4.1.2 The Data Protection Act / GDPR

The Data Protection Act (2018) is the UK implementation of which European law?

• ECHR

• GSO

• GSP

• GDPR

Answer explanation

General Data Protection Regulation (GDPR)

What does the Data Protection Act (2018) primarily seek to control?

• The distribution of digital technologies

• How personal data and information is used by organisations

• The export of personal data outside the UK

• The use of internet and social media by individuals

The Data Protection Act 2018 defines 'personal data' as information relating to...

• Any individual, living or deceased

• An identified, or identifiable living individual

• Individuals in the UK

• Anyone on the internet

Which of the following is NOT a principle defined by the Data Protection Act 2018?

• Used in a way that is adequate, relevant and limited to only what is necessary

• Kept for no longer than is necessary

• Ensuring speedy access to personal data

• Handled in a way that ensures appropriate security

Which principle is common to both DPA 2018 and GDPR?

• Data minimisation

• Storage limitation

• Lawfulness, fairness and transparency

• All of the above

What type of information does the DPA 2018 provide legal protection for?

• Financial records and transactions

• Sensitive information such as race and religious beliefs

• Corporate data and patents

• All of the above

Under the Data Protection Act (DPA), which of the following is a right of the data subject?

THERE ARE FIVE OPTIONS

• Have incorrect data updated

• Access personal data

• Be informed about how the data is being used

• Have data erased

• All of the above

What does GDPR require to protect personal data from malicious intent?

• Regular audits by external agencies

• Evaluate the risks and then implement cyber-security controls

• Public disclosure of data breaches within 24 hours

• Mandatory data encryption

According to the DPA and GDPR, consent for marketing must be:

• Implied and inferred from user behaviour

• Given after the marketing communication

• Clear, specific, and freely given before sending marketing messages

• Only required for electronic communications

What is required for a person to give valid consent to receive marketing emails according to the GDPR guidelines?

• The person must provide verbal consent only.

• The person must tick a box confirming they are happy to receive marketing calls, texts, or emails.

• The person must send an email to the company asking to receive marketing materials.

• The person must be informed about the marketing during a purchase.