Chapter 7

Chapter 7

1. Data Protection Act 1998

   • DPA Principles
     • Processed fairly and lawfully
       • Data subjects must be informed if data is being collected about them and their permission sought
       • Data subjects must be aware of the purpose for which and collected data will be used
     • Used only for the purposes stated in the registry entry
       • Data users can only use the data for those purposes
       • The registration process with the ICO requires identification of the classes of data held and the purposes for which they are to be used
     • Adequate, relevant and not excessive
       • There must be enough information to meet the needs of the organisation and individual
       • An organisation must only keep relevant data and no more
     • Accurate and must be kept up to date
       • An organisation is responsible for ensuring data is entered accurately
       • Validation and verification can be used to help reduce data entry errors
       • The organisation must review data regularly to ensure it is up to date and this may involve contacting data subjects to ask them to check their personal data
       • If a data subject says data in inaccurate, then the errors must be corrected by the organisation
     • Not be held for longer than is necessary for the purpose
       • Personal data can only be held while it is needed for its purpose
     • Be processed within the rights of the Data Subjects
     • Be kept secure and protected against unlawful access and accidental / deliberate damage
       • Security measures must be put into place including anti-virus software, encryption, backups, authorisation and authentication
       • Data users must be made aware of the need for security, particularly if they are carrying data on a portable device
     • Not be transferred outside of the European Union unless that country has adequate data protection legislation
       • This has wide ranging consequences with much business being conducted internationally
   • The purpose of the DPA is to protect individual from organisations
   • Main aspects
     • Accurate
     • Secure
     • Used for specified purposes
     • Not kept for longer than necessary
     • Fairly and lawfully processed
   • DPA Terminology
     • Personal Data – Covers both facts and opinions about a living individual
     • Data – Anything which is part of a record about an individual e.g DOB, Name
     • Processing – Collection and storage of data which includes sorting the data into order
     • Data Subject – The person that the data is being collected from or stored about
     • Data Controller – Is responsible for ensuring the data meets the rights of the DPA
     • Data Processor – Third parties who process the data who are not necessarily part of the Data controller’s organisation
     • Recipient - This is any person who is employed to access, use or process personal data as part of their job
     • (Information) Commissioner – The person who has overall responsibility for enforcing the DPA across the UK
   • DPA Rights
     • Right to subject access
     • Right to rectify or remove incorrect data
     • Right to prevent processing that is likely to cause damage or distress
     • Right to compensation if damage or distress is caused
   • DPA Exemptions
     • Not everyone is automatically entitled to see the data which is held on them
       • Crime
       • Schools and examinations
       • Taxation
       • Health and Social Work (medical records)

2. Computer Misuse Act 1990

   • The purpose of the Act is to prevent the unauthorised use of computer systems and relates to both hardware and software
   • Computer Misuse Act Offences
     • Unauthorised access to computer material
     • Unauthorised access with intent to commit further crimes
     • Unauthorised modification of computer material
     • Making, supplying or obtaining material that could be used in computer misuse offences e.g. Viruses, Trojans
   • Computer Misuse Act Problems
     • Accidental Intrusion is not listed as a crime
     • There may be more than one person in the house therefore responsibility is an issue
     • The act can only be put in place once the crime has been committed

3. The Copyright, Designs and Patents Act, 1988

   • Act covers: stealing software, using illegally copied software and manuals, running purchased software on two or more machines at the same time without a suitable licence

4. Regulation of Investigatory Powers Act 2000

   • The purpose of the Act is for the organisation to lawfully intercept any misuse of communications device
   • Organisations may monitor and record communications
     • Prevent or detect crimes
     • Prevent public disorder from occurring
     • To ensure national security and the safety of the general public
     • To investigate or detect any abnormal or illegal use of telecommunication systems
     • Advantages
       • The company can monitor what its employees are doing
       • Make sure that the facilities are only being used for legitimate work
       • Make sure company secrets are not being revealed
     • Disadvantages
       • Monitoring can be seen as a breach of trust by employees
       • Desire by employees to maintain their privacy

5. Electronic Communications Act (2000)

   • The purpose of the ECA was to make the UK the best place in the world for e-commerce
   • Advantages
     • Contracts that are signed over the Internet have the same legality as those signed by hand
     • Increases the security with which individuals can engage in e-commerce
     • Contracts entered into have legal backing
   • Disadvantages
     • Many people aren’t aware of digital signatures therefore it will take time for it to be accepted
     • Since transactions are important to people it will take a lot of time for it to be introduced
     • People feel insecure due to the security of digital signatures

6. Freedom of Information Act (2000)

   • The purpose of this act is being able to find out information on any topic from any public authority (government, hospitals, and schools)
   • People can write a letter to the public authority requesting the information they want, it takes 20 working days for them to respond to your request.
   • Advantages
     • Information which was not accessible to the general public is now available
     • People feel more confident that they know things aren’t being hidden
   • Disdvantages
     • There is no certainty that you will receive the information you ask for
     • The public authority have the right to deny any existence of the information
     • There is a large cost to respond and find the information

7. Methods for combating ICT crime and protecting ICT systems

   • Physical Security (Security guards)
   • Biometric Security (Fingerprints)
   • Location of Equipment
   • Firewalls (Prevents unauthorised computers connecting to your network)
   • Backup (Making a copy of the data)
   • Encryption (Coding the data)
   • Software Patches / Updates (Removes any flaws in the software)
   • Anti-virus / anti-spyware (Prevents viruses and spyware infecting machine)
   • Access rights (Access is only granted to certain users)

8. Networking

   • Linking together two or more computers to be able to share files through a server
   • Advantages
     • The sharing of peripherals (printers)
     • Data can be shared
     • Backup and virus checking from a central location
   • Disadvantages
     • Viruses can spread faster on a network
     • Lack of privacy
     • Initial cost of network
   • Local Area Network (LAN) – When computers are fairly close to one another
   • Wide Area Network (WAN) – When several different LAN’s are linked together it is spread over a wide area
   • A protocol is a set of rules which define:
     • How to establish communication between the machines
     • The format of any data which is to be exchanged between the machines