Safety And Security Of Data 4

Safety And Security Of Data 4

• 1.
  Safety and Securityof Data 4
• 2.
  The Need forLegislation As ICT and the internet develops, new laws are required to protect people. There is often debate as to the extent laws are required – ie protection against erosion of civil rights Difficulties with managing laws internationally
• 3.
  The Data ProtectionAct 1998 Introduced to protect the individual against the misuse of data Also introduced to bring into line with other EU members who already had legislation Covers misuse of all personal data, whether on computer or not
• 4.
  The Data ProtectionAct 1998 Individuals have the right to find the information stored about them and to check whether it is correct. If the information is wrong individuals can have it altered and may be able to claim damages if they have suffered a loss resulting from this
• 5.
  What is PersonalData? Data about an identifiable person That person must be alive The data must be specific to that person Medical history Credit history Qualifications Religious beliefs Criminal records Important for marketing departments!
• 6.
  The Data ProtectionPrinciples Personal data shall be processed fairly and lawfully. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
• 7.
  The Data ProtectionPrinciples Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. Personal data shall be accurate and, where necessary, kept up to date.
• 8.
  The Data ProtectionPrinciples Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. Personal data shall be processed in acordance with the rights of data subjects under this Act.
• 9.
  The Data ProtectionPrinciples Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
• 10.
  The Data ProtectionPrinciples 8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
• 11.
  The Data ProtectionPrinciples Fairly and lawfully processed Processed for limited purposes Adequate, relevant and not excessive Accurate Not kept longer than necessary Processed in accordance with the data subjects’ rights Secure Not transferred to countries outside the EU without adequate protection
• 12.
  Processing of PersonalData Obtaining data Recording data Carrying out any operation or set of operations on data
• 13.
  Notification Under theAct Businesses etc must let the Information Commissioner’s Office know that an organisation is story and processing personal data Information is added to a register which the public may view It is an offence for an organisation to process data without notification The following information is required:
• 14.
  Required Information Companyregistration number Details of data controller Classes of data held General description for the reasons Description of the data subjects List of organisation to whom data is passed Information about info passed outside EU
• 15.
  Exemptions from NotificationData held for personal, family or household reasons Data used for preparing the text of documents Data used for accounting purposes only Data held in the interests of national security Data used for mailing lists
• 16.
  Subject Access Individualshave a right to see data held about them Must write to the organisation and pay a fixed fee (£10 or £2 if a credit reference agency) Reply must be received within 40 days (7 days if credit reference agency)
• 17.
  Exemptions Data usedfor prevention or detection of crime Data used for the apprehension or prosecution of offenders Data used for the assessment or collection of tax or duty
• 18.
  The Information CommissionerResponsible for the Information Commissioner’s Office An independent authority Responsible for: Administering two acts – DPA and Freedom of Info Act 2000 To promote good information handling To investigate complaints To provide guidelines To bring legal proceedings, if necessary
• 19.
  The Freedom ofInformation Act 2000 Gives the right of access to information held by Local Authorities How public authorities carry out their duties How they make their decisions How they spend public money Public Authorities include Central government and gov depts Local Authorities NHS bodies Police and prison service
• 20.
  Scope of theAct Not restricted to personal information Covers all types of information Exemptions are: Were the info could jeopardise the prevention of detection of a crime Where the release of the information would harm the public more than not releasing the information
• 21.
  What You Needto Do Hand in completed MC spreadsheet Complete Case studies 4 and 5 on pages 193 and 194 of Folens