GDPR Training Refresher Quiz

UK General Data Protection Regulations Training Refresher

• GDPR Officers:
  • Compliance Officer: Malcolm Prescott
  • General Data Protection Officer: Karlie Baker
  • Information Commissioner's Office Registration Number: Z5129639
  • The Webbers GDPR Policy is stored on the company L Drive.

GDPR

• Definition: GDPR refers to regulations designed to protect personal data and privacy for individuals within the EU and the UK.
• Who it applies to: Any organization based in the EU or UK that uses personal data, including processing by law enforcement, national security, and personal/household activities.

Personal Data

• Definition: Any piece of information that can be used directly or indirectly to identify a person.
• Examples: Names, addresses, phone numbers, email addresses, dates of birth, photo IDs, proof of funds, purchase/sale prices of property, and debt history.

Data Protection Roles

• Data Protection Officer (DPO) - Karlie Baker: Handles subject data access requests, breach records, reports to the ICO, and maintains data protection compliance.
• Controller: An entity that gathers and stores data, like Webbers.
• Processor: Responsible for processing personal data on behalf of a controller.
• Data Subject: The individual whose personal data is about.

GDPR Principles

• Collected for specific, explicit, and legitimate reasons: Data collected must have a clear and lawful purpose.
• Processed lawfully, fairly, and transparently: Processing must be lawful and fair, and individuals must understand how their data is used.
• Accurate and kept up-to-date: Data must be accurate and kept current.
• Kept in an identifiable form for no longer than necessary: Data must be stored in a format that allows identification and only for the required period.
• Processed with appropriate security: Data must be processed with appropriate security measures.
• Adequate, relevant, and limited to what is necessary: Data collected must be adequate, relevant, and limited to what is necessary for the stated purpose.

Legal Basis for Processing Data

• Consent: Unambiguous, informed, and explicit consent for processing personal data.
• Contract: Processing personal data to fulfill a contract.
• Legal Obligation: Processing required to comply with laws.
• Public Task: Processing in the public interest.
• Legitimate Interests: Processing as part of a legitimate business interest.
• Vital Interests: Processing to protect someone's vital interests.

Webbers and Personal Data

• Collection Methods: Emails, phone calls, property portals, tenancy applications, proof of funds, and face-to-face interviews.
• Data Collection (Legitimate Interests): Market assessments, providing information to buyers, sellers, and tenants, and complying with legal obligations.
• Data Collection (Contractual Reasons): Marketing, selling, letting of a property, finding suitable purchasers/tenants, managing properties, and completing transactions.
• Data Storage: Can be kept in locked filing cabinets or on a computer system with appropriate security measures and stored only for the required minimum period.

Individual Rights Under GDPR

• Right to be Informed: About collection and use of personal data.
• Right to Access: Known as a Subject Access Request (SAR).
• Right to Rectification: To have inaccurate information corrected.
• Right to Erasure: Also known as the right to be forgotten.
• Right to restrict processing: Request the restriction of data processing.
• Right to Data Portability: Information a data subject has provided to a controller that can be transferred.
• Right to Object: Absolute right to stop data being used for direct marketing.
• Rights relating to automated decision-making and profiling

Subject Access Request (SAR)

• Definition: Everyone in the UK has the legal right to request access to personal information held on them by a company.
• How to submit: Individuals need to write or email the organization with name, address, contact information and details of the specific information they need along with dates.
• Timeframe: Companies have one month to provide this information and they aren't allowed to charge.
• Webbers Policy: All SAR requests should be sent to Karlie Baker, the DPO.

Accountability and Governance Measures for Compliance

• Data protection policies: Data protection policies, documentation of processing activities, and written contracts with data processors, security measures.
• Activities: Recording/reporting of breaches, adhering to codes of conduct, and annual policy reviews.

Data Breaches

• Examples: Unauthorized third-party access, incorrect recipient of data, alteration without permission, data encrypted by ransomware, devices being lost/stolen, accidental loss/destruction of data.
• Reporting Procedure: Immediate report to Karlie Baker (DPO), who will record breaches and advise the ICO within 72 hours for serious breaches.

Handling Client Data Outside the Office

• Data security measures: Secure data in vehicles, prevent visibility of data through vehicle windows, avoid overnight storage of data in vehicles, shred diary printouts/notes, store data in plain folders or briefcases.

Staff Responsibilities

• Data Breach Avoidance: Lock computers when leaving workstations, ensure secure storage of personal data in locked cabinets and proper disposal of confidential waste, confirm and document client consent for third-party data sharing and inform the appropriate personnel if there is a data breach, and ensure contractors and developers have confirmed their GDPR policies are effective.
• Marketing Consent: Ask for marketing consent with each client, including second applicants as necessary.