Bis4425, Unit 10: Privacy & Data Protection

Front 1

Define privacy.

Back 1

The right to be left alone.

To decide what to reveal about oneself.

Front 2

Name four different legislation concerned with privacy.

Back 2

Human rights act 1998.

Convention for protection of human rights 1950

Universal declaration of human rights 1948

Front 3

Name four different types of privacy.

Back 3

[Privacy is terribly boring]

1. Privacy of communications

2. Information privacy (DPA)

3. Territorial privacy (Video recording)

4. Bodily privacy (Invasive procedures, genetic tests)

Front 4

Give four key points proving why privacy is important.

Back 4

Psychological well being.

Sociological well being.

Economically - Freedom to innovate

Political privacy - People need to be free to think, argue and act.

Front 5

Discuss the four major models for privacy protection.

Back 5

1. Comprehensive laws.

2. Sectoral laws

3. Self regulation

4. Technologies of Privacy

Front 6

Discuss comprehensive laws relating to privacy.

Back 6

General Laws that govern: Collection. Use. Dissemination of personal information.

Example: Data Protection Act of 1998.

Front 7

Discuss Sectoral laws relating to privacy.

Back 7

Specific Laws that cover only certain sections (sectors) of privacy protection.

Ex: Health & Financial Privacy laws in USA.

Problems: Lags behind with each new technology introduced. Lack of oversight.

Front 8

Discuss Self regulation relating to privacy.

Back 8

Companies step in, define their own privacy rules.

Drawbacks: Weak protections. Lack of enforcement.

Front 9

Discuss Technology relating to privacy.

Back 9

For: Encryption. Anonymous remailing. Proxy servers. Biometric access systems. Secure Online access.

Against: Government backdoors, spyware, cookie tracking.

Front 10

Name some threats to privacy.

Back 10

9/11: Increased surveillance

Weakened data protection laws.

Sharing company/customer data with government agencies.

Identity systems

Face regognition

Front 11

Discuss privacy within the context of e-commerce. (1) What are the issues?

Back 11

Large amounts of personal data transferred which can reveal interests, tastes, religion.

Ex: Data Mining. Tracking cookies.

Customers concerned about unauthorized access to that data and secondary use.

Front 12

Discuss privacy within the context of e-commerce. (2) How is it regulated? Name two relevant directives.

Back 12

EU Data Protection Directive (1995)

EU e-Privacy Directive (2002)

Front 13

Who does the Data Protection Act (DPA) protect?

Back 13

It protects individuals.

It regulates the ability of organisations to use the data for business purposes.

Front 14

What is the EU data protection directive?

Back 14

It protects the privacy and all personal data of EU Citizens. It states that data should be processed in a fair and legal way, limited to the purposes that were explicitly defined.

Front 15

What is personal data in relation to the EU data protection directive?

Back 15

Personal data is any information which can directly relate to a person.

Data is only personal if it enables anyone to link information to a specific person.

Front 16

What is sensitive personal data according to the EU Data Protection Directive?

Back 16

Data revealing: Racial, religious, political, trade-union, health or sex life.

Front 17

Define processing in the context of the EU data protection directive.

Back 17

Processing is any operation performed on personal data by automatic or manual means.

Examples include collection, recording, organisation, storage, retrieval.

Front 18

How should personal data be processed according to the EU data protection directive?

Back 18

Relevant to the explicitly defined purposes.

Data stored must always be Accurate.

Time-Limited data is only stored for as long as needed.

Front 19

When is processing permitted, according to the EU data protection directive?

Back 19

Data may only be processed with Consent.

By Contract and meeting Legal obligations.

With the vital interests of the data subject in mind especially when subject is physically/legally incapable of giving consent.

With public interest and legitimate interest.

Front 20

What are the four rights of data subjects?

Back 20

1. Right to access the information

2. Right to correct the information

3. Right to object

4. Right to not be automation and solely automated decisions.

Front 21

What are the obligations of data controllers?

Back 21

1. Notice to individuals: if the data is not used in purposes already explicitly defined.

2. Notice to data protection authorities.

Front 22

Transfer of data to third countries is allowed when....

Back 22

Data can only be transferred to non-EU countries under specific circumstances if they provide adequate protection.

1. Country specific exceptions, ex: EU & US: Safe harbor provision

2. Business specific exceptions

3. Circumstance specific exceptions

Front 23

Name a few examples of data protection offences (Data Protection Act of 1998)

Back 23

1. Processing personal data without notifying the data commissioner.

2. Unlawful obtaining, selling of personal data.

3. Failing to respond to information notice.

4. Failing to take appropriate technical/organisational security.

Front 24

Name the key points of protection the EU e-privacy Directive provides.

Back 24

1. Subscribers must be informed of security threats

2. Confidentiality of information is to be maintained.

3. Consent is provided.

4. Erase/anonymize data not needed.

5. SPAM- No emails without prior opt-in consent

Front 25

Cookies

Back 25

Users must be informed that

1) they are there

2) what they are doing

3) obtain consent.

Front 26

Human rights act 1998

Back 26

"Everyone has the right to respect for his private and family life", however this right cannot be used to interfere with public authorities acting in accordance with the law.

Front 27

Freedom of information act (2000)

Back 27

Amends DPA (1998)

Provides right of access to information held by public authorities with exemptions.