Week 9 Data Protection

Question 1

Personal information

Answer 1

Any information related to an identifiable natural subject

Question 2

Identifiable natural subject

Answer 2

Someone who can be identified (directly or indirectly) by reference to an identifier such as name, ID number, location data, or any other factors specific to their identity

Question 3

Processing of data which reveals racial/ethnic origin, religious beliefs, union membership, sexual orientation or biometrics for identification

Answer 3

Prohibited unless agreed to

Question 4

Data protection law purpose

Answer 4

Give individuals the power to manage their information in the public domain

Question 5

Power of data protection laws

Answer 5

Not absolute
Consenting, knowing, objecting and withdrawing/correcting
Control over what kind of processing and who can process it

Question 6

Processing

Answer 6

Operation on data

Question 7

Controllers

Answer 7

Entities who determine the purpose/means of processing of personal data

Question 8

Major data protection laws

Answer 8

GDPR in the EU
UK GDPR (Post-brexit) alongside the DPA 2018

Question 9

Differences between the EU and UK data protection laws

Answer 9

UK lowers age of consent for children to give data from 16 to 13

Question 10

Data protection must be

Answer 10

By design and by default
Considered right from the start and not as an after-thought
Privacy enhancing technologies are legally mandated

Question 11

Potential penalty for non-compliance of GDPR

Answer 11

€20 million or 4% of global annual turnover

Question 12

Privacy by policy

Answer 12

Implementation of notice/choice

Question 13

Privacy by design/default

Answer 13

PETs, anonymisation, et al.

Question 14

CIA triad

Answer 14

Confidentiality, Integrity and Availability

Must be embedded as far as possible into organisational processes and technical designs

Question 15

GDPR Principles

Answer 15

Lawfulness fairness and transparency (Require consent, necessity, an obligation of interest to collect data)
Purpose limitation (Explicit purpose, no others)
Data minimisation (Only necessary information)
Accuracy (Keep data accuract, correct inaccurate)
Storage limitation (Keep data whilst necessary)
Integrity and confidentiality (Keep data safe)
Accountability (Demonstrate compliance with the other principles)

Question 16

Pseudonymisation

Answer 16

Process of disguising identities, such that you can use data without needing to know the identity of the individuals in the dataset
Protects against unauthorised third party access

Question 17

Achieving pseudoymisation

Answer 17

Hash map (key-coded)
Two-way cryptography algorithm

Question 18

Pseudonymisation considerations

Answer 18

How easy it is to re-trace the data
Size of the population in which the user is concealed
Whether you can link individual records to the same person

Question 19

GDPR pseudonymisation

Answer 19

Incentivised as data is subject to fewer restrictions

Question 20

Anonymisation of data

Answer 20

Offers the strongest protection but curtails the analytical value of it
Outside the GDPR

Question 21

Processor

Answer 21

Entity which processes personal data on behalf of the controller

Question 22

What must engineers do to follor the data protection regulations?

Answer 22

Undefined in the detail

Question 23

Technological neutrality

Answer 23

No mention of specific privacy engineering technologies

Question 24

Foundational question for data regulation?

Answer 24

Can controllers be trusted?, should PETs be designed in a way to minimise trust to avoid unwanted consequences