LO4 legislation

Question 1

what year was the Data Protection Act introduced? 4.1

Answer 1

2018

Question 2

what dose GDPR (1998) stand for? 4.1

Answer 2

general data protection regulation

Question 3

what dose GDPR and the data protection act do? 4.1

Answer 3

protects the privacy of data of individuals that is stored in computers and processed by organisations

Question 4

how dose the data protection act work? 4.1

Answer 4

each person who has data stored = a data subject. employees in an organisation must be appointed as a data controller and they are responsible for registering with the information commissioner. the information commissioner is responsible for managing several laws. when registering the data controller must be clear on what information they are collecting, why its being collected and what it will be used for.

Question 5

what are the six principles for the data protection act 2018? 4.1

Answer 5

• data must be collected lawfully and processed fairly
• collected data must only be used for the reasons specified
• data must be relevant and not excessive
• data must be accurate and up to data
• data must not be stored for longer than necessary
• data used must be stored and processed securely

Question 6

what actions must an organisation take to stick to the data protection act 2018? 4.1

Answer 6

• the company must appoint and register a member of staff to be the data controller
• strong security measures
• staff should be trained to be aware of their responsibilities
• data subjects should be given the opportunity to alter their data
  data should be deleted if no longer needed
• data subject have the right to make a subject access request

Question 7

rights of data subjects 4.1

Answer 7

If an individual wishes to access their data they must submit a subject access request (SAR) which results in the following steps:
- The organisations data controller must be written to and told exactly what information that is required to access.
- An administrative fee should be paid to the organisation but only if the request requires excessive efforts to fulfil.
- The organisation must provide the requested information within 40 days.
- The individual must verify their identity using appropriate ID because only the data subject can request their data.

Question 8

when was the computer misuse act established? 4.1

Answer 8

1990

Question 9

why was the computer misuse act introduced? 4.1

Answer 9

Was introduced as computers became cheaper and more common at home and work. The act attempts to stop and punish those who use computers inappropriately. Breaking any of the three principles could result in fines and a jail sentence but only if it can be proved that it was done on purpose and not on accident.

Question 10

what does the computer missuse act entail? 4.1

Answer 10

1. No unauthorised access to data. E.g. hacking a computer system.
2. No unauthorised access to data that could be used for further illegal activates. E.g. accessing personal data to use as blackmail or identity theft.
3. No unauthorised modification of data. E.g. spreading a virus to change data.

Question 11

when was the freedom of information act introduced? 4.1

Answer 11

2000

Question 12

what does the freedom of information act allow? 4.1

Answer 12

allows people to request public authorities to release information

Question 13

examples of public authorities 4.1

Answer 13

local councils, government departments, universities and hospitals

Question 14

in what forms can an information request be submitted? 4.1

Answer 14

letter or email within 20 days of sending the request

Question 15

why might some requests not be accepted? 4.1

Answer 15

too expensive to process, or involves sensitive data

Question 16

when was the regulation of investigatory powers introduced? 4.1

Answer 16

2000

Question 17

what does the regulation of investigatory powers act do? 4.1

Answer 17

used to monitor and access online communication of suspected criminals.

Question 18

what powers does the RIPA grant? 4.1

Answer 18

• Internet service providers ISPs must provided access to the suspects online communication such as emails or social media.
• Locked or encrypted data may be accessed such as online messages.
• ISPs could install surveillance equipment or software to track the suspects online activity.
• Surveillances may take place to physically track the suspect e.g. in private vans or by under cover officers in public spaces.
• Access may be granted to personal information

Question 19

what year was the copyright, designs and patents act introduced? 4.1

Answer 19

1988

Question 20

what does the copyright, designs and patents act do? 4.1

Answer 20

makes it a criminal offence to copy work that isn’t your own without permission of the creator/copyright holder. Owning the copyright of an image might not prevent others form copying and using it but this means that the owner can bring legal proceedings in court to those who have stolen their work. Creators of copyrighted work can take ownership of their work and control how it is used. Others must ask for permission to use the work otherwise to copyright holder can ask for it to be removed or demand a fee for its use.

