Introduction to Data Protection and Information Security

Editor's Notes

• #2: Slide 1 Intro of myself advisor for learning resources, bgnd, information arch manager at SQA with direct responsibility for the management of the process of Data Protection Act and also to ensure the continued accreditation to the international standard 27001, which was the effective management of an information security system. Ask them to introduce one another and their bgnd. today short workshop will look at some of the process that is involved to ensure personal information, is stored, managed, processed and secured in accordance with the Data Protection Act
• #3: Slide 2 this workshop is by no stretch that magical silver bullet that will solve all data protection woes and challenges for an organisation, it really is a very general introduction and also to give some ideas about how Angus College can ensure the integrity and confidentiality of personal data. we’ll have a look at some of the key terms and principles within the data protection act have a look at the 2 main levels of personal information and some of the tools and processes an organisation can deploy to ensure adherence to the data protection act.
• #4: Slide 3 so the DPA, although it was established in 1998 it became an effective legislation tool from about March 2000, the act and legislation outlines a framework for organisations for the collection and use of personal data ensuring the confidentiality and integrity of that data remains, ensuring no loss of privacy or harm to the person the data is about that an organisation is storing, the DPA does not approve of the ‘we’ll store this data, just in case’ attitude, and rightly so so when we talk of personal data this covers data which relates to a living individual and said individual can be identified from those data and/or an amalgam of other data in possession of the data controller this also includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual. So an example would be if you’re marking a students paper and you write feedback or any remark on it, within the context of a personal information request this information would have to be transcribed and sent to the individual.
• #5: Slide 4 The act hinges on 8 principles that 1 st data principle have legitimate grounds for collecting and using the personal data; be transparent in how you are going to use the date not use the data in ways that have unjustified adverse effects on the individuals concerned; 2 nd data principle clear about the purpose or purposes for which you hold personal data so that you can then ensure that you process the data in a way that is compatible with your original purpose or purposes (or ”not incompatible”, as the Data Protection Act says.) Specifying those purposes at the outset is likely to help you avoid the possibility of “function creep”. make sure that you process personal data in accordance with the other data protection principles, and that you have notified the Information Commissioner if you need to do so, you are likely to comply with the requirement to “specify” without doing anything more. 3,4 & 5 Ensuring you don’t hold excessive amounts of data, You should not hold personal data on the off-chance that it might be useful in the future Data protection principle 4 take reasonable steps to ensure the accuracy of any personal data you obtain; ensure that the source of any personal data is clear; carefully consider any challenges to the accuracy of information; and consider whether it is necessary to update the information. Data protection principle 5 Retention the current and future value of the information; the costs, risks and liabilities associated with retaining the information; and the ease or difficulty of making sure it remains accurate and up to date. Principle 6 The right of access to what an organisation holds about them a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed; and a right to claim compensation for damages caused by a breach of the Act. Principle 7 Adequate security controls are in place to ensure the integrity and confidentiality of the personal information design and organise your security to fit the nature of the personal data you hold and the harm that may result from a security breach; be clear about who in your organisation is responsible for ensuring information security; be ready to respond to any breach of security swiftly and effectively. Principle 8 It is important to remember that all the data protection principles apply to overseas transfers of personal data – not just the eighth principle. So you must consider how you will comply with the other principles if you transfer.
• #6: Slide 5 The types of personal information an organisation may hold falls into two types, we have what is deemed personal…
• #7: Slide 6 And we also have sensitive/restricted information regarding a living individual The presumption is that, because information about these matters could be used in a discriminatory way, and is likely to be of a private nature, it needs to be treated with greater care than other personal data. In particular, if you are processing sensitive personal data you must satisfy one or more of the conditions for processing which apply specifically to such data, as well as one of the general conditions which apply in every case. The nature of the data is also a factor in deciding what security is appropriate. The first data protection principle requires, that you must be able to satisfy one or more “conditions for processing” in relation to your processing of personal data. Many (but not all) of these conditions relate to the purpose or purposes for which you intend to use the information. if you have a legitimate reason for processing personal data, the best approach is to focus on whether what you intend to do is fair. http://www.legislation.gov.uk/uksi/2000/417/contents/made
• #8: Slide 7 The ICO website holds information and guidance for educational establishments, the guidance covers information such as A students examination records and in your packs I’ve included the specific guidance for access to pupils data in Scotland FOI This guidance gives examples of the kinds of information that we would expect colleges of Further Education to provide in order to meet their commitments under the model publication scheme. Any publication scheme you have that was created before 1 January 2009 is now out of date and you should replace it with the ICO model scheme. 7 classes of information, how you should make the information available, what you can charge, and what you need to tell members of the public about the scheme. It is also required that you tell the ICO that you have made these changes to your publication scheme.
