F200 TA4: Legal Considerations
The UK GDPR and the Data Protection Act 2018 applied to real analytics work, plus the other legislation an analyst has to know by name.
The UK GDPR and the Data Protection Act 2018
The Data Protection Act 2018 implements the UK GDPR. Together they govern the processing of personal data, which is any information relating to an identified or identifiable living person.
Special category data
Data needing extra protection: racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation. Processing it needs a condition beyond the usual lawful basis, and in analytics it is the category that most often forces a project to be redesigned.
The seven principles
| Principle | What it requires |
|---|---|
| Lawfulness, fairness and transparency | A lawful basis, no deception, and people told what you do |
| Purpose limitation | Collected for a stated purpose, not quietly reused for another |
| Data minimisation | Only what is adequate and necessary for that purpose |
| Accuracy | Kept correct and up to date, with errors corrected |
| Storage limitation | Kept no longer than necessary, with a retention schedule |
| Integrity and confidentiality | Kept secure against loss, damage and unauthorised access |
| Accountability | You can demonstrate compliance, not merely claim it |
The six lawful bases
Consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent must be freely given, specific, informed and as easy to withdraw as to give; a pre-ticked box is not consent. Most analytics on existing customer data relies on legitimate interests, which requires a documented balancing test weighing the organisation's interest against the individual's rights.
Individual rights
| Right | What it means in practice |
|---|---|
| Access | A subject access request, answered within one month |
| Rectification | Inaccurate data corrected |
| Erasure | The right to be forgotten, where no overriding reason to keep it applies |
| Restriction | Processing paused while a dispute is resolved |
| Portability | Their data provided in a structured, machine readable format |
| Object | Including an absolute right to object to direct marketing |
| Automated decisions | Not to be subject to a solely automated decision with legal or similarly significant effects, without safeguards |
Accountability in practice
A record of processing activities, a privacy notice, a Data Protection Impact Assessment for high risk processing, a Data Protection Officer where required, processor contracts, staff training, and breach reporting to the ICO within 72 hours where there is a risk to individuals, plus notification to the individuals themselves where the risk is high.
If the data can be linked back to a person using a key you hold, it is still personal data and the whole regime still applies. Only genuinely irreversible anonymisation falls outside it, and that is much harder than deleting the name column.
The other legislation by name
| Law | What it does | Why an analyst cares |
|---|---|---|
| Computer Misuse Act 1990 | Makes unauthorised access to a computer system an offence, along with unauthorised modification and making or supplying tools for it | Accessing a dataset you were not granted access to is an offence even inside your own employer |
| Freedom of Information Act 2000 | Gives a right of access to information held by public authorities | It is where a great deal of open public data comes from, and it is why public bodies must know what they hold |
| Copyright, Designs and Patents Act 1988 | Protects original works, and gives database right over a database whose contents required substantial investment | Scraping or republishing somebody else's dataset is an infringement, licence or no licence to view it |
| Equality Act 2010 | Prohibits discrimination and requires reasonable adjustments | A model that disadvantages a protected group can be unlawful discrimination, however it was trained |
| Consumer Rights Act 2015 | Governs fairness in consumer contracts and digital content | Constrains what a terms-of-service click can be held to have agreed |
| Privacy and Electronic Communications Regulations | Covers cookies, tracking and electronic marketing | Consent is needed for non-essential cookies and most marketing email |
Working with a data processor
If another organisation processes personal data on your behalf, a cloud provider or an analytics vendor, you remain the controller and stay accountable. That relationship needs a written contract specifying the purpose, the security measures, the use of sub-processors, assistance with individual rights, breach notification and what happens to the data at the end.
"I had the password" is not authorisation. Looking up a relative's record, or querying a database your role does not cover, is unauthorised access, and prosecutions of insiders are routine.
Step 1 of 4 Computer Misuse Act 1990
Ethics, retention and destruction
Legal and ethical are not the same question
Something can be lawful and still be the wrong thing to do. The questions worth asking of any analysis:
- Would the people in this dataset be surprised to learn it was being done?
- Could the result harm an individual or a group, including by being wrong?
- Is the data being used for the purpose it was given for?
- Who is accountable if the output is acted on and turns out to be wrong?
