Data Management - KT Qs

Question 1

What is the main legislation behind Data Protection?

Answer 1

General Data Protection Regulation (2016) (GDPR) aimed to create a single data protection regime for the European Union.

It came into effect in the UK as the Data Protection Act (2018). = Right to be Informed.

Freedom of Information Act (2000) = Right to Access.

Question 2

Does the EU GDPR still apply in the UK?

Answer 2

UK GDPR has adopted the EU GDPR regulation and is incorporated into the Data Protection Act (2018).

Question 3

What is the role of UK GDPR?

What is the role of the Data Protection Act (2018)

Answer 3

UK GDPR is supplemented by the Data Protection Act (2018) and relates to PERSONAL DATA.

It aims to create a single data protection regime and empower individuals to take control of how their data is used by third parties.

Crucially – gives people the RIGHT TO BE INFORMED about how their personal information is used.

Provides a framework for companies processing personal data to ensure this is handled correctly.

Question 4

What is Personal Data under the Data Protection Act (2018)

Answer 4

May include:

Race
Ethnic background
Religious beliefs
Genetics
Biometrics
Health

Question 5

What do you understand about UK GDPR? What are key requirements of GDPR?

Key points about the legislation?

Answer 5

An obligation to conduct data protection impact assessment for high risk holding of data.

New rights for individuals to have access to information on what personal data is held – and the option to have it erased.

A data controller decides how and why personal data is processed and is directly responsible for GDPR.

A new principle of ‘data accountability’ ensuring that organisations can prove to the Information Commissioner’s Office (ICO) how they comply with the new regulations.

Data security breaches need to be reported to ICO within 72 hours where there is a loss of personal data and a risk of harm to individuals.

Fines up to 4% of global turnover of the company or £17.5 million (whichever is the greater).

Policed by the ICO.

Question 6

What are the 8 individual rights under UK GDPR? What rights do you/your clients have in relation to saved data?

Answer 6

1. Right to be informed
2. Right of access
3. Right to rectification
4. Right to erasure
5. Right to restrict processing
6. Right to data portability (to use for their own purposes)
7. Right to object
8. Rights to automated decision making and profiling

Question 7

What do you need to do in the event of a data breach / cyberattack?

Answer 7

Notify the Information Commissioners Office (ICO) within 72 hours of the breach where there is a loss of personal data and a risk of harm to individuals.

Question 8

What is the penalty / what is the fine for non-compliance with UK GDPR?

Answer 8

Fines up to 4% of the global turnover of the company, or £17.5 million (whichever is the greater).

Question 9

Who is UK GDPR policed by?

Answer 9

Information Commissioners Office (ICO).

Question 10

What does the Freedom of Information Act (2000) do?

Answer 10

Freedom of Information Act (2000) = Right to Access!

Gives individuals the right of ACCESS to information held by public bodies.

The public body must tell any individual requesting sight of information whether it holds it.

Normally the public body is required to supply it in 20 working days in the format requested.

It can charge for the provision of the information.

Question 11

What exemptions are allowed under the Freedom of Information Act (2000). When would someone not be allowed to access their information?

Answer 11

Contrary to the GDPR requirements

If it would unduly influence a criminal matter under investigation or a person’s / organisation’s commercial interest i.e. if there is an overriding public interest to not allow access.

Question 12

If you received a Freedom of Information Act (2000) request would you act on it?

Answer 12

The Freedom of Information Act (2000) gives individuals a right of access to information held by the public sector.

The request must be in writing.

Information must not be exempt – e.g. personal data or national security.

If I received a FOI request I would not need to act on it, unless the information was held in the public domain/public body.

(This is becuse FoI relates to info held by public bodies - not confidential information).

Question 13

Does the RICS say anything about Data Management? Any guidance?

(COMMON QUESTION)

Answer 13

Proposed: Professional Standard on: Data Handling and Prevention of Cyber Crime – aimed at how surveyors capture, store and share data.

Likely mandate policies and practices and training for all regulated firms and members.

Question 14

What forms of data security technologies are available?

How can you keep data secure? How would you prevent cybercrime?

Answer 14

Disk encryption – encrypting data on a secure hard disk drive.

Firewalls

Password protection and anti-virus software protection

Regular back-ups off-site

Question 15

What forms of data protection do Cluttons have in place?

Answer 15

All of the above

Password protection folders for client data

Cluttons hold a number of ‘IT Security’ training sessions

Clients have to ‘opt in’ to distribution lists in order to be contacted – if an enquiry has not ‘opted in’ to comply with our GDPR regulations we are unable to contact them.

Question 16

What is Cluttons policy when collecting and storing data?

