Module 16 Flashcards
What is GDPR?
enacted by the EU to harmonise all the data protection laws used across Europe
How is GDPR embedded in UK law?
by the data protection act 2018.
Who is responsible for protecting data?
the information commissioners office (ico) who is an independent authority
who enforces information laws in Scotland?
Scottish information commissioners office
Who does GDPR apply to?
any business or organisation which uses information for any business of non household purpose.
What is processing information under GDPR?
collecting, recording, storing, disclosure or other use of personal data by the business.
Who must have a Data protection officer?
organisation how regularly process data or those in the public sector who deal with large amounts of personal info e.g. the NHS.
What does the EU directive that led to GDPR require of personal data?
- processed in a fair and legal manner
- for a purpose
- not excessive
- accurate
- current
- kept no longer than deemed necessary
What rights to EU citizens have regarding their data?
- access data
- correct, erase, o block info
- object to usage
- oppose automated decisions
- judicial remedy and compensation
What fine can be charged for data breaches?
up to 17 million or 4% of global turnover
What must companies do if there has been a data breach?
Reveal this, even if only one company is affected. They have 72 hours to report a breach to the ICO
How can you identify a user?
- something you have e.g. token
- something you know e.g. PIN
- something you are e.g. thumbprint, signature, face id
What are the simple changes to protect info?
- passphrases not words, or even better, Touch ID
- lock all devices
- access controls
- update all software
- dont use work laptop for personal reasons
- firewalls
How can individuals protect the information?
- Anti theft devices
- avoid public wifi
- check web addresses for security, https
- be cautious about sharing on social media
- turn off location services
What is a denial of service attack?
malicious attack with the intent of restricting the operation of the server. flood communication ports and memory of a target site.