Topic 24 Flashcards
Other regulation affecting the advice process (103 cards)
What legislation replaced the Data Protection Act 1998 in the UK?
The Data Protection Act 2018, which incorporates the General Data Protection Regulation (GDPR), retained in UK law as UK GDPR after Brexit.
What does ‘personal data’ mean under UK GDPR?
Personal data is information that can directly or indirectly identify an individual, such as name, ID number, location data, or online identifiers.
What are the six data protection principles under UK GDPR?
Processed lawfully, fairly, and transparently
Collected for specified, legitimate purposes
Adequate, relevant, and limited to necessity
Accurate and kept up to date
Retained no longer than necessary
Processed securely
What are ‘special categories’ of personal data?
Sensitive data needing extra protection, including race, religion, political beliefs, trade union membership, health, sexual orientation, biometric and genetic data.
Who is a data subject?
A natural person whose personal data is processed.
What is a data controller?
A legal person (usually an organisation) who determines why and how personal data is processed and ensures compliance with data protection rules.
What is a data processor?
A person or organisation that processes personal data on behalf of the data controller.
What are the lawful bases for processing personal data under UK GDPR?
Consent
Contract
Legal obligation
Vital interests
Public task
Legitimate interests
What rights does a data subject have under UK GDPR?
The right to access, correct, erase, object to processing, and transfer their data.
What must organisations do to demonstrate compliance with UK GDPR?
Establish governance roles, record processing operations, document policies, and perform data protection impact assessments for high-risk activities.
What is a restricted transfer under UK GDPR?
A transfer of personal data to a non-UK controller or processor, allowed only if the recipient is covered by UK adequacy regulations or safeguards are in place.
Who is responsible for enforcing the UK GDPR?
The Information Commissioner.
What must firms do in the event of a significant personal data breach?
Report it to the Information Commissioner.
What powers does the Information Commissioner have to enforce UK GDPR?
Require information from organisations
Conduct compulsory audits
Issue undertakings
Issue monetary penalty notices
Serve enforcement and assessment notices
Serve ‘stop now’ orders
Prosecute
Conduct consensual assessments (audits)
Issue temporary or permanent bans on data processing
What is are the criminal offences under UK GDPR?
Failing to comply with an information or enforcement notice
Failing to properly notify the ICO
Processing data without authorisation
Re-identifying individuals from pseudonymised or anonymised data
What is the maximum penalty under UK GDPR for serious breaches?
The higher of £17.5 million or 4% of an organisation’s total annual worldwide turnover from the previous financial year.
What does the Pensions Regulator (TPR) oversee?
Work-based (occupational) pension schemes and some personal pension schemes with direct pay arrangements.
What are the key aims of the Pensions Regulator?
Ensure automatic enrolment
Protect scheme members’ benefits and savings
Promote good scheme administration
Reduce risks leading to Pension Protection Fund claims
Maximise employer compliance under the Pensions Act 2008
Minimise impact on sustainable employer growth
How does the Pensions Regulator approach its work?
With a risk-based approach, focusing on prevention rather than reaction, considering both likelihood and impact of risks.
What are the three broad categories of TPR powers?
Investigating schemes
Putting things right
Acting against avoidance
Give two examples of actions TPR might take when “putting things right.”
Recover unpaid contributions
Disqualify unfit trustees
What powers does TPR have to act against avoidance?
Prevent employers from avoiding obligations
Issue contribution notices
Issue financial support directions
What must pension trustees have under the Pensions Act 2004?
Sufficient knowledge and understanding of pension and trust law, scheme funding, investments, and scheme documentation.
What is the purpose of the Pension Protection Fund (PPF)?
To protect members of private sector defined-benefit schemes when an employer becomes insolvent and cannot fully fund pensions.