Data Management

Question 1

What is the key principles of the Data protection Act 2018

Answer 1

The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR)

Question 2

What are the key principles of the freedom of info Act 2000

Answer 2

Applies to all public bodies in England, Wales and Northern Ireland. The act relates to all information held in any form. Acknowledge request for information within 20 days.

Question 3

What does GDPR stand for

Answer 3

General Data Protection Regulation which came into force in May 2018

Question 4

What are the rights under GDPR

Answer 4

The right to:
Decisions in relation to automated profiling etc
Access
Informed
Restrict processing
Rectification
Erase
Object
Data portability

Question 5

What are the 6 principles of GDPR

Answer 5

Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality

Question 6

What databases do you use

Answer 6

Land Registry

Planning Portal

Question 7

How do you protect data in your office?

Answer 7

Data is protected by;

• Ensuring consent is received to store data
• Only use data for the exact reason it was collected
• All PC’s and mobile devices are encrypted to ensure high levels of security
• We only process data that is required and delete data when it is no longer required

Question 8

What are the consequences of breaking GDPR regulations

Answer 8

This is the biggest change in GDPR - There are 2 tiers;

Tier 1 (Lesser Breaches): Companies can be fined up to 2% of their annual global turnover or €10million, whichever is greater

Tier 2 (Serious Breaches): Companies can be fined up to 4% of their annual global turnover or €20million, whichever is greater

Question 9

When did GDPR come into force

Answer 9

25th May 2018

Question 10

Who policies GDPR

Answer 10

Information Commissioners Office (ICO)

Question 11

How does your firm protect data?

Answer 11

Information barriers

Do not keep confidential info on desks

Appointed a data protection officer

Question 12

How has GDPR impacted your day to day work? Give an example of a practice that you have had to change since it’s introduction?

Answer 12

Consent to hold customer data

Question 13

How do you keep you professional work secure at home ?

Answer 13

Stronger password, lock the screen when I am not using it and keep computer away from windows.

Question 14

what is the difference between a data controller and data processor ?

Answer 14

The data controller is the person (or business) who determines the purposes for which, and the way in which, personal data is processed.

By contrast, a data processor is anyone who processes personal data on behalf of the data controller

Question 15

Core Principles of Data Protection?

Answer 15

x6 (PLAID)

1 Purpose Limitations – Only use data for the exact reason you collect it.

2 Lawfulness, fairness & Transparency – Is everything legal, fair & transparent for your reasons for collecting the data?

3 Accuracy – All data needs to be up to date & correct.

4 Integrity & Confidentiality – Security needs to be up to speed, both on PCs (by encryption) & physically (organise so documents are not accessible)

5 Data minimisation - only process data you require. Don’t process extra information that is not needed

6 Storage Limitation – Delete data when it is no longer required

Question 16

What are the procedures for data breaches under GDPR?

Answer 16

Before there was no obligation to report a data breach. Under GDPR you now have 72 hours to report to the Data Protection Commission.

Question 17

What is the purpose of a Data Protection Officer?

Answer 17

A Data Protection Officer is now required if your company is;

• An organisation that carries out ‘regular & systematic monitoring of individuals on a large scale’
• An organisation that carries out the large-scale processing of special data categories, such as health records or criminal convictions
• A public authority
  The DPO is in place to be the Data Protection representative. They will make sure everything in your company is above board & in compliance with the law

Question 18

How the new GDPR rules affected you carrying out your duties?

Answer 18

As a company we;

• Got an external company into the office to advise (Code-in-motion)
• Brainstorming session
• Full audit on stored data
• Performed a risk analysis for data held on each employee
  o Name
  o Why is this data held?
  o Who has access?
  o Who is the data sent to outside office?
  o Who can access the files?
  o What could be done to protect the data
• Letter issued to employees asking for consent to personal data
• Steps taken for encryption of all business phones & laptops
• Website updated to show data protection policy