Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

If4 claims handling process 2021 (ALL of my study notes that helped me pass) READ THE SINGLE CARDS DECK IN PROGRESSIVE MIX > DPA & GDPR > Flashcards

DPA & GDPR Flashcards

1
Q

The Data Protection Act 2018 (DPA 2018) came into effect in May 2018, to coincide with the implementation of the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) 2016/680/EC .

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the aim of the coincide with the implementation?

A

To modernise data protection laws to

ensure they are effective in the years to come.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The GDPR has direct effect across all EU Member States

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Also the organisations have to comply with the GDPR

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

GDPR allows Member States limited opportunities to make provisions for how it applies in their country.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In the UK, GDPR, have been included as part of the DPA 2018.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

It’s important the GDPR and the DPA 2018 are read side by side.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The main elements of the DPA 2018 include the following:

A

General data processing:
Ensure that sensitive health, social care and education data can continue to be processed to ensure continued confidentiality in health and safeguarding situations can
be maintained.
Implement GDPR standards across all general data processing.
Provide appropriate restrictions to rights to access and delete data to allow certain processing currently undertaken to continue where there is a strong public policy justification, including for national security purposes.
Provide clarity on the definitions used in the GDPR in the UK context.
Set the age from which parental consent is not needed to process data online at age 13, supported by a new age-appropriate design code enforced by the Information Commissioner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Set the age from which parental consent is not needed to process data online at age 13, supported by a new age-appropriate design code enforced by the Information Commissioner. what is this?

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Provide clarity on the definitions used in the GDPR in the UK context??

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Provide appropriate restrictions to rights to access and delete data to allow certain processing currently undertaken to continue where there is a strong public policy justification, including for national security purposes. what is this?

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ensure that sensitive health, social care and education data can continue to be processed to ensure continued confidentiality in health and safeguarding situations can be maintained. what is this??

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Implement GDPR standards across all general data processing?

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Ensuring that sensitive health, social care and education data can continue to be processed to To ensure continued confidentiality in health and safeguarding situations can be maintained.
, what is this process?? :

A

Main elements of the DPA 2018 of the General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is this process relating to?

A

General Data Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Implement GDPR standards across all general data processing.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Provide appropriate restrictions to rights to access and delete data to allow certain processing currently undertaken to continue where there is a strong public policy justification, including for national security purposes.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do National Security Purposes include for continuing processing?

A

The appropriate restrictions to rights to access and delete data to allow certain processing undertaken to continue when there is strong public policy justification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Provide clarity on the definitions used in the GDPR in the UK context.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Setting the age from which parental consent is not needed to process data online at age 13, and supported by a new age-appropriate design code enforced by the?

A

:Information Commissioner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Regulation and enforcement

A

Enact additional powers for the Information Commissioner who will continue to regulate and enforce data protection laws.
• Allow the Commissioner to levy higher administrative fines on data controllers and processors for the most serious data breaches; being up to £17m (€20m) or 4% of global turnover.
• Empower the Commissioner to bring criminal proceedings for offences where a data controller or processor alters records with intent to prevent disclosure following a subject access request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

To levy higher administrative fines on data controllers and processors for the most serious data breaches; being up to £17m (€20m) or 4% of global turnover is the responsibility of:

A

The Commissioner in

Regulation and Enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Empowering the Commissioner to bring criminal proceedings for offences where a data controller or processor alters records with intent to prevent disclosure following a subject access request.

A

True

Regulation and Enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Enact additional powers for the Information Commissioner who will continue to regulate and enforce data protection laws.

A

True

Regulation and Enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Who will continue to regulate and enforce data protection law and requires additional powers?

A

Information Commissioner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Administrative fines, for most serious data breaches are on the?

A

Data controllers and processors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How much is the fine?

A

Up to £17m (€20m) or 4% of global turnover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Who does the GDPR apply to?

A

The GDPR applies to ‘controllers’ and ‘processors’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The definitions are broadly the same as under the now superseded:

A

Data Protection Act 1998 (DPA 1998) –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What’s the difference between the data controller and the data processor?

