5.2.1 Personal Data Issues (B03)

Question 1

personal data (+ eggs)

Answer 1

any information relating to an identified or identifiable living person
stored on servers belonging to online services

eggs:
name, age, gender, interests, id numbers (driving licences, passports), location, genetic information, medical information

Question 2

details about personal data

Answer 2

collected every time you post on social media, sign up, use a search engine
stored on servers that belong to online services
sold to other companies for (mostly) advertising and research purposes

also collected by surveillance cameras - to prevent crime and antisocial behaviours

Question 3

privacy

Answer 3

the right to be left alone and free from unwanted scrutiny and intrusion

Question 4

GDPR - consent

Answer 4

organisations legally have to ask for people’s consent of people if they are going to collect and process their final data

consent must be:
freely given (people must be able to say no and organisations cannot require consent in order to use their services)
specific (made clear what data processing activities are being carried out with different pieces of information)
informed (person knows identity of organisation, nature and purpose of data processing activities)
able to be revoked (at any time)

Question 5

Data Protection Act 2018 - responsibilities of data holders

Answer 5

data must be:
processed fairly lawfully transparently
only be used for specified and explicit purpose for which it was collected
used in a adequate, relevant and limited way
accurate and kept up to date (should be)
not kept any longer than necessary
subject must give consent - asked to “opt in” not “opt out”
kept secure - w/ protection against unlawful processing, access, loss, damage

Question 6

Data Protection Act 2018 - rights of data subjects

Answer 6

they must:
be informed
be able to access personal data

they have the right to:
ask for inaccurate data corrected
have data erased
restrict/stop processing of data
data portability (can move, transfer, copy data - eg if another service is offering a better deal)
not be subject to automated decision making without any human involvement (eg profiling - use of data to evaluate a person’s character)

Question 7

Computer Misuse Act 1990

Answer 7

3 types of data misuse:

1 unauthorised access to computer material (programs/data) - still an offence if you are unsuccessful

2 unauthorised access with intent to commit further offences (stealing personal details for identity theft)

3 intentional and unauthorized destruction of software/data (changing data/impairing running of computer - like with a virus)