Question 21

what does the copyright, designs and patents act specifically prohibit? 4.1

Answer 21

• Making copies of copyrighted material to sell to others
• Importing and downloading illegally copied material (except for personal use)
• Distributing enough copyrighted material to have a noticeable effect on the copyright holder
• Possessing equipment used to copy copyrighted material, as part of business

Question 22

what is the information commissioner? 4.1

Answer 22

The information commissioner is the senior government official in charge of the country’s freedom of information requests and the protection of personal data.

Question 23

what does the information commissioners office describe itself as? 4.1

Answer 23

“the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.”

Question 24

what does the information commissioners office do? 4.1

Answer 24

Publishes codes of practices about various data protection and privacy topics, usually related to explaining the data protection acts. For example, the ICO has a code of practice regarding how organisations should share data and another code about the use of CCTV. Also offers to help and support both individuals (such as giving access to students to their exam results) and organisations (such as support with legal and electronic marketing).

Question 25

what year was the protection of freedoms act introduced? 4.1

Answer 25

2012

Question 26

what does the protection of freedoms act do? 4.1

Answer 26

There are seven section to this act, revolving around the protection of personal data. It was introduced because there was little legislation about biometric data, and to update older laws.

Question 27

what are the IT sections of the protection of freedoms act? 4.1

Answer 27

1. States how biometric data e.g. fingerprints and DNA, is stored, handled and collected. For example, parents must give consent before their child gives biometric data to a school. Also, biometric data for suspects of minor offences is deleted after a case is closed.
2. Creates new regulation for CCTV and ANPR
3. The disclosure and barring services (DBS) was created to run background checks on anyone wanting to work with children or vulnerable people.
   Extends the freedom of information act 2000 allowing for wider requests to be made.

Question 28

when was the privacy and electronic communications regulations introduced? 4.1

Answer 28

2003, updated in 2011

Question 29

what does the privacy and electronic communications regulations do? 4.1

Answer 29

Regulates how organisations can communicate with individuals.

Question 30

what must companies stick to to abide by the privacy and electronic communications regulations? 4.1

Answer 30

• It is an offence to directly contact an individual unless they have specifically opted in to receive communication. This is commonly managed by using tick boxes on online stores where you must opt in to receiving promotional material
• Companies must clearly state who they are when contacting customers, such as displaying the phone number when calling and not hiding the number
• Organisations must explain how cookies are used on their website
• Companies must only contact customers through contact channels that the customer has previously permitted. This can be done with tick boxes when signing up. Customers can select or deselect methods such as email, phone calls and text messages

Question 31

who is responsible for upholding the privacy and electronic communications regulations? 41.

Answer 31

The information commissioners office is responsible for this regulation and can fine companies that commit unsolicited communications up to £500,000. it is the customer who benefits and is protected by this regulation.

Question 32

when was the equality act introduced? 4.1

Answer 32

2010

Question 33

what does the equality act aim to do? 4.1

Answer 33

The act aims to end discrimination in the workplace and open up opportunities for every employee regardless of behavioural or physical characteristics that are outside of their control.

Within a company, the Equality Act protects staff by stating that protected characteristics should not be a factor in an employee’s promotion or change of any role. Information must be presented in a format accessible to all staff.

Government states that “the equality act legally protects people form discrimination in the workplace and in wider society.”

Question 34

what are some of the protected characteristics? 4.1

Answer 34

Discrimination because of protected characteristics such as gender, race, religion, age and disability are specifically punishable by legal action.

Question 35

what are the global legalisation categories? 4.2

Answer 35

data protection outside of the Uk, EU-US privacy shield, UNCRPD

Question 36

data protection outside of the UK. 4.2

Answer 36

Personal data should never be transferred outside of the UK unless the country receiving the data has adequate data protection laws that match the Data Protection Act 2018/GDPR.

