Part 1 - Design Flashcards
What must Trustees and administrators ensure that admin systems provide
🤍 Reliability
🤍 Flexibility
🤍 Security
List the basic system requirements for a DB Scheme
🤍 Production of letters and emails
🤍 Production of benefit statements
🤍 Data extracts for actuarial valuations and scheme accounts
🤍 Data extracts for HMRC returns and reports
🤍 Operation of a payroll facility and production of P60s for pensioners
🤍 Monitoring of work within the administration function (workflow)
🤍 Electronic scanning and storage of documents
🤍 Electronic transfer or submission of data between parties
🤍 Accuracy - ability to produce a warning message for members with special circumstances
How often does tPR suggest data quality should be reviewed?
On an annual basis
What are the two types of pension data
🤍 Common data
🤍 Scheme-specific data
How long should pension schemes hold member data?
🤍 a minimum of six years after the member is no longer entitled to any benefit under the scheme
List the Common data items for all schemes:
🤍 NI Number
🩶 Surname
🤍 Forename/ Initial
🩶 Sex
🤍 Date of birth
🩶 Date started pensionable service/ policy/ contributions
🤍 Expected retirement date/ Target retirement date
🩶 Membership status
🤍 Last status event
🩶 Address
🤍 Postcode
What three things should a computerised system provide?
- Reliability
- Flexibility
- Security
Basic system requirements for DC schemes
🤍 Member details
🤍 Contributions and Units
🤍 Switching & Lifestyling
🤍 Charges
🤍 Calculations
🤍 Reporting
What acts govern Data protection?
The European Union General Data Protection Regulation (EU GDPR)
enacted in UK through Data Protection Act 2018 (DPA 18)
When did the European Union General Data Protection Regulation (EU GDPR) come into effect?
25 May 2018
What does DPA make provision for?
🤍 the regulation of the processing of personal data relating to individuals which includes:
- obtaining
- holding
- use or disclosure
What is personal data?
🤍 any information relating to an identified or identifiable natural person
How may the identification of an individual for personal data be done?
🤍 Directly: eg a name
🤍 Indirectly: eg a number that can be used to look up a name
What identifiers may an individual be identified by?
🤍 IP address
🩶 Name
🤍 Address
🩶 NINO
🤍 Email address
What does ‘special categories of personal data’ replace?
🤍 sensitive personal data
What can ‘special categories of personal data ‘ include
🤍 Health data
🤍 Sexual orientation
What are the Six Data Protection principles
🤍 Lawfulness, fairness and transparency
🩶 Purpose limitation
🤍 Data minimisation
🩶 Accuracy
🤍 Storage limitation
🩶 Integrity and security
What is the definition of a data ‘controller’
🤍 Data controllers determine the purpose and means of processing data
🤍 The controller is responsible for demonstrating compliance with the data protection principles
What is the definition of a data processor
🤍 Data processors process the data on behalf of the data controllers
What is the right that members have to access their data known as?
Subject Access Request
What is the period to supply data from a Subject access request?
🤍 One month
🤍 Supplied at no cost
What may a trustee do if subject access requests from a member are unfounded or excessive?
🤍 Charge a reasonable fee taking into account the administrative charges
🤍 Refuse to act on the request
Who may be fined for not complying with DPA18
🤍 BOTH the data controller and data processor
What is the maximum penalty to non compliance with DPA18
Higher of:
🤍 £17.5m or
🤍 4% of worldwide annual turnover
What Bill have the government announced that will restructure the ICO (Information Commissioners Office)
🤍 Digital Information and Smart Data Bill
