Data Management

Question 1

What is the distinction between the Data Protection Act, 2018 and UK GDPR?

Answer 1

The EU GDPR no longer applies in the UK but this was almost entirely transcribed in the UK GDPR
The UK GDPR is supplemented by the Data Protection Act 2018.

Question 2

What is the aim of this legislation?

Answer 2

To create a single data protection regime affecting businesses and to allow people to take control of how their data is used by third parties

Question 3

What are the key requirements of the Data Protection Act?

Answer 3

• An obligation to conduct data protection impact assessments for high risk holding of data
• A data controller decides how and why personal data is processed and is directly responsible for GDPR
• Data security breaches need to be reported to ICO within 72 hours where this is a loss of personal data

Question 4

What are the fines for breach of this legislation?

Answer 4

4% Global turnover or £17.5 million, whatever is greater

Question 5

What are the principles of UK GDPR?

Answer 5

Article 5(1) Principles relating to the storage of personal data must …
- Be processed lawfully, fairly and in a transparent manner
- Collected for specified, explicit and legitimate purposes
- Ensure appropriate security of data

Question 6

What is personal data?

Answer 6

Any data that identifies a person, e.g. name, address, date of birth

Question 7

How would you ensure accuracy of data from third parties?

Answer 7

When sourcing data from third parties such as CoStar, I always call the relevant agents to confirm accuracy in the data

Question 8

How do you ensure appropriate data protection on the Cluttons portal?

Answer 8

• The portal requires users to update passwords every 30 days
• Access is restricted to the requirements of each user.
• All accounts have to be approved by the client

Question 9

How did your firm prepare for the introduction of GDPR?

Answer 9

Data training, cyber security training, password requirements