A

The controller says how and why personal data is processed and the processor acts on the controller’s behalf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The GDPR places specific legal obligations on:

A

Processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Firms are required to maintain records of personal data and processing activities.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A firm has significantly more legal liability if it is responsible for a breach.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

These obligations for processors are a new requirement under the GDPR.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Controllers are not relieved of their obligations where a processor is involved

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

the GDPR places further obligations on controllers:

A

To ensure their contracts with processors comply with the GDPR.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What information does the GDPR apply to?

A

The GDPR applies to personal data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

The GDPR’s definition is more detailed, reflecting changes in:

A

technology and in the way in which information is collected.

39
Q

It makes it clear that information such as an online identifier – e.g. an IP address – can be personal data.

40
Q

The GDPR applies to both automated personal data and to manual filing systems where personal data is accessible according to specific criteria.

41
Q

This is wider than the DPA 1998’s definition and could include chronologically ordered sets of manual records containing:

A

personal data.

42
Q

Personal data that has been anonymised – e.g. key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.

43
Q

The GDPR refers to sensitive personal data as ‘special categories of personal data’. These categories include:

A 
Biometrics 
Ethnic origin 
Genetics 
Health 
Politics 
Race
Religion 
Sexual life 
Sexual Orientation 
Trade union membership
44
Q

What is used for ID purposes in the GDPR personal data special categories.

A

Biometrics

45
Q

Under the GDPR, the data protection principles set out the main responsibilities for organisations.

46
Q

They are similar to those in the DPA 1998 with added detail.

47
Q

The most significant addition is an accountability principle: the GDPR requires firms to show how they comply with the principles.

48
Q

By documenting the decisions they take about a processing activity, this is an example of :

A

Accountability principle

49
Q

What is the accountability principle :

A

Requirement from GDPR for firms to show how they comply with principles.

50
Q

Data Protection Principles

A

All personal data should be:

accurate and, where necessary, kept up-to-date;

51
Q

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed..

A

True
(Data Protection Principles
All personal data should be)

52
Q

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

A

True
(Data Protection Principles
All personal data should be)

53
Q

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;

A

True
(Data Protection Principles
All personal data should be)

54
Q

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

A

True
(Data Protection Principles
All personal data should be)

55
Q

processed lawfully, fairly and in a transparent manner in relation to individuals;

A

True
(Data Protection Principles
All personal data should be)

56
Q

accurate and, where necessary, kept up-to-date; is a example of :

A

Data Protection Principles of personal data

57
Q

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed..

A

True
(Data Protection Principles
All personal data should be)

58
Q

collected for specified, explicit and legitimate purposes but further processed in a manner that is incompatible with those purposes;

A

False ,,,
(collected for specified, explicit and legitimate purposes and NOT further processed in a manner that is incompatible with those purposes;)

59
Q

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;

A

True
(Data Protection Principles
All personal data should be)

60
Q

processed in a manner that ensures appropriate security of the personal data, including protection against :

A

unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

61
Q

processed lawfully, fairly and in a transparent manner in relation to individuals;

A

True
(Data Protection Principles
All personal data should be)

62
Q

For processing to be lawful under the GDPR, firms need to identify a lawful basis before they can process personal data and document it.?

A

TRUE ,,,

Lawful processing

63
Q

This is significant as lawful basis has an effect on an individual’s rights:

A

TRUE ,,,

Lawful processing

64
Q

where a firm relies on someone’s consent, the individual generally has stronger rights,

A

TRUE ,,,

Lawful processing

65
Q

for example to have their data deleted is an example of lawful processing.

A

TRUE ,,,

Lawful processing

66
Q

Consent under the GDPR must be a freely given, specific, informed and unambiguous indication of the individual’s wishes.

A

TRUE,,,

CONSENT

67
Q

Consent can be inferred from silence, pre-ticked boxes or inactivity,.

