11f The Data Protection Act 2018

Question 1

What is personal data?

Answer 1

Data relating to an individual who can be identified from the data with or without other information in the data controllers possession.

Question 2

What is data controller?

Answer 2

A person who alone, jointly or in common with other persons determine the purposes for and manner for which data is to be processed.

Question 3

What is a data processor?

Answer 3

Person other than the employee of the data controller who processes the data provided by the data controller.

Question 4

What should you do when finding out there is a breach of the data protection rules?

Answer 4

1. Asses the severity
2. Any breach should be reported to ICO within 72 hours.
3. Inform directly without delay who is affected if there is a breach likely to be of high risk to the rights and freedoms of data subjects.

Question 5

What happens if the Data Protection Act is not complied with?

Answer 5

This is a criminal offence leading to a fine of up to £17 million or 4% of the organisations global turnover.

Question 6

What data does the act apply to?

Answer 6

Computer based and manual files but not domestic use.

Question 7

What principles must all data be processed in line with?

Answer 7

1. Lawful, fairness and transparency - held for valid reasoning, processed fairly and must be transparent as to why they’re holding it.
2. Purpose limitation - Grounds for holding must be specified and explicit. Purpose must be provided up front and if changed consent is obtained.
3. Data minimisation - data adequate to fulfil its purpose, relevant to that purpose and not excessive.
4. Accuracy - steps taken to make sure data is correct and not misleading.
5. Storage limitation - not held for longer than necessary.
6. Integrity and confidentiality - adequate security measures to protect against risks to the data.

Question 8

What are the rights of the data subjects?

Answer 8

• To be informed: why their datas being collected, how long it’s being retained for and who it’s shared with.
• Gain access to data held on them, request can be verbal or writing and should be provided within 1 month.
• Correct/complete data held (in some circumstances can be rejected). Request should be responded to within 1 month.
• Request data to be erased and should be given response within 1 month.
• Request data is held not processed.
• Obtain data given to data controller and use it for another service.
• Object the use of their data.
• When used to make automated decisions, individual can request info about the processing of data, request human intervention and challenge decisions made based on automated services.

Question 9

What data is exempt from the Data Protection Act?

Answer 9

• Info kept for personal, recreational, family and household use.
• Data relating to national security.
• Info used for prevention of crime.
• Info used for assessments and collection of tax.
• Confidential references.v
• Processing of employee data by employers
• Academic institutions processing for academic puporses
• Scientific and historic research organisations