Question 37

what is GDPR? 4.2

Answer 37

GDPR was introduced in all European union countries in 2018. this set of regulations ensures that personal data is protected and can be sent between EU countries. However, many other countries only have partially adequate data protection laws such as the USA and Canada whilst many nations have inadequate or no laws regarding data protection.

Question 38

what is the EU-US privacy shield? 4.2

Answer 38

Personal data can be sent between European countries such as the UK and the united states because of a protection scheme which was known as the ‘safe harbour’ scheme (between 2000 and 2015).

This provided protection to European data in the US and requires both companies engaged in data transactions to sign up to the scheme before personal data could be transferred. The companies must have been assessed as responsible for the security of the data.

Question 39

why was the safe harbour scheme of the EU-US privacy shield stopped? 4.2

Answer 39

The scheme was stopped in July 2020 because the European court of justice argued it did not adequately protect the personal data of Europeans form government access.

Question 40

what does UNCRPD stand for? 4.2

Answer 40

united nations convention on the rights of persons with disabilities

Question 41

what is the UNCRPD? 4.2

Answer 41

This is a united nations human right that stated that disabled people should be able to ‘access information systems’ (article 9) and ‘use digital means to express their opinion’ (article 21).

Question 42

what methods comply with the UNCRPD? 4.2

Answer 42

Using <alt> text on images so that text-to-speech software can describe the image aloud, for the visually impaired. The <alt> tag can be added to the HTML code of an image on a website and will be audibly spoken by specialist reading software.</alt></alt>

Accessibility settings. Websites could allow users to change the font size and style or change the background colour to make text easier to read. Wikipedia presents some articles to be listened to if the user is unable to read them.

Question 43

what is green IT? 4.3

Answer 43

to use computers and IT recourses in an efficient and environmentally responsible way to reduce an organisation’s carbon footprint.

Question 44

what does it mean to reduce a carbon footprint? 4.3

Answer 44

means to decrease the amount of pollution such as CO2 produced by an organisation and to engage in more eco-friendly practice.

Question 45

examples of green IT in practice. 4.3

Answer 45

• Turn off computers, monitors and other connected devices when not in use
• Use cloud storage or virtualisation to reduce the number of physical devices being bought, powered and maintained
• Consider if it is necessary to print a document before doing so and print only what is required
• Adjust power options to help minimise power consumption
• Repair older devices rather than throwing them away
  Recycle ink cartridges and paper, donate older equipment to charities or school for reuse

Question 46

why should we use green IT? 4.3

Answer 46

• To become more sustainable by reducing the companies carbon footprint and positively impacting the environment
• Reducing energy costs (e.g. turning the equipment off when not in use) and saving money
  Improving the public image of the organisation as the people are increasingly environmentally conscious and will prefer to do business with a company that follows environmentally-friendly policies

Question 47

global requirements of green IT 4.3

Answer 47

In the UK, the greening government ICT strategy running between 2011 and 2015 was an annual report that investigated how IT use could become greener with in the government. Positive consequences of this strategy included:

- Using more cloud storge technology, enabling fewer individual storage devices to be purchased reducing emissions
- Using social media more widely to contact voters saving money by posting fewer letters and leaflets
- Increasing the use of teleconferencing and video calls reducing the need unnecessary travel to meetings and avoiding the generation of heavy pollution

Question 48

united nations climate change conference and green IT 4.3

Answer 48

United nations climate change conferences occur every year and are attended by leaders of each country in the united nations. The conferences establish obligations for countries to work towards reducing their carbon footprints and emissions of greenhouse gases. Whilst green IT is not specifically mentioned in these talks, IT is a hugely important sector with large annual emissions that need to be reduced to meet climate change limitations, such as the Paris Agreement.