Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IF 2 > CHAPTER 12 CONFIDENTIAL INFORMATION AND DATA PROTECTION > Flashcards

CHAPTER 12 CONFIDENTIAL INFORMATION AND DATA PROTECTION Flashcards

1
Q

The General Data Protection Regulation applies to

A

It applies to the controllers and processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Who is a controller

A

The one that says why and how personal data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who is a processor

A

One that acts on the controller’s behalf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What type of regulations does the General Data Protection Regulation place on the processor

A

It places specific legal obligation, like requiring them to keep records of personal data and processing activities.Firm faces more legal liability if its responsible for a breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Are controllers under the GDPR relieved of their obligation where processor is involved

A

No, they are not, the GDPR places further obligation on controllers to ensure their contracts with processors comply with the GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What information does the GDPR apply to

A

It applies to personal data, and reflects the changing technology and the way data is collected. Online information like IP address can also be personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of data does the GDPR apply to

A

It applies to both automated personal data and manual filing system where personal data is accessible according to specific criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How is the GDPR a wider version of the Data Protection Act 1988

A

It’s definition is wider and include chronologically ordered sets of manual records containing personal data. Also including personal data that has been anonymised fall within the GDPR scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the sensitive personal data of the GDPR

A
  • race
  • ethnic origin
  • politics
  • religion
  • trade union membership
  • genetics
  • bio metrics
  • health
  • sex life
  • sexual orientation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which is the most significant principle under the GDPR

A

Accountability Principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How does the Accountability principle work under the GDPR

A

It requires firms to show how they comply with the principles i.e. having records/documentation for the decision they take about processing activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Under the GDPR, data protection principles sets out

A

It sets out the main responsibilities for organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is required for processing to be lawful under the GDPR

A

Firms need to identify a lawful basis before they can process personal data and document it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does lawful basis have an effect on individual’s rights

A

Firm has to rely on someone’s consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How must consent under the GDPR be given

A

It must be freely given, specific, informed and unambiguous indication of the individual’s wishes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Under the GDPR consent can’t be inferred from

A

It can’t be inferred from silence, pre-ticked boxes or inactivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Under GDPR consent is separate from

A

It is separate from other terms and conditions and be verifiable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Under the GDPR, what are the new rights for individual and the existing ones under the DPA

A
  • right to be informed
  • right of access
  • right to ratification
  • right to erasure
  • right to restrict processing
  • right to data portability
  • right to object
  • right in relation to automated decision making and profiling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are more significant under the GDPR

A

Accountability and Transparency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the good practice tools for accountability and governance used by firms

A

Privacy Impact assessments and privacy by design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Under GDPR breach notifications should be reported to

A

It’s a duty on all organisation to report data breach to the relevant supervisory authority and in some cases individuals affected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What restriction does the GDPR impose on transfer of data

A

It imposes restriction on the transfer of data outside the EU and to third world countries or international organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why does GDPR impose restriction on the different areas of transfer of data

A

This is done to ensure level of protection of individual afforded by the GDPR is not undermined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The Data Protection act 2018 came into effect May 2018 so as to coincide with

A

The implementation of the GDPR and Law Enforcement Directive (LED)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the aim of Data Protection ACT 2018

A

It aims to modernize data protection laws to ensure they are effective in the years to come

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The GDPR has direct effect across EU member states and organisations have to comply with, however what does it also allow

A

It allows member states limited opportunities to make provision for how it applies in their country, thus in the UK has been included as part of the data Protection Act 2018. It is important the GDPR and DPA 2018 to be read side by side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the main elements of the Data Protection Act 2018

A
  • General Data Processing

- Regulation and Enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

For Regulations and Enforcement fines on controllers and processors for most serious data breaches are up to

A

Up to 17 million pounds or 4% of global turnover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

For Regulations and Enforcement for situations where a data controller or processor has altered records with intent to prevent disclosure following subject access request what should the punishment be

A

Criminal proceedings for offences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

When considering the storage and disposal of documents, insurance organisation must adhere the following basic principles

A
  • Restricted Access
  • File saving and Backup
  • Source documentation retention
  • Protection against theft
  • Copyright
  • Use of password
  • File disposal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

For Restricted access, with physical paperwork, what should a firm ensure

A

Paperwork are locked in filing cabinet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

For Restricted access, with computers, what should a firm ensure

A

Have sophisticated access control for each user and additional restrictions on view only data or data that can be operated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Why has the need of greater sophistication in restricting access to sensitive data increased

