Data Management

Question 1

What is GDPR

Answer 1

GDPR is short for the EU General Data Protection Regulation which is legislation designed to harmonise data protection regulations across the EU and give individuals greater control over the privacy and use of their data.

Question 2

What is the Data Protection Act 2018

Answer 2

Data Protection Act 2018 is the UK’s implementation of the EUs GDPR. Since the UK left the EU in Jan 2021, now have UK GDPR which mirrors the EU version.

Covers all aspects of general data and aspects of personal data (reflects modern data usage)
It controls how your personal information is used by organizations, businesses and the government.

Question 3

Name previous act on Data Protection

Answer 3

Data Protection Act 1998

Question 4

What is personal data

Answer 4

includes name, address, date of birth, CVs, appraisals, emails, texts

Question 5

Name the main changes for data protection

Answer 5

1. Fines - now max fine is higher of 20mn euros or 4% turnover
2. Accountability - businesses have to clearly demonstrate compliance
3. Breach Notification - breaches reported within 72 hours
4. Right to be forgotten - gives individuals greater controls over the use and management of their data - deleting records rather than archiving

Question 6

Who controls data protection in Uk

Answer 6

Information Commissioners Office (ICO)

Question 7

What is the role of a data controller

Answer 7

Data controller decides on the purpose for which data is being collected, held or processed primary responsibility for managing and protecting the data

Question 8

What is the role of a data protection officier

Answer 8

Data Protection Officer - primary contact, mandatory for large organisations - overseeing a company’s data protection strategy and its implementation to comply with GDPR requirements

Question 9

Name the 6 core principles for data protection

Answer 9

1. Data must be processed in a lawful and transparent manner
2. Legitimate purpose - personal data must be obtained for specified, explicit and legitimate purposes only
3. Data should be relevant and limited to what is necessary
4. Accurate and upto date
5. Limited storage
6. Secure

Question 10

Describe examples of a data breach

Answer 10

Loss of file, memory stick, laptop, phone, hacking, stolen/misused password

Must report breach within 72 hours

Question 11

Name 8 rights under GDPR

Answer 11

1. Right to be informed
2. Right of access
3. Right to rectification
4. Right to erasure
5. Right to restrict processing
6. Right to data portability
7. Right to object
8. Rights to automated decision making and profiling.

Question 12

How is CJ compliant with GDPR

Answer 12

• Lock computers when not at desk
• All paper documentation is filed in locked cabinets
• When onsite, prevent taking personal information on paperwork
• Prevent sharing passwords
• Don’t have paper files unless really necessary

Question 13

How does CJ ensure confidentiality

Answer 13

– good security of electronic data (firewalls, encryption and passwords), Non Disclosure Agreements

Question 14

What is a non disclosure agreement

Answer 14

Non disclosure Agreements are a legal contract. It sets out how you share information or ideas in confidence. They commonly last 3-5 years and ensures information is kept confidential.

Question 15

What is the main purpose of teh Data Protection Act 2018

Answer 15

to set the guidelines for companies for the collection, processing, storage and protection of personal data and to give individuals the rights to access, and correct their personal data and prevent it from being used for marketing

Question 16

Name RICS new guidance on data

Answer 16

New RICS Guidance – Data Handling and Prevention of Cyber Crime (currently in consultation)

Question 17

What is the freedom of information act 2000

Answer 17

• Gives individuals the rights to access information held by public bodies.
• Public bodies (government / Local authorities) are required to issue information held on individuals within 20 days of request.