Law and the Internet

Question 1

Civil Evidence Act 1968

Answer 1

Computer records became admissible in civil trials

Question 2

List the six principles of GDPR

Answer 2

Data must be:
1. Fairly and lawfully processed
2. Processed for limited purposes
3. Adequate, relevant and not excessive
4. Accurate and up to date
5. Not kept in a form that identifies people for longer than necessary
6. Processed securely and protected against loss or damage

Question 3

What does GDPR stand for?

Answer 3

General Data Protection Regulation

Question 4

GDPR includes a requirement to keep internal records of your databases. What does this include?

Answer 4

1. Who you are, the type of data and who provided it
2. Retention schedules
3. Security arrangements
4. Details of transfers

Question 5

GDPR makes it essential to identify why processing is allowed. What does this include?

Answer 5

1. Consent: for each purpose must be freely given, specific, informed and unambiguous
2. Contract
3. Legal compliance

Question 6

List the rights that GDPR provides for individuals

Answer 6

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling

Question 7

What is meant by the right to be informed?

Answer 7

Need to have a privacy notice that explains your processing

Question 8

What is meant by the right of access?

Answer 8

Systems need to be designed for this right to be exercisable

Question 9

What is meant by the right to rectification?

Answer 9

Errors need to be corrected and passed on if the data was passed on

Question 10

What is meant by the right to erasure?

Answer 10

Right to be forgotten - delete data when there is no compelling reason to keep it

Question 11

What is meant by the right to restrict processing?

Answer 11

You can keep data, but not otherwise process it unless you have to

Question 12

Who does GDPR state that firms processing data at scale must appoint? What is their job?

Answer 12

Data Protection Officer. They advise on GDPR obligations, monitor compliance with GDPR and report to the board

Question 13

What characterises offences that fall into Section 1 of the Computer Misuse Act 1990?

Answer 13

• Unauthorised access to a program or data
• Requires knowledge that is unauthorised

Question 14

What characterises offences that fall into Section 2 of the Computer Misuse Act 1990?

Answer 14

As Section 1, but with intent to commit another serious offence

Question 15

What characterises offences that fall into Section 3 of the Computer Misuse Act 1990?

Answer 15

Unauthorised modification of data Eg. virus writing, denial of service, making/distributing hacking tools

Question 16

What was Whitaker convicted under the Computer Misuse Act 1990 for?

Answer 16

Not disclosing a time-lock that froze bespoke software when client was late in making payments.

Question 17

Explain the Wimbledon case

Answer 17

After an appeal it was found that “mail bombing” is a Section 3 offence - test of unauthorised becomes “if I were to ask, would they say yes”

Question 18

What was Cuthbert convicted of under the Computer Misuse Act 1990?

Answer 18

Section 1 offence for trying out ../../../ URLs

Question 19

Electronic Communications Act 2000

Answer 19

Electronic signatures shall be admissible as evidence

Question 20

Investigatory Powers Act 2016

Answer 20

• Deals with interception and communications data
• Permits equipment interference under a warrant
• Permits bulk interception, bulk acquisition, bulk equipment interference and collection of bulk personal datasets

Question 21

What is communications data?

Answer 21

Metadata about communications. Needs a retention regime

Question 22

What is interception?

Answer 22

Revealing content to someone other than sender/receiver

Question 23

How must interception be authorised under the Investigatory Powers Act 2016?

Answer 23

By a warrant signed by the Secretary of State ie. Home Secretary. Power can only be delegated very temporarily

Question 24

Give 2 examples of interception

Answer 24

1. Tapping a telephone
2. Copying an email

Question 25

What relevant power does GCHQ have?

Answer 25

They can scan international communications for "factors"

Question 26

How must regulators undertake lawful business practice with respect to the Investigatory Powers Act 2016?

Answer 26

1. Regulations prescribe how not to commit an offence under IPA 2. Must make all reasonable efforts to tell all users of system that interception may occur

Question 27

Which party of the Regulation of Investigatory Powers Act 2000 is still in force?

Answer 27

The part that deals with encryption

Question 28

Regulation of Investigatory Powers Act 2000

Answer 28

Basic requirement is to "put this material into an intelligible form". You can supply the key instead. Keys can be demanded

Question 29

Consumer Rights Directive 2011

Answer 29

1. Remote seller must identify themselves 2. Details of contract must be delivered 3. Right to cancel unless service already delivered

Question 30

E-Commerce Directive 2002

Answer 30

Online selling and advertising is subject to UK law if you are established in the UK - whoever you sell to. There are complexities if selling to foreign consumers if you specifically marketed to them

Question 31

Privacy and Electronics Communications Regulations 2003

Answer 31

Bans unsolicited marketing emails to natural persons

Question 32

What does legislation say about cookies?

Answer 32

- Must give clear and comprehensive information - Must have consent unless cookies are strictly necessary for provision of an information society service that has been requested

Question 33

Give 2 examples where cookies may be used without permission

Answer 33

1. Shopping carts 2. Security on bank websites

Question 34

Give 3 examples where cookies may not be used without permission

Answer 34

1. First and third party advertising 2. Analytics 3. Personalisation