Data Management Flashcards
What should be considered when sourcing data?
When accessing data, it is essential to consider the reliability of the source and associated risks; where possible, you should verify data against an alternative source through ‘triangulation’
What is triangulation?
Triangulation in data management refers to a research strategy where multiple datasets, methods / theories, investigations are used to address a research question.
By doing so, researchers aim to enhance the validity and credibility of their findings and mitigate any potential research biases.
What are Ballymore’s data protection protocols?
It is essential that data is kept safe from corruption and that access to it is suitably controlled to ensure privacy and protection.
At Ballymore we have:
- Regular software updates to ensure the latest security & anti-virus software
- Staff training with spotting Phishing emails (spam)
- Password protection for data systems (IFS)
- VPN & two-factor authentication requirement when working remotely
What are Copyrights?
- A set of exclusive rights granted to the author or creator of any original work, including the right to copy.
- These rights can be licences, assigned, or transferred.
- Form of intellectual property.
- Crown Copyright refers to all material created and prepared by the Government e.g., laws, public records, official press releases etc.
- It is essential to acknowledge any copyright for information duplicated in your work.
What is the UK General Data Protection Regulation and the Data Protection Act 2018
DPA (Data protection Act 2018) controls how personal information is used by organisations, businesses or government
DPA is the UKs implementation of the GDPR
The EUs GDPR no longer applies in the UK, but was almost entirely transcribed into the UK GDPR in 2016. It is covered by the Data Protection Act 2018.
- Aims to create a single data protection regime affecting businesses, and empower individuals to take control of how their data is used by third parties.
- It gives people rights to be informed about how their personal information is used.
What are the key requirements and penalties for non compliance?
Requirements:
- Obligation to conduct data protection impact assessments for high risk holding of data.
- New rights for individuals to have access to info on what personal data is held and to have it erased.
- Data controller decides how / why personal data is processed and is directly responsible for GDPR
- New principle of ‘data accountability’ ensuring that organisations can prove to the Information Commissioner’s Office (ICO) how they comply with the new regulations.
- Data security breaches need to be reported to ICO within 72 hours where there is a loss of personal data and a risk of harm to individuals.
- Fines up to 4% global turnover of the company or £17.5m (whichever greater)
- Policed by ICO.
What are some of the principles of the UK GDPR?
- Information processed lawfully, fairly and transparently
- Collected for specified, explicit, and legitimate purposes
- Adequate, relevant and limited to necessity
- Accurate (kept up to date). Erase inaccurate data.
- Kept no longer than necessary
- Processed in a safe manner
What are the 8 Individual Rights under UK GDPR?
- Right to be informed
- Right to access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Right to automated decision making and profiling
What is the Freedom of Information Act 2000?
Gives individuals right of access to information held by public bodies.
- The public body must tell any individual requesting sight of information whether it holds it.
- Normally the public body is required to supply it in 20 working days in the format requested.
- It can charge for the provision of the information.
What is a Non-Disclosure Agreement (NDA)?
- A legally enforceable contract between two parties relating to sensitive information.
- The agreement will create a confidential relationship between info holder and person with access
- The party that was harmed by the breach of the NDA can take legal action to enforce the agreement and seek damages for any losses
- The duration of NDAs typically range from 1-5 years (circumstances dependent)
What would you do if there was a data security breach and what are the penalties for breaching the Data Protection Act 2018?
If there was a data security breach, I would inform the ICO within 72 hours.
The penalty for breaches are either 4% of the global turnover, or £17.5m, whichever is greater.
What are 3 key benefits of a cloud based storage system?
- Information is backed up securely on encrypted servers.
- Accessibility can be managed via online settings.
- It is more convenient and environmentally friendly to share files online rather than sending phsyical copies
Who are the key persons outlined within GDPR?
Controller
Person or enitity that determines the purposes and means of processing of personal data (e.g., when processing an employee’s personal data, the employer is considered to be the ‘controller’).
BALLYMORE IT
Processor
Person or entity that processes personal data on behalf of the controller (e.g., a call centres acting on behalf of its client) is considered to be a processor. At time, a processor is also called a third party.
ME!
If two separate departments within your firm were working for two rival companies, how would you ensure client sensitive data was managed?
- Make client aware of the risks
- Conflict of interest
- NDAs
What must companies put in place to ensure GDPR compliance?
- Raise awareness across your business.
- Audit all personal data.
- Update your privacy notice.
- Review your procedures supporting individuals’ rights.
- Identify and document your legal basis for processing personal data under GDPR.
- Review how you seek, obtain and record consent.
