Data Management

Question 1

Difference between GDPR and Data Protection Act?

Answer 1

• GDPR 2016 is an EU-wide data protection law. DPA 2018 is the UK’s implementation of the GDPR

Question 2

What are the 7 principles of GDPR?

Answer 2

• LP MASSA
• Lawfulness processed lawfully
• Purpose Limitation for the relevant purpose
• Data Minimalisation adequate and not exessive
• Accuracy held no longer than necessary
• Storage Limitation accurate and up to date
• Security not transferred to other countries without same security
• Accountability kept securely

Question 3

What can you tell me about the GDPR/ DPA?

Answer 3

• The UK’s implementation of GDPR. It is a complete data protection system and replaced the 1998 Act and relates to personal data. The obligations are more prescriptive and the penalties greater.
• Policed by Information Commissioners Office (ICO)
• Data breaches must be reported to ICO within 72 hours if they relate to personal data

Question 4

What are the 8 individual rights under GDPR?

Answer 4

1. Right to be informed
2. Right of access
3. Right to rectification
4. Right to erasure
5. Right to restrict processing
6. Right to data portability
7. Right to object
8. Right to automated decision making and profiling

Question 5

How do you keep data secure in your place of work?

Answer 5

• A great deal of my work is undertaken reviewing confidential portfolio information for a retained banking client, I therefore ensure that the sensitive data that they share with me is kept in password protected documents and access to the folder in which the documents are saved is not shared beyond what is needed.

Question 6

Tell me about the Freedom of Information Act 2000

Answer 6

• Gives individuals the right to access information held by public bodies
• Public body must tell any individual requesting sight of information whether it holds it
• Normally the public body must supply requested info within 20 working days in the requested format
• It can charge of the provision of the information
• Exemptions include:
• Contrary to GDPR requirements
• It would prejudice a criminal investigation
• It would prejudice a person/organisations commercial interest

Question 7

who enforces data protection legislation in the uk

Answer 7

Information commissioners office