Data Management Flashcards
What is the Data Protection Act 2018?
UK’s implementation of the General Data Protection Regulation 2016 (GDPR)
What is GDPR?
It aims to create a single data protection regime affecting businesses, and empower individuals to take control of how their data is used by third parties.
It gives people the right to be informed about how their personal information is used.
When did GDPR come into force?
25th May 2018
What are the key requirements under GDPR?
Obligation to conduct data protection impact assessments for high risk holding of data.
New rights for individuals to have access to information on what personal data is held and to have it erased.
A data controller decides how and why personal data is processed and is directly responsible for GDPR.
‘Data accountability’ ensuring that organisations can prove to the Information Commissioners Office (ICO) how they comply with the new regulations`
What happened is GDPR is breached?
“Data security breaches need to be reported to Information Commissioners Office (ICO)
Within 72 hours where there is a loss of personal data and a risk of harm to individuals.
A fine amounting to whichever is greater out of 4% of global turnover of the company responsible or £17.5m (whichever is the greater).”
What are the 8 individual rights under UK GDPR?
- Right to be informed
- Right of access
- Right to rectification
4, Right to erasure - Right to restrict processing
- Right to data portability (to uses for own purposes)
- Right to object
- Right to automated decision making and profiling (as undertaken by insurance companies).
“What does Article 5(1) of GDPR state in
relation to the processing of data?”
Data must be processed lawfully, fairly and in a transparent manner in relation to individuals.
How has your firm changed their data
management practices to comply with GDPR?
“Conducted data protection impact assessments i.e. evaluated risks associated with holding information about individuals.
Ensure data accountability through the appointment of a named data controller.
Contacted individuals who were on distribution lists to confirm that they wanted to be contacted.
Trained staff.
Ensured correct firewalls were in place to ensure appropriate security of personal data”
“Under GDPR, would you be able to transfer
personal data you hold outside of the UK?”
GDPR restricts transfers of personal data outside the European Economic Area (EEA)
Who has received the largest fine under GDPR?
British Airways received a £183m fine in 2019 after hackers stole the personal data 500,000 customers.
What is the Freedom of Information Act 2000?
Gives individuals the right of access to information held by public bodies.
What does the Freedom of Information Act 2000 require of public bodies?
Public body must tell any individual requesting sight of information whether it holds it.
Normally the public body is required to supply information in 20 working days in the format requested.
It can charge for the provision of the information”
What are the elements of a Non-Disclosure Agreement (NDA)?
“Identification of the parties
Definition of what is deemed to be confidential
Scope of the confidentiality obligation by the receiving party
The exclusions from confidential treatment
The length of term of the agreement”
How can security of data be improved?
Disk encryption - encrypting data on a secure hard disk drive
Regular back ups off site
Password protection
Use of anti-virus software protection
Firewalls and disaster recovery procedures”
What are MSCI Real Estate indicies?
Indices which provide investment performance statistics for owners and investors / fund management.