A

FALSE,,,
(consent CANNOT be inferred from silence, pre-ticked boxes or inactivity,. )
(CONSENT)

68
Q

Firms need to make it simple for people to withdraw consent.

A

TRUE,,,

CONSENT

69
Q

Consent must also be separate from other terms and conditions and be verifiable.

A

TRUE,,,

CONSENT

70
Q

Consent must be some form of positive opt-in

A

TRUE,,,

CONSENT

71
Q

Firms can rely on other lawful bases apart from consent –

A

TRUE,,,

CONSENT

72
Q

Processing is necessary for the purposes of an organisation’s or a third party’s legitimate interests.

A

TRUE,,,

CONSENT

73
Q

As firms were not required to automatically refresh all existing DPA consents in preparation for the GDPR, but if they rely on individuals’ consent to process their data, they must make sure it meets the GDPR standard.

A

TRUE,,,

CONSENT

74
Q

If not, firms must either alter the consent mechanisms and seek fresh GDPR-compliant consent or find an alternative to consent.

A

TRUE,,,

CONSENT

75
Q

Firms were always required to automatically refresh all existing DPA consents in preparation for the GDPR.

A

FALSE,,,
(Firms were NOT required to automatically refresh all existing DPA consents in preparation for the GDPR. )
(CONSENT)

76
Q

The GDPR created new rights for individuals and strengthens some of those that existed under the DPA

A

TRUE,,,

RIGHTS

77
Q

The Rights are:

A 
The right of access
The right to data portability
The right to erasure
The right to be informed.
The right to object
The right to rectification.
The right to restrict processing
and Rights in relation to automated decision making and profiling.
78
Q

Under the GDPR, individuals have the right to access their personal data.

A

True ,,,

Data Subject access request) or (DSAR

79
Q

When providing all the records the firm holds on a particular client such as notes summarising conversations, any recorded conversations and completed documentation are an example of a .

A

Financial services firm

80
Q

Individuals can exercise this right by submitting a DSAR to the organisation concerned, which can be made verbally or in writing.

A

True ,,,

Data Subject access request) or (DSAR

81
Q

The organisation generally has one month to respond to a DSAR, although it can take an:

A

additional two months in certain circumstances.

82
Q

If the organisation fails to respond?

A

the individual must complain to the organisation in the first instance.

83
Q

What If they remain dissatisfied after that?

A

they can make a complaint to the Information Commissioner’s Office.

84
Q

The first copy of an individual’s personal data should be:

A

provided free,

85
Q

although charges are permitted for additional copies :

A

if the organisation feels such a request is unfounded or excessive.

86
Q

Where this is the case, they (the organisation) can ask for a reasonable fee:

A

to cover administrative costs.

87
Q

Accountability and transparency are more significant under the GDPR.

A

TRUE,,,

Accountability and governance

88
Q

Firms are expected to have in place comprehensive but proportionate governance measures?

A

TRUE,,,

Accountability and governance

89
Q

Good practice tools such as privacy impact assessments and privacy by design are now legally required in certain circumstances.

A

TRUE,,,

Accountability and governance

90
Q

Practically, this is likely to have meant more policies and procedures for some organisations, although many will already have good governance measures in place.

A

TRUE,,,

Accountability and governance

91
Q

What tools are are now legally required in certain circumstances under the DPPR in accountability and governance?

A

Good practice such as privacy impact assessment and privacy by design.

92
Q

The GDPR places a duty on all organisations to report certain types of data breach to the :

A

Relevant supervisory authority, and in some cases to the individuals affected.
(Breach notification)

93
Q

The GDPR imposes restrictions on the transfer of personal data outside the European Union, to third countries or international organisations, in order to ensure that the level of protection of individuals afforded by the GDPR is not undermined.

A

True,,,

Transfers of personal data to third countries or international organisations

If4 claims handling process 2021 (ALL of my study notes that helped me pass) READ THE SINGLE CARDS DECK IN PROGRESSIVE MIX (24 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions