DATA PROTECTION

Question 1

What is the Data Protection Act?

Answer 1

1998 it provided a clear pathway for how personal data must be dealt with
It refers to living individuals who can be identified by that data
Following GDPR - the DPA was repealed and then replaced by the UK’s data protection act in 2018

Question 2

DATA PROTECTION ACT 2018

Answer 2

transposes the EU Data Protection Directive 2016/680 (Law Enforcement Directive) into domestic UK law.

National security is within scope of the DPA 2018

Question 3

THE DPA 2018 PRINCIPLES

Answer 3

1. Processing must be lawful and fair
2. Purposes of processing must be specified, explicit and legitimate
3. Personal data must be adequate, relevant and not excessive
4. Personal data must be accurate and kept up to date
5. Personal data must be kept no longer than necessary
6. Personal data must be processed in a secure manner

Question 4

DATA CONTROLLER

Answer 4

means a natural or legal person who alone or jointly with others determines the purpose and means of the processing of personal data. They must register with the Information Commissioner’s Office (ICO).

Question 5

DATA PROCESSOR

Answer 5

a natural or legal person who processes personal data on behalf of a data controller. They are not required to register with the ICO.

Question 6

What are the rights of individuals?

Answer 6

a data controller is required to make available to data subjects a range of information:

• the identity and contact details of the data controller and their data protection officer
• the purpose for which their personal data is being processed
• the existence of their right to exercise any of the below rights
• legal basis for the processing of their personal data
• retention period of data used to determine the retention period

Question 7

what to do with a major data breach

Answer 7

firms must make the ICO notified within 72 hours and if not, provide a reason for not doing so

• description and nature of the breach
• name and contact details of a contact point if additional information is required
• description of the likely consequences of the breach
• description of measures taken to address the breach

Question 8

THE INFORMATION COMMISSIONERS OFFICE

Answer 8

The mission is to ‘uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals’

With regards to data controllers, the ICO has the power to levy a fine of up to £17 million or 4% of global turnover.

Question 9

factors affecting the ICOs decision on financial penalties

Answer 9

• nature of the personal data involved
• duration and extent of contravention
• number of individuals actually or potentially affected
• importance, value, degree, amount or extent of the breach
• public importance

Question 10

2019 - the ICO FINED BRITISH AIRWAYS £183.9 MILLION

Answer 10

infringements on GDPR

variety of information was compromised by poor security arrangements at the company, including log in, payment card, and travel booking details, as well as name and address information.