Week 12 Flashcards
Legal Protections
Four Major Categories of Information Rights Issues:
– Information rights – your personal info
– Property rights – how can it be enforced
– Governance –is internet subject to public law?
– Public safety and welfare; gambling, porn, child
What is Privacy?
Moral right of individuals to be left alone, free from
surveillance or interference from other individuals
or organizations
What is Information Privacy?
Information privacy
– Subset of privacy
– Includes:
* The claim that certain information should not be
collected at all
* The claim of individuals to control the use of
whatever information is collected about them
Privacy Issues
- IS can collect, store, integrate, interchange and
retrieve data very quickly
– e.g. Tesco Club Card - Beneficial effect:
– Efficiency, effectiveness, competitive advantage - Detrimental effect:
– Individual’s right to freedom - Major political issue:
– Development of laws that govern relations between
record-keepers and individuals
What is a web cookie?
A web cookie is a small piece of data stored on the user’s computer by the web
browser while browsing a website. Cookies can also be used to remember
pieces of information that the user previously entered such as names,
addresses, passwords, phone numbers, etc.
While cookies offer convenience for users, they also facilitate tracking of users
and so have data protection implications.
GDPR does not prohibit cookies, but requires users to give permission to use
them when they first visit a website.
Data Collected on E-commerce Sites
– Personally identifiable information (PII); any data
that can identify & locate an individual
– Anonymous information
Types of Data collected on E-commerce sites
– Name, address, phone, e-mail, social security
– Bank accounts, gender, age, occupation, education
– Preference data, transaction data, clickstream
data, browser type
What is Profiling?
Creation of digital images that characterize online
individual and group behavior
What is Google’s adword program?
Businesses pay to get their advertisements ranked at the top
of the search results page, based on the keywords that want to target.
What is CyberLaw?
Laws intended to regulate activities over the
Internet or via the use of electronic data
communications and storage
– Intellectual property
– Privacy
– Freedom of expression
– Jurisdiction
Issues with Cyber Law
– Applicability of analogous legal principles and
precedent
– Internet regulation -national jurisdiction
– Unsettled body of law
Data Protection Acts (1984, 1988, 2002)
- Obtain and process data fairly
- Specified purpose
- Disclose only if compatible with purpose
- Keep safe and secure
- Accurate, complete and up to date
- Relevant and not excessive
- Retain only as long as necessary
- Comply with access request
What must those holding personal information do?
– Give individuals access to their personal data
– Allow individuals to correct or delete any
information about them that is inaccurate or
irrelevant
– Obtain information fairly, openly and transparently
– Use it only in ways compatible with the purpose for
which it was originally collected
– Secure it against unauthorised access or loss
– Ensure that it is kept accurate and up to date
What must those holding personal data not do?
– Further process data in a manner incompatible with
the purpose for which it was given
– Retain it for longer than is necessary for the
purpose for which it was given
Opt-in: EU standard
You must give your explicit consent to have data compiled about you
Opt-out: US standard
Opt-out: US standard
What is Pseudoanonymisation?
Preventing processing personal data being attri-
buted to an individual, without extra information.
* Pseudoanonymised data is encouraged
– extra security of the data
– used for statistical purposes.
GDPR terminology: Personal data
‘personal data’ means any information, including
data that can be combined with other
information, relating to an identified or
identifiable natural person (‘data subject’);
GDPR terminology: Natural Person
‘natural person’ is one who can be identified,
directly or indirectly, in particular by reference to
– an identifier such as a name, an identification
number, location data
– an online identifier or to one or more factors
specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that
natural person
GDPR Terminology: Sensitive Data
‘Sensitive’ personal data
– racial or ethnic origin,
– political opinions
– religious or philosophical beliefs
– trade union membership
– processing of genetic data
– biometric data
– data concerning health
– data concerning a natural person’s sex life
GDPR terminology: Processing
Processing: means performing any operation or
set of operations on personal data, including:
– obtaining, recording or keeping data;
– organising or altering the data;
– retrieving, consulting or using the data;
– disclosing the data to a third party (including
publication);
– erasing or destroying the data
GDPR terminology : Data Controller
is the person or organisation
who decides the purposes for which, and the
means by which, personal data is processed.
* ‘purpose’ of processing data involves ‘why’ the
personal data is being processed
* ‘means’ involves ‘how’ the data is processed.
GDPR terminology: Data Processor
A person or organisation that
processes personal data on behalf of a data
controller, but is not an employee of the DC above
Data might be outsourced to an external company.
Data processors might include
- Marketing agencies
- Offshore Data entry
- Analysts
GDPR Principles
- processed lawfully, fairly and in a transparent
manner in relation to individuals; - collected for specified, explicit and legitimate
purposes and not further processed in a manner
that is incompatible with those purposes;
– archiving shall not be considered to be
incompatible with the initial purposes; - adequate, relevant and limited to what is
necessary in relation to the purposes for which
they are processed; - accurate and, where necessary, kept up to
date - Kept in a form which permits identification of
data subjects for no longer than is necessary
for the purposes for which the personal data are
processed; - Processed in a manner that ensures appropriate
security of the personal data, including
protection against unauthorised or unlawful
processing and against accidental loss,
destruction or damage, using appropriate
technical or organisational measures.
– poor security on other people’s data is illegal
