Level 1 Flashcards
What does GDPR stand for?
General Data Protection Regulations
What is the relevant UK legislation that governs data protection?
The Data Protection Act 2018 is the UK’s implementation of GDPR (2016) (European directive), and DPA 2018 replaces DPA 1998
What is GDPR?
General Data Protection Regulations 2016 represents the largest change in data protection law across the EU to include the UK, and relates to the processing of personal data.
What is the purpose of GDPR?
- To create a single data protection regime for anyone doing business in the EU
- To empower individuals to take control of how their data is used by third parties
- Gives people more rights to be informed of how their personal data is being used
When did the most recent Data Protection Act come into effect?
25 May 2018
Is DPA 2018 affected by Brexit?
No as it is the UK’s implementation of the EU’s GDPR directive
What are the 8 individual rights under GDPR?
- Right to be informed
- Right of access
- Right to rectify
- Right to erase
- Right to restrict processing
- Right to data portability
- Right to object
- Rights to automated decision making & profiling
Under Article 5 of GDPR, what are the data protection principles?
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity & confidentiality (security)
- Accountability
What are the key requirements under DPA 2018?
- Conduct data protection impact assessments for high risk holding of data
- Elect a Data Controller who decides how and why personal data is processed & is responsible for GDPR
- Demonstrate compliance with principles to Information Commissioner’s Office (ICO)
When data security is breached, what is the protocol?
Report to ICO within 72 hours, where there is a loss of personal data and a risk of harm to individuals
What are the penalties for breaching data security?
Standard - the greater of 10m euros or 2% of total global turnover
Higher - the greater of 20m euros or 4% of total global turnover
Who polices data protection?
Information Commissioner’s Office (ICO)
What is the Freedom of Information Act 2000?
Provides individuals with the right to access information held by public bodies
Under the Freedom of Information Act 2000, how can individuals access information held by the public sector?
- Request access in writing
- Typically public body required to supply the data in 20 working days in the requested format
- Public body can charge for the provision of info.
N.B. Public body must inform any individual requesting sight of data whether or not they hold this data
Can the public sector provide access to any information that is requested?
Provided that the information is not exempt, i.e.:
- contrary to GDPR requirements
- it would prejudice a criminal matter under investigation
- it would prejudice a person’s/organisation’s commercial interest
- matter of national security