Course Outline
1. Context
The objective is to ensure a fundamental understanding of the context surrounding data protection law, with particular emphasis on the broader concept that privacy extends beyond mere data protection.
1.1 What is Privacy?
1.1.1 The right to private and family life and the importance of confidentiality.
1.1.2 European Convention on Human Rights and Fundamental Freedoms, UK Human Rights Act
1.2 History of Data Protection Legislation in the UK
1.2.1 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data 1980
1.2.2 Council of Europe Convention 108, 1981
1.2.3 Data Protection Act 1984
1.2.4 Data Protection Directive 95/46/EC
1.2.5 Telecommunications Directive 97/66/EC, Privacy and Electronic Communications
2. The Law
2.1 Data Protection Act
2.1.1 Definitions
The objective is to ensure that candidates understand the key definitions in the Act and how to apply them to identify what information and processing activities are subject to the Act.
2.1.2 Role of the Commissioner
The objective is to ensure an understanding of the role and primary powers of the Information Commissioner. The following areas will be covered:
2.1.2.1 Enforcement (including roles of the First-tier Tribunal and the Courts)
- Information and Enforcement Notices
- Prosecution
- Warrants (entry/inspection) (Schedule 9,1(1) & 12 only – that is a basic understanding of grounds for issuing and nature of offenses)
- Assessment Notices (s41A-s41C) including the effect of s55 (3) added by the Coroners and Justice Act 2009, which provides that the Information Commissioner may not issue a monetary penalty notice in respect of anything found during an assessment.
- Monetary Penalties (s55A-55E) including the effect of the s55 (3A) provision.
- Undertakings (candidates are required to have a basic understanding of how the ICO uses undertakings and that they do not derive from any provision in the DPA98. They are not expected to know the detailed status and provenance).
2.1.2.2 Conducting s42 Assessments
2.1.2.3 Codes of Practice (including s52A-52E Code of Practice on data sharing) and all current ICO-issued codes, but not codes issued by other bodies. Candidates will be expected to have a broad understanding of s52A-E, appreciate the distinction between statutory and other ICO-issued codes, and have a general understanding (but not detailed knowledge) of ICO-issued codes.
2.1.3 Notification
- The exemptions from notification.
- A basic understanding of the two-tier fee regime.
2.1.4 The Data Protection Principles
The objective is to ensure an understanding of how the principles regulate the processing of personal data and how they are enforced, as well as a comprehension of the individual principles in light of guidance found in Part II of Schedule 1. Candidates will be required to demonstrate an ability to interpret and apply the principles in context.
Introduction: how the principles regulate and enforce, including Information and Enforcement Notices.
2.1.5 Individual Rights
The objective is to ensure an understanding of the rights conferred by the Act and how they can be applied and enforced.
2.1.6 Exemptions
The objective is to ensure awareness that there are exemptions from certain provisions of the Act, and knowledge and understanding of some of these and how to apply them in practice. Candidates are not expected to have a detailed knowledge of all the exemptions. The following will be covered in detail:
2.1.7 Offenses
The objective is to ensure an awareness that there are various offenses under the Act, and of the role of the Courts as well as an understanding of how certain specified offenses apply in practice. It is not intended that candidates should have a detailed knowledge of all the offenses.
Candidates will be expected to cover:
- Unlawful obtaining and disclosure of personal data
- Unlawful selling of personal data
- Processing without notification
- Failure to notify changes in processing
- Failure to comply with an Enforcement Notice, Information Notice, or Special Information Notice.
- Warrant offenses (Schedule 9,12)
2.2 Privacy and Electronic Communications (EC Directive) Regulations 2003
The objective is to ensure awareness of the relationship between these Regulations and the Act, an understanding of the broad scope of the Regulations, and a detailed understanding of the practical application of the main provisions relating to unsolicited marketing.
2.3 Associated Legislation
The objective is to ensure a basic awareness of other relevant legislation and an appreciation that data protection legislation must be considered in the context of other laws for government operations.
3. Application
The objective is to ensure an understanding of the practical application of the Act in various scenarios. This will include detailed analysis of sometimes complex situations, determining how the Act applies in specific circumstances, and explaining and justifying decisions or advice given.
3.1 How to Comply with the Act
3.2 Addressing Scenarios in Specific Areas
3.3 Data Processing Topics
- Monitoring – internet, email, telephone calls, and CCTV
- Use of the internet (including Electronic Commerce)
- Data matching
- Disclosure and data sharing
Requirements
Testimonials (2)
I was benefit from the discussion and exchange of ideas.
RAYMOND JACKSON PAJARILLO
Course - Data Protection
I enjoyed the interaction and facts gained / learn.
