UK legislation Flashcards
Protection of freedoms act 2012
Why was it introduced?
What are the IT sections of this act?
- It was introduced because there was little legislation about biometric data.
- Part 1 - states how biometric data is stored, handheld and collected.
Part 2 - creates new legislation for CCTV and ANPR use
Part 5 - the disclosure and barring service (DBS) was created to run background checks on anyone want to work with their children or with vulnerable
Part 6 - extends the freedoms of information act 2000 allowing for wider requests to be made.
Data protection act 2018
- What is it?
- How does the data protection act works?
- What are the six principles of data protection act?
- To protect the the privacy of data of people living in the EU. It protects the data of individuals that have it stored on computers and is accessed by organizations
- Am employee within an organization must appointed as a data controller and it is they who are responsible for registering with the information commissioner. When registering with the information commissioner, the data controller should be clear on exactly
- what information they are collecting
- why is it being collected
- what the data will be used for - -data must be collected lawfully and processes fairly
- collected data must only be used for the reason specified
- data must be relevant and not excessive.
- data must be accurate and up to date
- data must not be stored for longer than necessary
- data must be stored and processed securely
Actions organizations should take to stick to the data protection act (2018)
- The company must appoint and register a member of staff to act as the data controller. the data controller is responsible for communicating with the information commissioner (IC) and ensuring that the principles of the DPA are not broken.
- There must be strong security measures in practice to protect data from being accessed or transferred without authorization. This could be in the form of physical or digital protection methods enforced by the company.
- staff should be clearly trained so that they are clearly aware of their responsibilities and each principle is adhered to. for example they should know that the data collected is only used for the data specified and should not be passed on to others without the permission of data subject
- data subjects should be given the opportunity to alter their data and make changes if it is incorrect. Data should be deleted when it is no longer required, so organizations should periodically assess the accuracy and relevance of storing each data subjects information.
- data subjects have the right to make subject access request (SAR) and receive a copy of the data which is stored about them. companies must abide by this request by verifying the users identity and presenting data to them securely
Rights of data subjects
- the organizations data controller must be written to and told exactly what information is required to access.
- an administrative fee should be paid to the organization (only if the request requires excessive efforts to fulfill)
- the organization must provide the requested information within 40 days
- the individual must verify their identity using appropriate ID because only the data subject can request their data
Computer misuse act 1990
- what is the act about?
- what can happen if principles are broken?
- what are the three main principles?
- This act was introduced when computers became cheaper and more common at home and work. this act attempts to stop and punish those who use computers inappropriately.
- breaking any of the principles can result in fines and jail sentence but only if it is proved that it was done on purpose and not by accident.
- no authorized access to data -hacking a computer system
- no authorized access to data that can be used for further
illegal activities - accessing personal data to blackmail or identity theft
- no un authorization modification of data - spreading a virus to change data.
- no authorized access to data -hacking a computer system
Freedom of information act 2000
what does this act about?
- this act allows people to request public authorities to release information. public authorities include governments, universities, hospitals and councils
- a freedom of information request must be formally submitted in a letter or email and a reply from the organization is required within 20 days of receiving the request
- certain requests will not be accepted such as processing the information will be too expensive or if it involves sensitive information protected by the DPA 2018
Regulation of investigatory powers act 2000
the act was introduced in response to the increase in both criminal and terrorist activities on the internet. I t is used to monitor and access online communication of suspected criminals. if criminal activity is suspected by an individual then this
internet service providers must provide access to the suspects online communication, such as emails or social media
locked or encrypted data may be accessed such as online messages
ISPs could install surveillance equipment or software to tract the suspects online activity.
surveillance may take place to physically track the suspect
access may be granted to personal information
This act became controversial as it used widened and local councils were using it for minor offences
copyright, designs and patents act 1988
what is the act about?
what actions does this act prohibits?
this act makes it a criminal offence to copy work that is not your own without the permission of the creator or the copyright holder. This can refer to texts, images, music.
owning the copyright of an image might not prevent others from copying your work but this act means that the owner can bring legal proceedings in court to those who have stolen their work.
Creators of copyrighted work can take ownership for their work and control how it is used. Others must ask for permission to use the work otherwise the copyright holder can ask to be removed or demand a fee for its use
-making copies of copyrighted material to sell to others
-importing and downloading illegally copied material
-distributing enough copyrighted material to have a noticeable effect on the copyright holder
-processing equipment used to copy copyright material, as part of a business.
information commissioner office (ICO) codes of practice
what is this act about?
what does the ICO publish?
what’s the job of an ICO?
An ICO is a senior government official in charge of the country’s freedom of information requests and the protection of personal data.
the ICO publishes codes of practice about various data protection and privacy topics, usually related to explaining the data protection act. For example the ICO has a code of practice regarding how organizations should share data and another code of practice about the use of CCTV.
The ICO helps and supports individuals (giving access to students exam results) and organizations ( support with legal electronic marketing)
privacy and electronic communications regulations 2003
what does the law state?
what are the rules companies must stick to?
updated in 2011 regulates how organizations can communicate with individuals.
- it is an offence to directly contact the individual unless they have specifically opted- in to receive communication. This is commonly managed by using tick boxes on online stores where you must opt-in to receiving promotional material.
- Companies must clearly state who they are when contacting customers, such as displaying the phone number when calling - and not hiding the number
- organizations must clearly explain hoe cookies will be used on their website
- companies must only contact customers through communication channels that the customers have previously permitted. this can be done with tick boxes when signing up. Customers can select or deselect methods such as email or phone calls.
the ICO is responsible for this regulation and fine companies that commit unsolicited communication up to £500,000. It is the customer who benefits and is protected by the regulation.
Equality act 2010
what does the government state
what is the aim of this act
the equality act legally protects people from discrimination in the workplace and in wider society.
discrimination because of protected characteristics such as gender, race, religion and disability are specifically punishable by legal action.
the aim of this act is to end discrimination in the workplace and open up fair opportunities for every employee regardless of behavioral or physical characteristics that are outside of their control
within a company, equality act protects the staff by stating protected characteristics should not be a factor in an employees promotion or change of role. Information must be presented in a format accessible to all staff.