• #9: Slide 8 To ensure some structure and generic reference within the act they use roles defined as the following :- Data controller, usually an organisation who determines how the personal data will be processed Data processors specifically Data subject Within a organisation it is paramount that all staff are aware of their role and responsibility to data protection and understand the consequences or enforcement of processing personal information. Some organisations, for example, will stipulate procedures within their policy if a member of staff breaches or does not comply with their responsibilities as a data processor, some organisations will develop specific contracts for staff who process personal data
• #10: Slide 9 Within your organisation North Glasgow College is the data controller It is mandated that all organisations that process personal data must notify and register with the information commission officer the registry of data controllers is public information and available online, click on link search the registry and show angus colleges notification this documents all purposes that Angus College use personal data and what they are processed for the ultimate responsibility for the adherence to the data protection act is the data controller
• #11: Slide 10 the Data Protection Act is enforced is via the Information Commissioner’s Office, ICO is an independent body set up to uphold our information rights and promote openness and transparency within the public sector and ensure data privacy for individuals click on link to show information and guidance available for organisations on DP there is a Scottish Information Commission and have jurisdiction in the management and enforcement of Freedom of Information (Scotland) Act, the ICO has specific regulatory responsibility for data protection.
• #12: Slide 11 so how does the ICO enact upon breaches for the data protection act by organisations, well they hit them where it hurts the most, money and reputation The ICO has the power to fine organisation up to a maximum penalty of £500,000 for the mismanagement of personal information.
• #14: Couple of recent examples are Sony were fined £250,000
• #15: Another one closer to home is that of Borders Council…read slide Slide 13 to determine the amount an organisation will be fined, the ICO uses a framework, they consider The seriousness of the breach, this would include the hurt or damage done to the persons data involved And they also consider any mitigating factors or aggravating factors - your policies and procedures in place, what your organisation does to ensure compliance (mitigating) Aggravating factors may be if this is your second or more offence Click on link And as I mentioned the reputation of an organisation, all monetary fines and decisions pertaining to breaches are published on the website The financial impact on the organisation, the case working group will take into account any financial hardship on the organisation, they want proof from the data controller and this can be used as evidence for their case
• #23: Slide 21 So how does an organisation ensure it compliance with the data protection act, well I think it’s a mixture of these 5 attributes It’s all very well having a policy that adheres to a certain level of information security and vocalises how an organisation will ensure the confidentiality and integrity of personal data but quite another thing to embed that policy as process in an organisational culture. Most organisations will develop information governance process and include all these as part of the implementation of good practice to ensure adherence to the data protection act, this can go further than just how to manage personal data all of this can also be embedded to ensure good information management practice for all information within an organisation. People, process and policy are the 3 key ingredients to good information management, ensuring your valued assets are aware of their responsibilities, that they understand the processes and policy your organisation works with. The more time spent on training and awareness will ensure adherence to your policies and process.
