The admin who only looked
A systems administrator can open any mailbox. One evening she reads her manager's email "just to see". She changes nothing.
She has broken the law. Two laws, in fact: one about the data, one about the computer.
Today you meet both.
Key words
| Word | What it means |
|---|---|
| GDPR | General Data Protection Regulation: the law that sets the rules for using personal data. |
| Personal data | Any information about a living person who can be named or found. |
| Database | An organised store of records that a program can search. |
| Ransomware | Software that locks your data and demands money to unlock it. |
| Data Protection Act 2018 | The UK law that sits with the UK GDPR and protects personal data and privacy. |
| Computer Misuse Act 1990 | The UK law against unauthorised use of computers and data. |
| Unauthorised | Done without permission. |
| Offence | An act that breaks the law. |
| Intent | What a person means to do. |
| Impair | To damage or weaken how something works. |
| Principle | A basic rule that others follow from. |
| Retention | How long data is kept. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what each principle of the Data Protection Act asks of an infrastructure team, and name the three Computer Misuse Act offences.
Starter: GDPR
Have a go
Starter: GDPR
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: the Data Protection Act 2018
The Data Protection Act 2018 is the UK's version of the GDPR rules. Its purpose is to protect data and privacy. It gives the ICO its powers.
Personal data must be:
- used fairly, lawfully and openly
- used for clear, stated reasons
- adequate, relevant and limited to need
- accurate and kept up to date
- kept no longer than necessary
- kept secure, against loss, damage and unauthorised access
The UK GDPR adds a seventh: accountability.
Worked example: each principle on the servers
| Principle | What the team does |
|---|---|
| Fair, lawful, open | Tell people what is held and why, for example on a privacy page |
| Clear reasons | Use the data only for the reason it was gathered |
| Limited to need | Do not copy whole databases to a test system |
| Accurate | Give staff a way to correct their records |
| Kept no longer than needed | Set a retention time on logs and back-ups, then delete |
| Kept secure | Encrypt, limit access and keep logs of who looked |
The cells students fill in are left blank in this preview.
Check: which principle?
Have a go
Check: which principle?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.