Optional - Data Management (L3) Flashcards by Rachel Meir

What is GDPR?

GDPR is the General Data Protection Regulation (2016), that came into effect on the 25th May 2018. It aims to create a single data protection regime for the European Union

How well did you know this?

Not at all

Perfectly

What Act Implemented the GDPR in the UK?

The Data Protection Act (2018), which replaces the Data Protection Act 1998 after 20 years.

How well did you know this?

Not at all

Perfectly

What do you need to do if you have a data breach?

Notify the Information Commissioners Office (ICO) within 72 hours of the breach occurring.

How well did you know this?

Not at all

Perfectly

What are the fines for non-compliance with UK GDPR?

For serious breaches of the data protection principles, ICO power to issue fines of up to £17.5 million or 4% of your annual worldwide turnover, whichever is higher

How well did you know this?

Not at all

Perfectly

What are the 8 Individual Rights Under GDPR?

Right to Be Informed of info being held
Right of Access
Right of Rectification
Right to Erasure
Right to Restrict Processing
Right to Data Portability
Right to Object
Right to Automated Decision Making

BARE ROPA

How well did you know this?

Not at all

Perfectly

When was the Freedom of Information Act Enforced, and what does it do?

The freedom of information Act came into effect in 2000, it allows an individual to request access to information held by a public body. The public body is required to provide that information (normally in 20 working days) in the requested format, however they can charge a fee for this.

How well did you know this?

Not at all

Perfectly

Give me an example of how your company is compliant with GDPR

On marketing emails, we give people the right to be removed from our database.

How well did you know this?

Not at all

Perfectly

Does your company tell people how their data is stored?

Yes, our website gives detail on our ‘Fair Processing Notices’ which outlines:
* our purpose of collecting personal data
* how to unsubscribe from marketing communication
* special catergories of data are necessary for fulfilling legal obligations relating to AML

How well did you know this?

Not at all

Perfectly

What Act Implemented the GDPR in the UK?

The Data Protection Act (2018), which replaces the Data Protection Act 1998 after 20 years.

How well did you know this?

Not at all

Perfectly

What is GDPR?

GDPR is the General Data Protection Regulation (2016), that came into effect on the 25th May 2018 as part of the UK Data Protection Act.

It aims to create a single data protection regime for the European Union

How well did you know this?

Not at all

Perfectly

What do you need to do if you have a data breach?

Notify the Information Commissioners Office (ICO) within 72 hours of the breach occurring.

How well did you know this?

Not at all

Perfectly

What are some examples of data security technologies?

Disk encryption (encrypting data on a secure hard disk drive)
regular back-ups offsite
password protection
use of anti-virus software protection
firewalls
VPNS (Virtual Private Networks)

How well did you know this?

Not at all

Perfectly

What is a firewall?

Network security device that monitors traffic to or from your network

How well did you know this?

Not at all

Perfectly

What is copyright?

A set of exclusive rights granted to the author or creator of any original work inc. the right to copy. Form of intellectual property

How well did you know this?

Not at all

Perfectly

What is triangulation?

Triangulation is the process of verifying data from multiple sources to validate any data collected

How well did you know this?

Not at all

Perfectly

Who polices the Data Protection Act and UK GDPR?

Information Commissioners Office (ICO)

How well did you know this?

Not at all

Perfectly

What are the individual rights under UK GDPR? (8)

Right to be informed
Right of access
Right to rectification
Right to erasure
Right to restrict processing
Right to data portability
Right to object
Right to automated decision-making and profiling.

What are the principles of the UK GDPR? (5)

Personal data must be
1. processed lawfully, fairly and in a transparent manner
2. collected for a specific and legitimate purpose
3. accurate and kept up to date
4. kept no longer than necessary
5. processed in a secure manner.

What is the link between UK GDPR and Data Protection Act 2018?

When UK left EU in 2016, it formed its own regulations, the UK GDPR which is covered by the Data Protection Act 2018

What is the aim of the UK GDPR/Data Protection Act 2018?

Aims to create a single data protection regime affecting businesses and empowering individuals to take control of how their data is used by third parties

What is an SAR?

Subject Access Request – Demand that the individual be given all the information that a company holds on them.

When was the Freedom of Information Act Enforced, and what does it do?

What are some of the requirements of the UK GDPR/Data Protection Act 2018? (4)

Obligation to conduct data protection impact assessments for high-risk holding of data
Data controllers decides how and why personal data is processed and is directly responsible for GDPR
‘Data Accountability’ ensures that organisations can prove to the ICO how they comply with the new regulations
Data security breaches need to be reported to the ICO within 72 hours where there is a loss of personal data and a risk of harm to individuals.

What is the Freedom of Information Act 2000? (2)

Give individuals right of access to information held by public bodies. Public body is required to supply it within 20 working days

Are there any exemptions to the Freedom of Information Act 2000? (2)

1. If something is contrary to the UK GDPR 2. If something would prejudice a criminal matter under investigation.

How does an NDA work?

legally enforceable contract between two parties relating to sensitive information

What is included in an NDA?

1. parties 2. definition of what is deemed confidential 3. scope of confidentiality 4. exclusion of confidentiality 5. signatures

Who is bound by the NDA - the signatory or whole company?

Whole company

How does your firm keep its data secure?

1. Regular password changes, regular back-ups of site (daily – through ‘OneDrive’) 2. not allowed external hardware e.g. USB 3. two-factor authentication and log-in 4. restricted file access

How can you keep a confidential folder safeguarded?

Ensure restricted access, use non-descript project names, store properly.

How do you ensure accuracy in your data records?

Through triangulation - method of verifying data and through regular review. Also restricting access to data controllers

What country do you store your data in (and does it matter)?

Store in the UK – covered by Data Protection Act 2018 – some countries do not have the same levels of security around data, GDPR etc. outside of the EU for example.

Does it make a difference whether a file/folder contains personal data or purely company data?

How does a virtual data room comply with GDPR Rules?

How do you shut down a data room securely?

How do you set up a data room?

What is leasing velocity?

What are the limitations of using external databases?

* Can't always confirm accuracy * Can't always verify source of information * Needs to be carefully considered and caveated

What are the advantages of external databases?

* Volume of information * Quick access to information * Cover areas/data you do not personally hold

Are there any proposed developments in Data Management for RICS?

Proposed RICS Professional Statement on Data Handling and the Prevention of Cyber Crime. Address how surveyors collect, store and use data. Address cyber risks posed by modern ways of working including portable devices.