Answer 16

In compliance with UK GDPR and the Data Protection Act (2018).

Kept for no longer than necessary

Collected for a specified, explicit purpose

Password protected folders with ‘Code Names’ where necessary.

Question 17

How do you hold Client Data?

Answer 17

Password protected folders with ‘code names’ where necessary. This is held for the relevant time (at least 6 years after instruction for PII reasons).

Any paper copies are kept in locked cupboards, main reception security 24-hours a day.

Question 18

What is a Non-Disclosure Agreement (NDA)?

Answer 18

NDA = A legally binding contract that establishes a confidential relationship.

Question 19

What is Copyright?

Answer 19

A set of exclusive rights granted to the author/creator of any original work

Form of intellectual property

Crown Copyright refers to all material created and prepared by the Government – such as laws, public records, official press releases and OS survey maps.

It is essential to acknowledge any copyright information duplicated in work.

Question 20

What are the benefits of Cloud-Based Storage Systems?

Answer 20

Information is automatically backed up on encrypted servers.

Accessibility can be managed via online settings.

Cloud systems are cheaper than the costs of physically storing and managing files.

It is convenient to send and share files online instead of mailing physical copies.

Cloud systems are environmentally friendly.

Question 21

Tell me what practices do you put in place to secure data?

Answer 21

Password protected folders with ‘code names’ where necessary. This is held for the relevant time (at least 6 years after instruction for PII reasons).

Any paper copies are kept in locked cupboards, main reception security 24-hours a day.

Regular back ups off site + Cloud based storage.

Question 22

What are you doing with information if you have a Conflict of Interest?

Answer 22

Request client informed consent they are happy with conflict management.

Creating password protected folders with ‘code names’ - to ensure information / ethical barrier is in place and absolutely no oversight from either party.

Question 23

Are there any regulations governing data management?

Answer 23

GDPR (General Data Protection Act) 2016 = aimed to create a single data protection scheme in the EU.

Data Protection Act (2018) = UK implementation of the GDPR = Right to be INFORMED.

Freedom of Information Act (2000) = Right to ACCESS.

Question 24

Can I get a few takeaways from the Data Protection Act (2018)?

Answer 24

UK implementation of GDPR.

Relates to PERSONAL DATA. Gives individuals the RIGHT TO BE INFORMED about how their personal infomation is used.

Must be used for specific purposes. Must be kept for no longer than is necessary, and must be handled securely.

Policed by the Information Commissioner’s Office (ICO) - data security breches need to be reported to ICO within 72 hours.

Fines of up to 4% of global turnover of the company or £17.5 million (whichever is greater).

Question 25

What rights do you have in relation to saved data?

(What are the individual rights under UK GDPR)?

Answer 25

Everyone has the right to:

RIGHT TO BE INFORMED (about how data is being used).

RIGHT OF ACCESS (their personal data)

RIGHT TO RECTIFICATION (Have incorrect data updated)

RIGHT TO ERASURE

RIGHT TO RESTRICT PROCESSING

DATA PORTABILITY (allowing you to reuse your personal data for different services).

RIGHT TO OBJECT

Question 26

Do you ever use the Government/Valuation Office Agency website?

Answer 26

Yes I used the VOA to establish the rateable value for commercial premises.

Question 27

What information can be gleaned from that?

What was the rateable value of the property in your case study?

Answer 27

VOA published new Rateable Value list for England and Wales in April 2023.

The current multipliers are: £0.49p for RV’s less than £51,000 (small business multiplier) and £0.512p for RV’s of more than £51,000 (higher multiplier).

So for my case study …

The Rateable Value for the 4th floor was £52,500. As this was higher than the threshold of £51,000, I used the higher multiplier (£0.512p).

This = the Rates Payable of £14.50 per sq ft for the 4th floor.

Question 28

Tell me what you can find on the Land Registry website and how this can help you in your work?

Answer 28

Land and property data (Title documents)

Title Deeds.

Title Register.

Title Plan.

Property ownership information.

Part of KYC - proving good title.

Question 29

What does land edged red on the Land Registry website generally signify?

Answer 29

Red edging on a plan indicates the demise of a piece of land.

Question 30

What would you do if there was a data security breach at your firm?

Answer 30

Report to the ‘data controller’ (compliance officer) immediately.

They MUST report the breach to the Information Commissioners Office (ICO) with 72 hours where there is a loss of personal data and a risk of harm to individuals.

Question 31

Are there any fines for non-compliance?

Answer 31

Fines of up to 4% GLOBAL TURNOVER of the company, or £17.5 million (whichever is the greater).