Data Management

Question 1

What is GDPR?

Answer 1

EU General Data Protection Regulation

Question 2

What is the purpose of GDPR?

Answer 2

Protects citizens personal data

Question 3

What constitutes personal data?

Answer 3

any information relating to a person / Data Subject that can be used to identify them

EG names, photos, email addresses, bank details

Question 4

Examples of personal data under GDPR that could apply to property companies?

Answer 4

• investors / fund managers data
• valuations
• background checks by HR
• compliance checks

Question 5

To what organisations does GDPR apply?

Answer 5

All organisations with more than 250 employees

Question 6

What are penalties for GDPR breaches?

Answer 6

4% of annual global turnover or 20 million euros (whichever is greater)

Question 7

What is the ‘right to access’ under GDPR?

Answer 7

Individuals have the right to obtain confirmation that their data is being processed, and to access their personal data

Question 8

What is a breach notification under GDPR?

Answer 8

• need to report breach within 72 hours of becoming aware of it
• if breach is high risk, then notify individual(s) impacted without delay

Question 9

How are data breaches typically discovered?

Answer 9

• access logs
• reported thefts
• lost equipment
• data security incident

Question 10

How have consent conditions been strengthened under GDPR?

Answer 10

• consent must be given using plain and clear language
• it must be as easy to withdraw consent as it is to give it

Question 11

What is the ‘right to be forgotten’ under GDPR?

Answer 11

Individuals have right to have personal data erased in certain circumstances
- data no longer necessary
- data been processed unlawfully

Question 12

What is data portability?

Answer 12

right for data subject to receive personal data concerning them, which they have previously provided, and have it transferred to another controller

Question 13

What is privacy by design?

Answer 13

• legal requirement under GDPR
• calls for inclusion of data protection from onset of designing systems, rather than as an addition

Question 14

Data Protection Officer

Answer 14

• individual appointed to monitor internal compliance
• they advise on an organisations data protection obligations

Question 15

Examples of data held by surveying practices?

Answer 15

• payroll and HR information
• customer data for marketing
• emails relating to clients / employees

Question 16

What are obligations imposed by GDPR?

Answer 16

• have knowledge of what data is stored/processed
• provide information on how data is used and the individuals rights
• demonstrate data is being managed in compliant manner
• delete every instance of individuals data in accordance with ‘right to be forgotten’
• keep data in format that allows portability to another data processor

Question 17

Who regulates GDPR in the U.K.?

Answer 17

Information Commissioner’s Office

Question 18

RICS best practice points for complying with GDPR?

Answer 18

• conduct data review
• anonymise data where possible
• encrypt everything where possible
• treat commercial data in same way as personal data (even though not covered by GDPR)

Question 19

What are your company policies for data protection breaches?

Answer 19

• report to line manager
• report to Data Protection Officer

Question 20

RICS recommendations for using confidential information?

Answer 20

• document purpose for which you are holding the information
• keep record of consent for processing, storage and retention
• check if you have appropriate contractual clauses for use of information

Question 21

What information should be included in firms privacy notice?

Answer 21

• what information you have
• what information will be used
• which 3rd parties information will be shared with
• how long information will be stored for
• what legal rights they have

Question 22

When did GDPR come into effect?

Answer 22

25 May 2018

Question 23

What Act implemented GDPR in the UK?

Answer 23

Data Protection Act 2018

(replaced Data Protection Act 1998)

Question 24

What are the 7 principles of Data Protection Act 2018?

Answer 24

• lawfulness, fairness, transparency
• purpose limitation
• storage limitation
• data minimisation
• accuracy
• accountability
• integrity and confidentiality

Question 25

8 individual rights under GDPR?

Answer 25

- right to information - right to access - right to rectification - right to erasure - right to restrict processing - right to data portability - right to object - right to automated decision making

Question 26

What is SAR?

Answer 26

Subject Access Request - demand that the individual be given all the information that a company holds on them

Question 27

Freedom of Information Act 2000

Answer 27

- allows an individual to request access to information held by a public body - public body is required to provide that information (within 20 working days) in requested format - they can charge a fee for this

Question 28

Land Registry Act 2002

Answer 28

- provides complete accurate reflection of the state of the title of the land at any given time - aim is to get all freehold land in England and Wales registered by 2030 (required for all freeholds of over 7 years)

Question 29

Disadvantages of the systems you use?

Answer 29

- rely on data input completed by others (human error) - external systems - firm is not in control of their security - not user friendly and lots of training required!

Question 30

How did GDPR tighten up the former Data Protection Act 1998?

Answer 30

- customer has greater control over their data - harsh penalties if fail to comply - GDPR is binding piece of legally enforceable regulation - applies to all EU nations and every company holding data on EU citizens - breaches have to be reported to relevant authority within 72 hours - companies will be accountable for data protection - any firm with over 250 people need data protection officer

Question 31

Privacy and Electronic Communications Regulations 2003

Answer 31

Make it unlawful to transmit an automated recorded message for direct marketing purposes via telephone without prior consent of subscriber

Question 32

Copyright

Answer 32

Exclusive legal right given to the creator of original work for fixed number of years - rights can be licensed, assigned or transferred

Question 33

Can copyright be transferred?

Answer 33

Yes