← Lessons 17-Electronic Data
Quiz
0 / 9 read
1. INTRODUCTION 2. THE VEHICLE 3. THE DRIVER 4. THE LOAD 5. THE BUSINESS 6. THE LAW 7. CONCLUSION 8. Quick Exam Numbers / Facts – Memorise These 9. Final Memory Checklist

6. THE LAW

  • The source states that the law has tightened requirements concerning how electronic data is stored, processed and safeguarded.
  • The General Data Protection Regulation (GDPR) came into force on 25 May 2018 and, according to the source, replaced the Data Protection Act 1998.
  • Personal data concerns information about a living person who can be identified from the information.
  • The source stresses that personal data is not limited to computer records.
    • Examples given include:
    • Paper files containing personal information.
    • CCTV where individuals can be identified.
    • Vehicle registration numbers captured by systems.
    • Employee bank account details.
    • Posts on social-networking websites.
    • Medical information.
    • Computer IP addresses.
  • Businesses should document:
  • What personal data they hold.
  • Where the data came from.
  • Who the data is shared with.
  • The source lists individual rights, including:
    • Right to be informed.
    • Right of access.
    • Right to rectification.
    • Right to erasure.
    • Right to restrict processing.
    • Right to data portability.
    • Right to object.
    • Right not to be subject to automated decision-making.
  • The source explains that data portability applies where the individual provided the personal data, processing is based on consent or performance of a contract, and processing is automated.
  • The source states that an employer wishing to keep personal data on employees would need to register with the Information Commissioner as a data controller.
  • The data controller should identify what personal information is held and the purpose for which it is used.
  • The underlying principles described in the material are that data should be:
    • Reasonable in scope.
    • Accurate
    • Not excessive.
    • Kept secure against unauthorised access and unlawful processing.
  • The source also states that only the minimum necessary personal data should be held and retained only for as long as required.
  • Individuals have the right to know that personal data is being held and to view it.
  • A written request for access must, according to the training material, be answered without delay and at least within one month.
  • For complex or numerous requests, the period may be extended by a further two months.
  • If an extension is needed, the individual must be informed within one month and given an explanation.
  • Failure to provide information within the required time can allow the individual to seek a court order demanding compliance.