A

This is due to the tremendous growth in the use of mobile equipment, allowing more access points. And also an increase in illegal activities of people attacking companies’ system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Why are more individuals attacking companies’ system

A

toe extract data for fraudulent aims, theft, ransom or simply disrupt the company as a means of protest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Online back up is similar to

A

Cloud backup. it simply means backing up to a service provider’s site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How do customers pay a service provider to handle backups

A

Pricing is based on capacity ,frequency and backup size, bandwidth and number of users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which companies are prime use cases for online back up

A

Companies with lower backup volume and smaller IT teams

38
Q

Online computer back up service provider must assure what in terms of security

A

They must assure firms that their data is safe and service providers processors comply with current legislation

39
Q

Most online backup product feature

A

Encryption and access control

40
Q

In order to maintain documentation retention, what shall a firm ensure

A

It must ensure that original source data is stored in a secure separate building.

41
Q

How can a firm import computer virus

A

By allowing unauthorized software to be imported onto a computer system

42
Q

What could an imported computer virus do

A

In its worst form they could jeopardize all of the data held on the computer/network.

43
Q

Apart from computer virus, what is another way that an insurers document can be attacked

A

When unauthorized person gains access,steal or corrupt data relating to individuals and corporation.

44
Q

What is Copyright

A

Computer data originated by an organisation is entitled to legal protection

45
Q

What happens if data is copied whilst protected by copyright

A

This means an infringement has occurred which is an illegal act, person doing/permitting this illegal act is liable to prosecution

46
Q

What are the usual failings of passwords

A
  • use simple reference to close family
  • use of dates of birth/family ages/telephone
  • use of favorite animal names
  • inadvertently allowing others to use your password
  • leaving machine unattended without logging out
  • not changing password regularly
47
Q

Even with a use of strong password how can malware enter a system

A

They can enter via an email account,where by user opens the email thinking its harmless.Then this malware will establish itself on the individual machine and spread to major section of the system

48
Q

What will help overcome password failings

A

Strict company rules and ongoing security awareness program within the b’ness

49
Q

Who is allowed to dispose of files

A

Only an authorized personnel

50
Q

Which information is kept for long time

A

Information of a policy that is in force and has a liability element, always a possibility of a claim arising

51
Q

Which information is kept for short time

A

Information in relation to quotation that was never given up by a proposer

52
Q

For a written or printed confidential information, what is used to dispose information

A

An authorized person uses paper shredder system

53
Q

What is another method of disposal of written or printed confidential information

A

Confidential waste is stored separately and disposed regularly by specialist confidential waste contractors. This expensive alternative is operated by banks and building societies

54
Q

Corporate data must be protected from

A
  • malicious alteration
  • deliberate destructive acts
  • industrial espionage
55
Q

Personal data must be protected from

A
  • being used for blackmail

- unauthorized disclosure

56
Q

Why is computer security becoming an ever key issue

A

Due to the rapid development of Local Area Networks(LAN) and widespread use of WI-FI

57
Q

Under the GDPR what are data controllers supposed to inform Information Commissioner

A

They must notify the office of the information commissioner with details of the data held and its purpose. And then the information commissioner maintains a register of this information

58
Q

What is the duty of the information commissioner

A

Too oversea the working of the data processing law

59
Q

When is a data controller said to commit an offence

A

When they fail to comply with data processing principles. If they process data without notifying the office of the information commissioner

60
Q

When can personal data be transferred to territories outside the EU

A

If the country/territory to be transferred ensures an adequate level of protection for rights and freedom of data subjects in relation to the processing of personal data

61
Q

Under the Money Laundering regulation, disclosure of data to the NCA is permitted

A

Where there is actual or suspected money laundering activities

62
Q

What is the Computer misuse Act 1990

A

This Act was passed to provide a deterrent against all kinds of unauthorized computer access

63
Q

What are the three new criminal offences created by the Computer Misuse Act 1990

A
  • unauthorized access to computer
  • unauthorized access to computer with intent to commit serious crime
  • unauthorized modification of computer material
64
Q

What does the Computer misuse Act 1990 also set out

A

It sets out maximum penalties for the new criminal offences

65
Q

What are price comparison site/ aggregates

A

These are websites used for purchasing insurance, they enable a client to gain several quotes via electronic e-quote form

66
Q

How do the price comparison websites communicate with insurers

A

They conclude agreements with a number of insurers to provide comparative quote based on a pre-determined list of specific needs as disclosed by potential clients

67
Q

What do price comparison websites optimize

A

They optimize user experience,customer insights and search engine performance across a variety of mobile platforms

68
Q

What is the criticism for price comparison sites

A

They focus too much on price

69
Q

What does the internet of things involve

A

They involve communication and interaction between networked devices that relay information across the network

70
Q

The connected devices on the internet of things include

A

Sensors that can control temperature/sense smoke/detect escape of water from leaky pipes

71
Q

How do the internet of things devises help insurer

A

They help insurers more accurately underwrite polices and offer personalized cover, as they are a source of key for real-time data on customers

72
Q

For Internet of things, the collection and processing of detailed data gives rise to which challenges

A
  • who will be allowed to collect the data
  • how will the data be stored
  • how will the data be used
  • who will have access to the data
73
Q

What are telematics

A

This consists of high frequency motion sensors which capture how the car is driven

74
Q

Where have telematics been commonly used

A

Emergency services and formula one teams

75
Q

Telematics provide which type of information

A
  • the time of day/night the car is driven
  • the speed at which it was driven
  • how smoothly it s driven
  • whether breaks are taken on long journeys
  • how many motorway miles are driven
  • the total mileage
  • the total number of journeys made
76
Q

Who will have access to the information provided by the telematics

A

The aggregator collecting the information, the insurer and software provider

77
Q

How is social media defined

A

Its defined as a collection of online media tools and channels that foster communication and conversation, not only delivering content but also allowing interaction and participation in the development of the content being discussed

78
Q

For insurers how is social media helpful

A

They can provide a continuous,interactive relationship with the customer, it offers multiple opportunities to listen and engage with individuals and communities in a highly personalized dialogue

79
Q

What are some of the advantages of social media to insurers

A
  • They present a potential reputational risk, where by action is taken against an organisation if its considered to be unfair by the public,these detrimental comments can spread rapidly nationally or even internationally through social media campaign
  • A lot of consumer information from communication with the insurer is stored and protected in the social media database also thus bringing additional risk
80
Q

How do insurers use Apps

A

They use apps for reporting and managing claims on motor and household policies. These apps also allow insured to take photos from their camera phone and upload them, and claim contact information is made available quickly to record the claim details

81
Q

The future of data gathering and storage within the insurance industry is shaped by

A

General Data Protection Regulation(GDPR)

82
Q

What are the Key areas which will be specifically affected by the GDPR data gathering and storage

A

-An underwriter is required to collect and review personal data of the applicants ranging from demographics to more sensitive special categories data, any misprocessing of these sensitive data will attract a higher fine under the two GDPR fine brackets( 4% of global annual turnover or 20 million pounds)
-More personal data obtained the more it will help in pricing of a risk, but in order to process such information on a large-scale, companies need to carry out formal data protection impact assessment
-Under the GDPR marketing(selling individual personal data to insurers e.t.c.) requires positive opt in by the individuals to state their consent and preference on whether they want to be contacted. This consent is given freely and individuals can easily withdraw their consent and be forgotten. The data subjects also have the right to receive their personal data held by controller or transmit them to another controller
-

83
Q

What does data protection impact assessment require

A

It requires for companies to carefully record the necessity and proportionality of processing, assess risks posed to the rights and freedoms of data subjects and document planned measures to address these risks

84
Q

When insurers use direct marketing methods, where do they collect data

A
  • They collect data directly

- They also purchase data from third party providers

85
Q

What are insurance companies required to do to comply with all the GDPR new rights and other changes

A

They will have to review and make the appropriate changes to improve their IT infrastructure and revisit data retention and disposal policies

86
Q

Personal cyber protection insurance is marketed for which type of companies

A

It’s marketed for High Net Worth Individuals(HNWI)/ Commercial Companies

87
Q

How are the cyber products distributed

A

They are distributed through brokers as standalone cyber protection insurance or add- on product to home cover

88
Q

For cyber products being distributed as add on products to home cover what type of cover does it provide

A

The policy will cover everyone in the household against loss due to

  • defamation
  • cyber bullying
  • loss of insured data
  • online retail/banking fraud
89
Q

What is ransomware

A

This is when a cyber bully restrict access of the infected system until a ransom is paid

90
Q

Thus in summary what are the challenges facing the insurance industry

A
  • Price Comparison sites
  • Internet of things
  • Telematics
  • Social Media
  • Mobile Technology
  • GDPR and Data Protection
  • Cyber Crime

IF 2 (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions