Data Management Flashcards
What legislation can you name that applies to data protection in the UK?
- The data protection act 2018.
- UK General Data Protection Regulation (GDPR).
What does data protection mean and what does involve?
- Data protection means using and storing information about people fairly and responsibly.
- It involves being open and accountable, and recognising and complying with individuals’ rights over how their personal details are used, accessed and shared.
What is personal data?
- ## Personal data is information about a specific living person, such as name, address or date of birth
Why do we have laws to protect our data?
Data protection laws aim to ensure all our personal data is kept securely, and used fairly, openly and legally.
Under data protection, what rights are reserved to individual?
- right to be informed (know how data is collected and used)
- right to access (request access to data held about them)
- right to have data erased
- right to have data rectified, if is inaccurate
- right to restrict processing of their data in specific circumstances
- right to data portability (so they can reuse data across different services or for their own purposes)
- right to object decisions results if data is being processed through only automated systems which affect legal rights or financial circumstances (i.e. mortgage application)
What is UK GDPR? and what’s its purpose?
It’s the UK data protection framework which is based on Data Protection Act 2018 and UK GDPR; It’s a privacy and security law designed to protect personal data and how is this used by organisations, businesses and government
Is UK GDPR same as EU GDPR? When does the EU GDPR applies?
UK GDPR follows the same principles, rights and obligations as EU GDPR; The EU GDPR applies if UK organisations offer goods or services to individuals in the European Economic Area (EEA)
What are the Data Protection principles?
- Limited purposes: personal data can only be collected for specified and legitimate purposes. If original purpose changes a new consent is required;
- Data minimisation: personal data shall be adequate and limited to its purposes; no additional info should be collected/stored if not needed
- Accuracy: data must be accurate and kept up to date
- Storage limitation: data must be kept only for the required time and not hold for longer than necessary
- Securely processed: data must be kept safely and be protected by unauthorised access and accidental losses
- Accountability: the controller and processor are responsible for adopting adequate and secure system for using personal data
- Lawfulness, transparency: data shall be processed lawfully, fairly and in user friendly manner, that allows comprehensive understanding from the individual
What is required under article 5(2) of GDPR?
The controller shall be responsible for, and be able to demonstrate compliance with the principles
Under the Data Protection Act, what are the key requirements for businesses handling data?
- Have policies and procedure for data protection in place
- Keeping data security measures up to date
- Carry out data protection impact assessment, to test and check the measures are effective, and improve them where necessary
- Train staff
- Employ an independent Data Protection Officer (DPO) to monitor internal compliance (compulsory for public organisation)
What are the consequences of non-compliance with data protection?
- Compensation claims (i.e. compensate for the loss of money or distress caused)
- Negative publicity
- Financial penalties
What are the financial penalties for data breach and how are they assessed?
Penalties for data breaches are assessed on a case-by-case basis (two tiers):
- low-level offences (i.e. failing to report a breach)
- high-level offences (i.e. infringing individual rights and potential maximum fines are the greater of 20 ml euros or 4% of annual global turnover)
What are the key roles in the data management context?
- Data subject: living person whose personal data is processed
- Data controller: an organisation or individual that decides why and how to process personal data
- Data processor: An organisation or individual that process the data on behalf of the controller
**(If you are an employee and your organisation is the data controller, you might process data to fulfil your organisation’s role as a controller. This does not make you a data processor as defined in the legislation)
What is a data controller?
A data controller decides how and why personal data is processed and is directly responsible for GDPR
What is a data processor?
An organisation or individual that only processes personal data on behalf of the data controller, and in line with their instructions.
Can you give me some example of the data you manage ?
- Client details
- Values
- Plan info
- Project details
- Build costs (BCIS)
- Planning info
- EPC rating
How do you ensure the data that you hold on your clients is kept secure and confidential?
- Limit access to sensitive data use smart passwords and update the regularly
- Use Firewalls and antivirus protection dedicated server
- stay on top of security updates.
What does the RICS say about confidentiality?
The RICS bye-laws say that client’s confidentiality must be maintained for all client’s affairs. This includes all historic information and info provide before an instruction.
Can information regarding client’s be accessed by a third party?
No, unless it’s been approved by the client
Which instances would you be able to disclose client’s information without their explicit consent?
Only when there is a statutory right overriding the client’s confidentiality, such as a request from the police or HMRC
If you receive an email sent by error from a competitor, containing confidential info, what would you do?
Firstly, the info contained in the email cannot be used for my own purpose, and I must advise the sender of this leakage and dispose of the email securely
What BCIS stand for? and what includes?
The Building Cost information Service provides cost and price data for the UK construction industry. It is a part of the Royal Institution of Chartered Surveyors.
Offers numerous product datasets such as
- Build Costs rates based on the location
- BCIS Schedule of Rates
- BCIS Dilapidations Estimating Price Set
How have you changed the way you managed data during COVID 19 and home working ?
- Only use company owned work equipment and ensure that storage of hard copies of files is limited to the office.
- Regular updates for passwords etc.
- Log into secure intranet - no files downloaded locally.
What are the PII requirement for company data?
It is a requirement of our PII insurance that all contracts under deed are kept for a minimum of 12 years and to hand for 6 years. I am aware of the limitation act to claims which can be brought about up to 15 years after the act of negligence.
What is BRE?
BRE is an independent and impartial, research-based advisory, testing and training organisation, offering expertise in every aspect of the built environment and associated industries.
Undertakes and publishes research to allow tackling of the current and future challenges of the built environment.
What should you do if there is a data breach?
Inform the Information Commissioner’s Office not later than 72 hours after becoming aware of it.
Where does BCIS collect its’ data from?
from a variety of sources including construction professionals’ surveys, accepted contracts and tenders and government agencies
What is Tender Price Index?
Measures the trend of contractors’ pricing levels in accepted tenders. BCIS offer this as a service.
What is a Firewall?
It’s a security tool for any organisation that want to protect its computer networks and data from unauthorized access or malicious attacks (viruses)
What information is included in Company House?
- Company name, number and registered office address
- Directors names and addresses
- Shareholder names and addresses
- Accounts and annual returns filed by the company
- Memo and articles of association
- any charges or mortgages over the comapny assets
- details of any insolvency proceedings or liquidation
- statutory filings made by the company
What information type of land interest can be found on Land Registry?
- Freeholds
- Leasehold over 7 years
- Easements
- Restrictive covenants
Name some of the information that can be found on the Land Registry?
- Title register: document including property address, the registered owner, and any rights or restrictions that affect the property
- Title plans: document showing the location, and boundaries of the property on a map
- Charges register: this section is included in the title register and lists any mortgages, liens and other charges that have been registered against the property
- Conveyancing deeds: legal docs that tarnsfer ownership of the property from one party to another. The LR may hold copies if they have been registered with the agency
- Leases that are granted for a term of more than seven years
- Price paid data: sale price, date of sale and property address
- Property boundaries: may include info on shared boundaries