APC Mandatory - Data Management

Question 1

What is personal data

Answer 1

Uk GDPR Article 4
Personal data is any information relating to an identified or identifiable natural person (data subject), and an identifiable natural person is one who can be identified directly or indirectly

Question 2

What is the freedom of information act

Answer 2

Gives individuals the right to access information held by public bodies

Question 3

What are the exceptions to a FOI request

Answer 3

1. Contrary to GDPR requirements
2. It would prejudice a criminal matter
3. CRCA overrides FOI request

Question 4

What are the benefits to cloud based storage systems?

Answer 4

1. Info backed up securely on encrypted servers
2. Environmental friendly
3. Could be cheaper than managing hard copy files

Question 5

What is a non disclosure agreement?

Answer 5

Used to protect against disclosure or sharing of confidential data

Prior to sharing confidential info, the recipient will be requested to sign an NDA to ensure confidentiality

Question 6

If 2 departments within ure firm were working for 2 rival companies how would u ensure data confidentiality

Answer 6

Per RICS Global COI 2018

1) Make client aware of risks involved with COI
2)Request written confirmation from both parties
3) Conflict management;
Ensure single communication lines to client, separate working locations for staff and NDA’s, also make sure data is secure

Question 7

Key persons outlined in GDPR?

Answer 7

CONTROLLER
Determines process and means of processing of personal data (I.e employer processing employees data, employer considered controller)

PROCESSOR
Process data on behalf of controller (ie call centre on behalf of client).

DATA PROTECTION OFFICER
Under GDPR dpo is a required leadership role overseeing data protection

Question 8

What are the 8 individual rights under GDPR

Answer 8

Article 5 Part II
Rights to
1) be informed
2) access information
3) rectify information
4) erasure
5) Restrict data processing
6) data portability
7) object
8) automated decision making and profiling

Question 9

What things must companies put in place to ensure GDPR

Answer 9

Raise awareness
Review proceadures
Audits

Question 10

CEW FS

How is data managed and protected within ure firm?

Answer 10

VOA policy CEW-FS
Clear desk policy
Encryption technology
Waste disposal for restrictive info/data
Fire wall protection
Security markings

Question 11

What is GDPR?

Answer 11

Gives rights and protection to living data subjects over who holds their personal data and how that data is used

Question 12

What are the 7 principles of GDPR?

Answer 12

LDP ASIA
Lawful fair and transaction
Data minimisation
Purpose limitation
Accuracy
Storage limitations
Integrity and confidentiality
Accountability

Question 13

Who is the responsible body for overseeing GDPR in the UK?

Answer 13

Information commissioner office

Question 14

GDPR breach what happens?

Answer 14

Inform ICO within 72 hrs
Can be fined up to 20m euros or 4% of turnover whichever is greater

Question 15

What is the purpose of CRCA 2005

Answer 15

Protect ratepayer confidentiality

Question 16

RNP

How long can you store data for under the CRCA

Answer 16

No time limit but needs to be reasonable, necessary and propotinate

Question 17

What act covers data in the UK

Answer 17

Data protection act 2018 and its amended version 2021 post brexit

Question 18

What happens if you breach CRCA?

Answer 18

Sec 19
Maximum 2 Yr imprisonment or unlimited fine

Question 19

Can you use someone else’s work

Answer 19

Under copyright designs and patents act 1988
Sec 50 allows for stat function
Sec 45 allows for judicial proceeding
If recive permission from copyright owner
In accordance with terms of publisher
Acknowledge source

Question 20

What is the deadline once a FOI or SARS is requested?

Answer 20

Depends
GDPR - Should respond within 1 month (Article 12). This can be extended to 2 months where complex.
FOI - 20 working days

Question 21

Which acts are relevant to data management

Answer 21

GDPR 2016
DPA 2018
CRCA 2005
EIR 2004 (covers foi relating to environmental matters)
Copyrights design and patents act 1988
FOI 2000
PRA 1958 (must manage data in accordance with FOI sec 46)

Question 22

How does your employer store data?

Answer 22

CDB - local taxation and SDLT
EDRM- holds historic correspondence and plans
NBS holds taxation info for non standard properties
CWS holds CCA related information

Question 23

L2 examples

Answer 23

Ashton - Appeal
Took over appeal case. Noted appellant wished for her farther to act on her behalf. Could not located LOA. Requested new LOA in line with GDPR
Manchester
Dealt with agent on challenge who informed they had been disinstructed. Immediately ceased sending any further correspondence and ensured any further data was sent direct to IP

Question 24

L3 examples

Answer 24

Manchester - allowance
Agent sought 7.5 % frag allowance. Unusual building. Extracted data and confirmed allowance was discontinued from 2010 list. Intergoated surrounding rents and confirmed this property was unusual and would mostly likely obtain lower rent in open market. Therefore agreed with agent and awarded allowance.
FOI request reg 17 need to confirm this one

Question 25

Fines under GDPR

Answer 25

4% of global turnover
Or 20m euros

Question 26

What is ISO 27001

Answer 26

First published in 2005 by International organisation for standardisation (ISO) recently revised in 2022.
Widely used global security framework focusing on data confidentiality,integrity and availability [CIA]. It involves audits followed by ongoing certification.
Helps organisations have a better approach to data security

Question 27

What are the main differences between DPA and GDPR?

Answer 27

In summary, the GDPR serves as the foundational regulation for data protection in the EU, while the UK DPA 2018 adapts GDPR principles to the UK’s context, particularly after Brexit

(There is a new accountability requirement- you are required to show how you comply with the principles).