Chapter 13 - Data protection Law

Question 1

What is the primary purpose of the Data Protection Act 2018?

Answer 1

To protect individuals from misuse of their personal information and to set out principles and rights based on the EU’s GDPR.

Question 2

GDPR stands for

Answer 2

General Data Protection Regulation (GDPR).

Question 3

What is the role data controller?

Answer 3

Data controller: Determines the purpose and means of processing personal data.

Question 4

What is the role data processor?

Answer 4

Data processor: Processes personal data on behalf of the controller.

Question 5

What is the role data subject?

Answer 5

Data subject: Identifiable individual (not companies) whose personal data is being processed.

Question 6

What types of personal data does the Data Protection Act apply to?

Answer 6

Personal data held on computer or manual files by any organization (large or small, profit or non-profit) and includes factual records or opinions about an identifiable living individual.

Question 7

Who is the UK regulator for data protection under the Act?
A) The Data Protection Agency
B) Information Commissioner
C) General Data Protection Authority
D) Personal Data Committee

Answer 7

B) Information Commissioner

Question 8

When must be the Information Commissioner be informed of a data breach?

Answer 8

 Is the UK regulator for data protection.
 Has statutory powers to enforce compliance with the Act.
 Must be informed with 72 hours of a data breach that affects the rights and freedoms of individuals (in high risk cases the individuals must be informed as well).

Question 9

What are the penalties for non-compliance with the Data Protection Act?

Answer 9

Criminal conviction if a crime is committed under the Act.

A fine of up to approximately £18 million or 4% of the organization’s global turnover.

Question 10

What does the principle of lawfulness, fairness, and transparency entail?
A) Data must be obtained legally with clear and honest processing.
B) Data must not be shared with external parties.
C) Data must be kept accurate and up to date.
D) Data must not be used for new purposes.

Answer 10

A) Data must be obtained legally with clear and honest processing.

Question 11

What is the principle of purpose limitation?

Answer 11

Data must be recorded and used only for specified and lawful purposes. If used for new purposes, permission must be obtained again.

Question 12

Define data minimization under the Act.

Answer 12

Personal data must be adequate, relevant, and not excessive in relation to the purpose for which it is processed.

Question 13

What does the accuracy principle require?

Answer 13

Reasonable steps must be taken to ensure personal data is accurate and up to date. Inaccurate or misleading data must be corrected.

Question 14

What is the principle of storage limitation?

Answer 14

Personal data should not be kept longer than necessary for the purpose it was processed. Data no longer needed should be destroyed or anonymized.

Question 15

What does the principle of integrity and confidentiality ensure?

Answer 15

Appropriate security measures must be in place to protect data from risks, including technical and organizational measures.

Question 16

What is the right to be informed?

Answer 16

Subjects must be informed about the collection and use of their personal data, including its purpose, retention period, and who it is shared with.

Question 17

How does the right to access work?

Answer 17

Subjects can access their data verbally or in writing, and it must be provided within one month, usually free of charge.

Question 18

What is the right to rectification?

Answer 18

Subjects have the right to have inaccurate or incomplete data corrected within one month of a verbal or written request.

Question 19

Explain the right to erasure.

Answer 19

Known as the “right to be forgotten,” subjects can request data to be erased under certain circumstances. A response must be provided within one month.

Question 20

What is the right to data portability?

Answer 20

Subjects can obtain their data and reuse it in a different service, such as when switching banks.

Question 21

What does the right to object allow?

Answer 21

Subjects can object to the processing of their data, such as to avoid receiving junk mail.

Question 22

When do rights apply in relation to automated decision-making and profiling?

Answer 22

Subjects are granted rights where automated decisions or profiling impact them, with strict circumstances regulating such use.

Question 23

Name 4 areas exempt from the provisions of the Act.

Answer 23

 Employers may process data in accordance with employment law, eg payroll
 Academic institutions (e.g. universities) if the data processed is for academic purposes
 Scientific and historical research organisations where the principles would impair their core activities
 Individual rights are limited where they can be abused to commit crimes, disrupt legal proceedings or otherwise disrupt public authorities and regulators.

Question 24

When are individual rights limited under the Act?
A) To disrupt private businesses.
B) When used to commit crimes or disrupt public authorities.
C) To improve public services.
D) To gain financial advantage.

Answer 24

B) When used to commit crimes or disrupt public authorities.

Question 25

INTERACTIVE QUESTION 33: DATA PROTECTION

Kylie is a data subject of Compliance Bank plc. She has asked to see the information held about her by the bank and paid a fee of £10 to do so. From this, she discovered that some data was inaccurate, as it had not been updated to reflect the fact that Kylie has remarried and changed her name. She is also cross that the bank continues to send her marketing emails for loans that she does not want. Kylie decides to visit her local branch of the bank and asks for the marketing emails to stop within two weeks and for the data to be corrected.

YES OR NO
A Does the bank face a fine for holding inaccurate data on Kylie?
B Was the bank correct in charging Kylie £10 to see her data?
C Must the bank respond within two weeks to Kylie’s demand that the marketing emails cease?
D Must the bank correct the data it holds about Kylie?

Answer 25

A Yes, a breach makes the bank liable for a fine
B No, data subjects should not usually be charged
C No, bank has a month to respond
D Yes, Kylie has a right for inaccurate data to be rectified