type of data, design, method), may be more accurate.
38
What are the cons of primary data sources?
Expensive, time consuming.
39
What are the pros of secondary data sources?
Easily accessible, affordable.
40
What are the cons of secondary data sources?
May lack reliability, may be outdated.
41
Did you have permission to share rental evidence with an agent for rating purposes?
Yes - The Valuation Office Agency (VOA) is subject to the Commissioners for Revenue and Customs Act 2005 (CRCA).
42
Can other colleagues access information you are working on?
No, if they are in a different team they will not be able to access information stored for rating purposes.
43
What are the Freedom of Information Act 2000 exemptions?
Personal data, national security.
44
What does the Data Protection Act 2018 control?
How your personal information is used by organisations, businesses or the government.
45
What regulation covers sharing data?
Commissioners for Revenue and Customs Act 2005 (CRCA ACT).
46
What are the benefits of cloud-based systems?
Information is backed up by encrypted servers, accessibility can be managed via online settings, cheaper than physically storing files, more convenient to send and share files online.
47
What is the meaning of a non-disclosure agreement?
Used to protect against the disclosure or sharing of any confidential data.
48
Who are the key persons outlined within GDPR?
Controller, Processor, Data Protection Officer.
49
What should companies put into place to ensure GDPR compliance?
Raise awareness, audit personal data, review procedures, identify legal basis for processing, train staff.
50
What personal and confidential information does the VO hold?
Personal data relating to VOA employees, emails containing sensitive information, customer correspondence, customer records, property information, contractual information.
51
Define what disclosure means.
The sharing of information with others.
52
What does CRCA set the VO’s functions as?
Producing rating lists, council tax valuation lists, valuation of property.
53
What two ways does the Freedom of Information Act provide the public with access to information?
Public authorities are obliged to publish certain information, members of the public can request information.
54
When would you disclose information about taxpayers or customers to third parties?
In line with CRCA Act 2005, if essential for functions, in line with legislation, with consent, for civil proceedings.
55
How would you deal with someone requesting to access their own personal information?
There is a deadline of one month to respond, forward request to the SAR inbox immediately.
56
How would you deal with a Freedom of Information request?
Check the request is in writing, check it includes the requester’s name and address, forward request to FOI inbox team.
57
How do you store data?
Place it within the VOA’s secure drives, case documents in restricted drives.
58
Where was the data stored?
Two secured VOA drives for valuer access and a database created for land description.
59
What are the seven principles of GDPR?
Lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
60
What is a data controller?
Determines the purposes and means of processing personal data.
61
What is a data processor?
Processes personal data only on behalf of the controller.
62
What is discrete data?
Information that can only take certain values.
63
What is continuous data?
Data that can take any value.
64
How long to report a data breach?
48 hours to report internally, 72 hours to report to Information Commissioners Office.
65
What is your understanding of the term Confidentiality?
Where information is provided but is subject to confidence and not shared without permission.
66
What is your understanding of the term Meta Data and why is this important?
Info about a specific piece of data i.e author, file size, date document was created and keywords to describe the document. ## Footnote Must afford same level of care to Meta Data as for other data.
67
What is your understanding of Intellectual Property and Copyright?
IP - right to control use and ownership of original works. Copyright - Type of IP that gives the creator of the original work or another right holder the exclusive and legally secured right to copy, distribute, adapt, display and perform creative work for a limited time.
68
If two separate departments within your firm were working for two rival companies, how would you ensure client sensitive data was managed?
Make client aware of risks and check their understanding of COIs. Get client to sign a letter of instruction. Exclusivity of staff would be arranged. NDAs would be considered. Obtain written informed consent and set up information barrier. Separate working locations. Secure document and data storage would be arranged to be used exclusively for the separate teams.
69
What different sources of information do you use in your day-to-day surveying?
RICS guidance notes. Valuation Data. Industry Journals. Central Database. Electronic Data Management Application. Rating manual. Council Tax manual. Rent and Lease Details Forms.
70
How do you manage these sources of information to ensure compliance with the legislation?
If signed up to NDA, maintain complete confidentiality, Do not discuss with colleagues not party to the project. Keep data secured in EDRM or CDB. Computer is locked when away from screen. Passwords are regularly updated. Latest firmware is installed to ensure most up-to-date firewalls are in place. Ask for signed Authority to Acts before discussing cases with other parties.
71
How do companies ensure compliance with the Data Protection Legislation generally?
Should only retain data needed to perform day-to-day operations. If data is being retained, should inform the individual why they have it. They should hold the Data securely. They should keep the information up-to-date and delete information they no longer need.
72
How long do you need to keep data for?
6 years if contract is signed underhand. 12 years if the contract is signed as a deed. RICS recommends up to 15 years, this is the limitation for most legal claims.
73
If you intend to destroy a document, what things should you consider beforehand?
Is the document an original or legal document? Could the document be required for litigation or other proceedings? Does the document relate to a live project? Is a backup copy available?
74
What measures could be taken to protect commercially sensitive information?
Have an NDA in place. Physical separation of staff. Security of stored documents, including locked cabinets and passwords.
75
Are there any ways that we can protect data when we are transferring it on a client’s behalf?
Encryption and password locking. Recorded special delivery. Mark it as confidential. Using secure networks and software.
76
What is an information barrier?
A physical/electronic separation of individuals within the same firm. The aim is to protect confidential information.
77
What things must companies put in place to ensure GDPR compliance?
Raise awareness across their business. Audit all personal data. Update their privacy notice. Review their procedures supporting individuals’ rights. Identify and document their legal basis for processing personal data under the GDPR. Review how they seek, obtain and record consent.
78
What do the Privacy and Electronic Communications Regulations 2003 apply to?
The UK’s implementation of the EU ePrivacy Directive. A set of rules that protect the privacy rights of customers when using electronic communication for marketing. A complement to the Data Protection Act and the UK GDPR.
79
What specific rules are included in the Privacy and Electronic Communications Regulations 2003?
Specific rules on marketing calls, emails, texts and faxes; cookies (and similar technologies); keeping communications services secure; and customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.
80
Can Intellectual Property be transferred?
Intellectual property rights can be transferred through a written agreement, such as a contract or assignment. The agreement should clearly state the details of the transfer, including the specific intellectual property rights being transferred, the parties involved, and any conditions or limitations.
81
What should you do if you receive a freedom of information request?
You normally have 20 working days to respond to a request. For a request to be valid under the Freedom of Information Act it must be in writing, but requesters do not have to mention the Act or direct their request to a designated member of staff.
82
Can you tell me about the retention of files and the Limitation Act 1980?
The Limitation Act 1980 is a section of UK law that sets out rules for how long someone can take legal action to recover money they are owed.
83
What legal documents need to be kept for 6 years?
County Court Litigation, Debt collection, Immigration, Personal injury, Crime.
84
What legal documents need to be kept for 15 years?
Commercial property, Commercial transactions, Financial Services, Matrimonial matters, Probate, Property sales, Residential property purchases, Sales of leasehold properties, Children.
85
What files should be kept for longer than 15 years?
Change of name, Company formation, Court of Protection, Declaration of trust, Patents/intellectual property matters, Pension schemes, Power of attorney, Wills.
86
How do you validate information?
Cross-referencing. Fact checking.
87
What is the difference between a deed and a registered title?
The deed is the physical document that proves ownership. The title is the concept of legal ownership that the deed grants.
88
How do you source title information?
Request from client / acting party (solicitor). Access the register available online.
89
What are the differences between manual and electronic records?
Paper documents are difficult to search, carry, copy, and modify. Paper documents are easily damaged, misfiled or misplaced. Electronic documents are delivered by networks, disks, flash memory and CD/DVD and are stored on a file system. Multiple users can read and review electronic document simultaneously. Electronic documents can be hacked from external operators.
90
What is an index map?
Index maps are a type of finding aid that enables users to find a set of maps covering their regions of interest along with the name or number of the relevant map sheet.
91
What does encryption mean?
The process of converting information or data into a code, especially to prevent unauthorized access.
92
What is a firewall?
A network security device that monitors traffic to or from your network. It allows or blocks traffic based on a defined set of security rules.
93
How can you protect electronic data from viruses?
Keep systems, browsers and important apps up to date. Antivirus software. Antispyware software. Firewalls. Strong passwords. Be wary of phishing and suspicious emails. Use a secure wi-fi connection (Virtual Private Network VPN).
94
What does block chain mean?
A system in which a record of transactions, especially those made in a cryptocurrency, is maintained across computers that are linked in a peer to peer network.
95
What is BIM and how can it be used?
Building Information Modeling is a workflow process. It is based around models used for the planning, design, construction, and management of building and infrastructure projects.
96
What is ISO 9001?
Sets the requirements on how firms should control data and documents relevant to the service they provide.
97
What are the requirements of ISO 9001?
The ISO 9001 standard requires an organisation address seven key areas – also known as clauses – in order to achieve continual improvement within their Quality Management System.
98
What does ISO 27001 relate to?
The international standard for information security. It sets out the specification for an effective ISMS (information security management system).
99
Why is quality management important?
It helps an organization achieve greater consistency in tasks and activities that are involved in the production of products and services. It increases efficiency in processes, reduces wastage, and improves the use of time and other resources. Helps improve customer satisfaction.
100
What is an Electronic Document Management System (EDMS)?
A software that centrally stores and organises documentation in one digital repository.
101
What do you understand by the Civil Evidence Act 1995?
An Act to provide for the admissibility of hearsay evidence, the proof of certain documentary evidence and the admissibility and proof of official actuarial tables in civil proceedings; and for connected purposes.
102
Are electronic signatures accepted by the Land Registry?
Yes - Under English law, a deed can be validly signed and witnessed using an electronic signature platform, such as DocuSign eSignature, in situations where the law allows electronic signing.
103
What type of documents can electronic signatures be used for?
Legal documents, Contractual agreements, Invoices, Financing documents.
104
What is data redundancy?
When the same piece of data exists in multiple places, whereas data inconsistency is when the same data exists in different formats in multiple tables.
105
How does the Commission for Revenues and Customs Act 2005 apply to data management?
HMRC has a statutory duty of confidentiality set out in the CRCA 2005. HMRC must comply with general law principles when considering any disclosure and be compliant with the General Data Protection Regulation (GDPR), Data Protection Act 2018 and the Human Rights Act 1998 when disclosing information.
106
How does the CRCA 2005 apply to the FOIA?
A disclosure by HMRC in compliance with FOIA is a lawful disclosure under CRCA but information relating to identifiable individuals or legal entities is exempt from disclosure under FOIA.
107
What is a SAR?
Subject Access Request (SAR) allows an individual the ability to ask a company or organisation to provide data about them.
108
What is Business Management System?
A set of tools for strategic planning and tactical implementation of policies, practices, guidelines, processes and procedures that are used in the development, deployment and execution of business plans and strategies and all associated management.
109
How do you store data?
Place it within the VOA’s secure drives. Case documents go in restricted drives where only certain staff can reach.
110
Where was the data stored?
Two secured VOA drives: one for the valuer to download the sale and another database to describe the land.
111
What is discrete data?
Discrete data is information that can only take certain values, such as the profit of a company.
112
What is continuous data?
Continuous data is data that can take any value, such as height, weight, temperature.
113
Which regulation allows the VO to share information related to the grounds of the proposal?
Regulation 9 (7) or Section 18 of the Commissioner for Revenue and Customs Act.
114
What legislation does VOA follow regarding data protection?
General Data Protection Regulation 2016 (GDPR) / Data Protection Act 2018.
115
What must you ensure regarding section 18 to section 23 of the Commissioners for Revenue and Customs Act 2005?
Be aware of the implications when considering disclosure about taxpayers and clients.
116
How should we deal with data?
Keep only what you need, do not pass personal information, hold data securely, limit access, keep data up to date, and delete where appropriate.
117
What sources of data does VOA use?
Published sources such as CoStar and the VOA Public Business Rates Portal.
118
How does VOA collect data?
From ratepayers, forms of return (RALD), inspection, public domain, and subscription websites.
119
What must be done with the information collected by VOA?
All information must be securely stored, protected, and labelled for correct retrieval.
120
What is essential to understand regarding the Freedom of Information Act 2000?
Understand the rights of individuals to request the information we hold on them.
121
What constitutes a personal data breach?
Losing personal data, accidentally sending it to an incorrect recipient, and altering it without permission.
122
What is the ICO?
The ICO is the UK’s independent body set up to uphold information rights.
123
What role does data management play in your day-to-day job?
Data management is essential for handling and organizing information effectively.
124
If you worked in private practice, would your considerations differ?
Yes, considerations would differ, such as no CRCA and handling client data.
125
What does CRCA stand for?
CRCA stands for the Commissioners for Revenue and Customs Act.
126
What are the five principles of better regulation?
The five principles are Proportionality, Accountability, Consistency, Transparency, Targeting.
127
What does TARGETING mean in Principles of Better Regulation?
TARGETING means regulation should focus on the problem and minimize side effects.
128
What are the data protection principles under the DPA 2018?
The principles are: LAWFUL, SPECIFIED, RELEVANT, ACCURATE, TIMELY, SECURE.
129
What does an individual obtain from an SAR?
An individual is entitled to confirmation of processing, a copy of their personal data, and other supplementary information.
130
What legislation prevents an agent from taking photos of an FOR?
Regulation 17(4)(b)(ii) of The Valuation Tribunal for England (Council Tax and Rating Appeals) (Procedure) Regulations 2009.
131
What advice did you give for your Reval inspections?
Advice focused on verifying information and ensuring it is up to date.
132
Why was it important to undertake the task for Reval?
To verify information and increase its reliability.
133
Is the Electronic Document Management 1st edition current guidance?
No, it has been archived, and updates should be checked before acting on it.
134
How did you determine which transactions were non-useful for your sales verification task?
Determination was based on specific criteria for usefulness.
135
What does Regulation 17(4)(b)(ii) set out?
Evidence should be submitted to all parties two weeks prior to the hearing, and a copy of the information but not a photographic copy.
136
What information did you retract?
Any information which could identify the occupier.
137
Any recent high profile fines regarding Data breaches?
Meta – €1.2 billion (May 2023), Amazon – €746 million (2021), Instagram – €405 million (September 2022).
138
How does the VOA receive SDLT transactions?
Through solicitors.

APC REVISION (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions