Week 6 Flashcards
Data Protection (29 cards)
What is ‘Dataveillance’?
Surveillance using personal data instead of physical observation; includes mass and personal surveillance.
Three Aspects of Privacy
1) Information in one’s own possession
2) Information in the possession of others
3) Transborder data flows.
Why is transborder data flow problematic?
Can bypass local laws, e.g., data accessible in one country may be illegal in another.
Purpose of Data Protection Act 1998
Protect individual rights to privacy and regulate personal data processing; now replaced by GDPR.
Key Objectives of GDPR
Protect fundamental rights to privacy; give individuals control over their personal data.
Who is the Data Controller?
Person/entity determining the purpose and means of processing personal data.
Who is a Data Processor?
Processes data on behalf of the controller (e.g., ISP, freelance analyst).
Who is a Data Subject?
An individual whose personal data is being processed.
What is Personal Data?
Data identifying a living individual directly or indirectly, including opinions or intentions.
What is Processing?
Obtaining, recording, storing, altering, retrieving, using, disclosing, erasing data, etc.
What is required for DPA registration?
Data types, purposes, recipients, and non-EU transfers must be declared.
Offence for Failing to Register
Strict liability; fines up to £5,000 (Magistrates) or unlimited (Crown Court).
First Data Protection Principle
Fair and lawful processing; consent or legal basis required; sensitive data needs explicit consent.
Second Principle & Case Example
Use data only for specified purposes. Case: British Gas Trading v. DP Registrar (1998).
Third Principle & Case Examples
Data must be adequate, relevant, not excessive. Case: Runneymede Council & Alitalia Airport.
Fourth Principle & Case Example
Data must be accurate and current. Case: Credit card refusal due to outdated debt record (Greece, 2004).
Fifth Principle
Do not retain data longer than necessary.
Sixth Principle
Respect data subject rights; must provide access on request.
Seventh Principle
Ensure security against unauthorized access or accidental loss; written contract with processors required.
Eighth Principle
Transfers outside EU require adequate protection or consent from data subject.
Right of Subject Access
Request info about held data, processing purposes, and automated decisions (may include a fee).
Rights to Prevent Processing
Prevent processing causing distress or for direct marketing or automated decisions.
Right to Rectification/Erasure
Apply for inaccurate data to be corrected/erased; third parties should be informed too.
Right to Compensation
Available if harm is caused and controller failed to take reasonable care.