• #24: Slide 22 within an organisation the ICO would view it towards mitigating factors of a breach if there is an effective management system in place for personal data North Glasgow College has a data protection and IT security policy that documents exactly how staff must comply when working with personal data, it also includes measures to ensure the security of data be it physical or electronic access There are other areas that need organisations to have a policy or guidance in place for staff with the onslaught of mobile devices a lot of organisations need to consider what their policy is, a survey released in December last year "Independent research commissioned by Cisco reveals that 73% of Local Government, Healthcare and Higher & Further Education organisations allow employees to use personal devices at work.  But while the majority have begun to embrace BYOD, only 22% have put specific and enforceable policies in place for users.  In addition, only 24% have installed security solutions on user devices. email is also an issue and it must be specified within an organisation what can be shared, transferred over the internet via email. ensuring staff are aware of these policies and what the implication is for them is how an organisation can develop a secure data culture Know what you’ve got, where it is and what security controls must be applied, most organisations work within a risk framework and apply levels of risk to their operational and production processes, information is a valued asset in an organisation and so it can be useful to measure risk to data and what the impact may be a level of risk to an information asset if its loss of revenue to the organisation or damaging reputation click on link
• #25: Slide 23 In creating an information asset register or including information as an asset within your corporate risk register, you need to look at information and Identifying the risk to the information Then looking at how to treat the risk by how to by avoiding, reducing, transferring or accepting them so it looks what impacts the risk and how you can apply measures to mitigate the risk An organisation should then actively monitor and review risk to ensure stability in their treatments There are other tools that are worth considering, privacy impact assessments are useful if you are using third party data processors for example, PIAs can ensure that the external supplier adheres to the rigours of data protection and information security. Know what you’ve got, where it is and what security controls must be applied to ensure continued integrity and confidentiality of that information
• #26: We all have the right as individual to ask organisations about the personal information they hold about us. These requests are referred to as subject access requests A lot of organisations will specify how they deal with a subject access request and what kind of information they hold on their website, Click on link to SQA webpage and click on link for the SAR form. It is vital that an organisation specifies who is responsible for the dealing of SARs and that this information is monitored and reviewed
• #27: Slide25 dealing with SARs it is imperative that an organisation has ownership/responsibility in place, who deals with them and who is involved in the procedure By using good retention it is important that these requests are logged and recorded properly and are kept for a specific amount of time If the information being sent out involves other persons you must make sure that that persons information has been redacted Example of SQA exam logs from invigilators, all other persons who have been recorded must be redacted before sending out this information Click on link there are specific exemptions within the DPA , in the main are concerned with criminal proceedings or financial processes or management information within an organisation Example of an exemption The senior management of an organisation are planning a re-organisation. This is likely to involve making certain employees redundant, and this possibility is included in management plans. Before the plans are revealed to the workforce, an employee makes a subject access request. In responding to that request, the organisation does not have to reveal its plans to make him redundant if doing so would be likely to prejudice the conduct of the business (perhaps by causing staff unrest in advance of an announcement of the management’s plans). Example Your Examination script is exempt from release under the Data Protection Act. SQA markers are instructed not to add their comments to examination scripts, but occasionally this does happen. You are entitled to receive a copy of any marks or comments markers add to your script. We will provide these, if available, in response to your subject access request. examination marks and personal data contained in examination scripts; Mention the handout access to pupils information Another consideration for personal data requests is when an organisation shares data with other organisations for a specific purpose, data sharing agreements are extremely important to ensure data subjects are aware of how their personal information will be processed and what the external organisation is legitimately allowed to do with the data (mention the data sharing checklist and the code of practice for data sharing agreements)
• #28: Slide 26 Training and awareness are fundamental to creating good information governance Click on link ICO has created a useful toolkit for companies to download and use to raise awareness of protecting personal data Coming along this morning is also a useful in building up your ideas for moving forward with protecting personal information
• #29: Slide 27 Another of the attributes I mentioned earlier tat can help an organisation develop and embed good data protection process is records management, ensuring you have documented the Read slide
• #30: Slide 28 Example of retention schedule dealing with subject access requests from SQA, it documents exactly what information is comprised of, how long it must be stored, if it’s a statutory or business requirement and what treatment is used to complete the documents lifecycle.
• #31: Slide 29 Technology is an integral part of ensuring security procedures are in place for the management of personal data Most of this is very practical in nature and straightforward but it is amazing to see staffing organisations doing things like working with sensitive information, leaving their desk, not locking their pc, a security breach just waiting to happen An incident management team can be an effective way to govern both physical and electronic incidents, comprising of a board and working group with responsibility to ensure compliance and awareness amongst staff.
• #32: Angus College has specified in their policy who owns and has responsibility of security measures This also must be taken into consideration for the security of physical records and access to IT have management of the network of the organisation and ensuring access controls and permissions are in place to ensure only the right people gain access to the data they are allowed to view. Some organisations will introduce a security breach log to ensure any data breaches are reported, handled and solved. And due to the flexibility these days of working practice, some institutions will create guidance and policy for staff Click on link show remote working assessments to ensure security of data when working at home
• #33: Slide 31 Don’t despair! The ICO may be the ones that dole out the financial fines but they also have an excellent information dissemination policy and are there to help organisations embed and develop good information management practice. Click on link Advisory visits Self assessment data protection is ever evolving and is a developing piece of legislation, with our society being enslaved to an online environment the ICO have created a code of practice of how organisations can process and personal information online.
• #34: In summary:
• #35: Slide 33 we share our information everywhere now and it is increasingly difficult to keep up to speed with who has your information and what they may be doing with it and with that in mind click on link