Data Management (Level 1)

Question 1

What does the Data Protection Act (2018) set out?

Answer 1

Data Protection Act (2018)

Controls how personal information can be used and your rights to ask for information about yourself

Sets out the need to use information;
- Fairly
- Lawfully
- Transparently

Question 2

What are the principles of the General Data Protection Regulation (2016)?

Answer 2

EU law on data protection based on the following 7 priniciples:

1. Lawfulness, fairness, transparency
2. Purpose limitation
3. Data minimisation
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Accountability

Question 3

What does the Freedom of Information Act (2000) set out?

Answer 3

Provides public access to information held by public authorities

It does this in two ways:
- Public authorities are obliged to publish certain information about their activities
- Members of the public are entitled to request information from public authorities

Question 4

How do you comply with GDPR and the Data Protection Act 2018 in your role?

Answer 4

To ensure compliance with GDPR and the Data Protection Act I take the following steps in my day to day work:

• Ensure access to data is only granted to people who require it
• I ensure that all files and folders are labelled correctly
• Data is only stored for as long as necessary – either for the length of time needed for a project or to comply with statutory regulations e.g money laundering
• Secure confidential and sensitive information with password encryption
• Only share data using secure systems

Question 5

Give me an example of how you ensure that data is kept securely

Answer 5

• Ensure access to data is only granted to people who require it
• Secure confidential and sensitive information with password encryption
• Only share data using secure systems
• Separate out data in a logical and secure fashion

Question 6

What do the Privacy and Electronic Communications Regulations 2003 apply to?

Answer 6

The Privacy and Electronic Communications Regulations (2003)

• The Privacy and Electronic Communications Regulations (2003) (PECR) sit alongside the Data Protection Act and the UK GDPR.
• They give people specific privacy rights in relation to electronic communications. customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings

Question 7

What is copyright?

Answer 7

Copyright - Copyright is a type of intellectual property that protects original works and stops other people using it without your permission

Question 8

Can copyright be transferred?

Answer 8

A copyright owner can sell or transfer their rights to someone else. This is known as a copyright assignment.

Question 9

Can you tell me about the retention of files and the Limitation Act 1980?

Answer 9

Limitation Act (1980)

• Purpose is to set the time limits on various types of legal action, from this businesses can determine how long they need to keep documents
  states that legal action must be brought within six years of the issue arising.
• Businesses, then, have a responsibility to keep these documents for at least six years after they expire so they can refer to them if there’s a disagreement

Question 10

What is the Land Registry used for?

Answer 10

Land Registry – used to access a title register which includes:

• Title number
• Ownership
• How much the property was last sold for
• Whether the property has a mortgage
• Details of ‘restrictive covenants’ - promises to not do certain things with the land, like not building on a particular area
• Details of any ‘easements’ - the rights of one piece of land over another, like a right of way

Question 11

How do you validate information?

Answer 11

Source – is the source credible and reliable

Time – how recent is the information gathered is it as up to date as possible

Relevance – is the information gather directly related to your need or purpose

Sense check – try to verify the information by cross referencing

Question 12

What is the difference between a deed and a registered title?

Answer 12

Title refers to the ownership of a property

Deeds is the legal document that transfers title from one person to another

Question 13

How do you source title information?

Answer 13

Land Registry – used to access a title register which includes:

• Title number
• Ownership
• How much the property was last sold for
• Whether the property has a mortgage
• Details of ‘restrictive covenants’ - promises to not do certain things with the land, like not building on a particular area
• Details of any ‘easements’ - the rights of one piece of land over another, like a right of way

Question 14

What is an index map?

Answer 14

The index map contains information on all land and property that’s registered or being registered with HM Land Registry. Use it to find the title number of a property that does not appear in a search of the register

Question 15

What does encryption mean?

Answer 15

Encryption the process of converting information or data into a code, especially to prevent unauthorized access

Question 16

What is a firewall?

Answer 16

Firewall is software that blocks unexpected connections coming into or out of a network

Question 17

How can you protect electronic data from viruses?

Answer 17

-Firewall and anti-virus software
- Provide password protection
- Back up your data
- Educate your users on the dangers of viruses

Question 18

Which records are manually kept in your office and why?

Answer 18

Signed contracts – signed in wet ink, original copies may be required for proof of signature

Question 19

What does ISO 27001 relate to?

Answer 19

ISO/IEC 27001 is the world’s best-known standard for information security management systems.

Question 20

What is an Electronic Document Management System (EDMS)?

Answer 20

EDMS - An electronic document management system (EDMS) is a software system for organizing and storing different kinds of documents

Question 21

Are electronic signatures accepted by the Land Registry?

Answer 21

From July 2020 – the Land Registry will accept witnessed electronic signatures with immediate effect

Question 22

What is data redundancy?

Answer 22

Data redundancy occurs when the same piece of data exists in multiple places

Question 23

For which documents can an electronic signature not be used?

Answer 23

They cannot be used for executing wills or codicils, contracts relating to the alienation of immovable property, bills of exchange such as cheques, and long-term agreements for immovable property, which are in excess of ten years

Question 24

Under the Data Protection Act how quickly do you need to report a data breach and who to?

Answer 24

Within 72 hours of a personal data breach that causes harm to individuals to the Information Commissioner’s Office

Question 25

What are the penalties for breaching the Data Protection Act (2018)?

Answer 25

Companies will be fined the greater of 4% of annual turnover of £17.5 million

Question 26

What are the data protection principles Under General Data Protection Regulation?

Answer 26

Everyone responsible for using personal data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

• used fairly, lawfully and transparently
• used for specified, explicit purposes
• used in a way that is adequate, relevant and limited to only what is necessary
• accurate and, where necessary, kept up to date
• kept for no longer than is necessary
• handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

Question 27

What are the penalties for breach of GDPR?

Answer 27

Fined up to 4% of annual global turnover or 20 million euros

Question 28

When considering if there is a personal data breach what are the factors you must consider?

Answer 28

You must consider whether there is likely to be:
- physical or material damage
- emotional distress
- embarassment

Question 29

What is special category personal data?

Answer 29

sensitive data which needs greater protection as it may cause particular harm or distress if improperly used or disclosed

Question 30

What is a controller?

Answer 30

A controller is defined as any entity (company or public authority) that determines the purposes and means of the processing of personal data

Question 31

What is a processor?

Answer 31

A processor is defined as any entity that processes personal data on behalf of the controller.