Data Protection

Question 1

What replaced the Act of 1984 for Data Protection?

Answer 1

The Data Protection Act 1998 to allow for the incorporation of the EU Data Protection Directive of 1995

Question 2

What is the Data protection Act in place for?

Answer 2

• To allow private individuals a degree of control over how their personal data is used by organisations

Question 3

Who is responsible for enforcing the act

Answer 3

Information commissioner, an independent UK regulator also responsible for the Freedom of Information Act 2000
The Commissioner also has responsibility for promoting good practice in handling personal information

Question 4

The Act sets out eight data protection principles?

Answer 4

• Must be processed fairly and lawfully, data controller is required to tell the individual what information will be processed and why and whether it is disclosed to others
• Can only be processed for limited purposes
• Must be adequate and relevant for the purpose but not excessive
• Must be accurate and up to date
• Must not be kept for longer than is necessary
• Must be processed in accordance with the individual’s rights
• must be kept secure
• Must not be transferred outside the European Economic Area unless country to which it is transferred has comparable data protection rules.

Question 5

What are the seven rights of individuals under Data Protection Act?

Answer 5

1) Right to subject access up to a fee of £10
2) Right to prevent processing
3) Right to prevent processing for direct marketing
4) Rights in relation to automated decision making
5) Right to compensation
6) Right to rectification, blocking, erasure and destruction
7) Right to ask the Information Commissioner to assess whether the act has been contravened

Question 6

What can the Information Commissioner do if they believe infringement?

Answer 6

• Serve information notice
• Issues undertakings committing a company to a course of action
• Serve a ‘stop now’ order
• Conduct audits
• Serve assessment notices
• Issue monetary penalty notices - up to £500,000 for serious breaches on or after 6th April 2010
• Prosecute for criminal offences
• Report to parliament any concerns

Question 7

What is the maximum penalty for failing to notify Information Commission or processing without authroisation

Answer 7

£5000 unless goes to crown court then unlimited

Question 8

EU law

Answer 8

• Fines of 4% annual turnover or 2% of annual turnover for specified breaches
• Need to notify within 72 hours Information Commissioner
  The EU General Data Protection Regulation agreed Dec 2015