- Would the organisation be comfortable publishing its method?
Retention
Every dataset needs a documented retention period, derived from the purpose and from any legal minimum: accounting records have statutory retention, CCTV usually a few weeks, marketing contacts a defined period after last engagement. "We keep everything in case it is useful" is a breach of storage limitation, and it is also the single largest source of breach impact, because a breach exposes whatever you still hold.
Secure destruction
- Deleting a file does not erase the data; the blocks persist until overwritten
- Durable deletion means secure erase, cryptographic erasure where the key is destroyed, or physical destruction of the medium
- Backups and archives have to be included, or the data is still there
- Destruction should be recorded, with what was destroyed, when and by whom
Anonymisation for analysis
| Technique | What it does | Residual risk |
|---|---|---|
| Removing direct identifiers | Drops names, addresses, reference numbers | High: combinations still identify people |
| Pseudonymisation | Replaces identifiers with a key held separately | Reversible by design, so still personal data |
| Aggregation | Reports groups rather than individuals | Small groups can still disclose |
| Generalisation | Age bands instead of dates of birth | Reduces precision of the analysis |
| Suppression | Hides cells below a minimum count | Can be defeated by differencing two reports |
| Noise or differential privacy | Adds controlled randomness | Trades accuracy for protection, deliberately |
Re-identification is easier than it looks: a date of birth, a postcode and a gender identify most individuals in the UK population. Removing the name is not anonymisation.
Step 1 of 4 The raw record: obviously identifying, and obviously sensitive.
Key terms you must be able to define
- Personal data
- Any information relating to an identified or identifiable living person.
- Special category data
- Sensitive personal data such as health, biometrics, religion or sexual orientation, needing extra protection.
- Data controller
- The organisation that decides why and how personal data is processed.
- Data processor
- An organisation that processes personal data on a controller's behalf.
- Lawful basis
- One of six legal grounds that makes processing personal data lawful.
- Purpose limitation
- The principle that data collected for one purpose is not reused for an incompatible one.
- Data minimisation
- Collecting only the data that is necessary for the stated purpose.
- Subject access request
- A person's request to see the personal data an organisation holds about them.
- DPIA
- A Data Protection Impact Assessment, required before high risk processing.
- ICO
- The Information Commissioner's Office, the UK data protection regulator.
- Computer Misuse Act 1990
- The law making unauthorised access to computer systems an offence.
- Database right
- Protection for a database whose contents required substantial investment to assemble.
- Retention period
- The documented length of time a dataset is kept before secure destruction.
- Re-identification
- Linking supposedly anonymous data back to the individuals it describes.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
Marks come from applying a named law to the scenario and reaching a conclusion. Identify the data, name the principle or Act, say whether the activity is lawful, and say what has to change. An answer that lists the seven principles without touching the scenario scores a fraction of one that applies two of them properly.
Mistakes that cost marks here
- Saying 'GDPR' without naming the UK GDPR and the Data Protection Act 2018.
- Treating consent as the only lawful basis. Most internal analytics relies on legitimate interests.
- Calling data anonymous when it is pseudonymised.
- Forgetting purpose limitation, which is the principle analytics projects breach most often.
- Confusing the controller with the processor. Using a cloud provider does not transfer accountability.
- Thinking a deleted file is erased, or that deletion covers the backups.
The UK GDPR gives people the right to ask what an organisation holds about them, and the organisation has one month to answer. A single such request has forced more data clean-ups than any internal policy ever has, because you cannot answer it if you do not know what you hold.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LOne valid principle
- LA second, different principle
- LA third, different principle
Data minimisation, purpose limitation, and storage limitation.
- LThe controller decides the purpose and means of processing
- LThe processor acts on the controller's instructions
- LA valid example of each
- LAccountability remains with the controller
The controller is the organisation that decides why personal data is processed and how, and the processor is an organisation that processes it on the controller's behalf and only within its instructions. A retailer that stores its customer database with a cloud provider is the controller, and the cloud provider is the processor. The distinction matters because accountability does not transfer with the data: the retailer remains responsible for having a lawful basis, for answering subject access requests and for the security of the processing, and must have a written contract requiring the provider to apply appropriate security, use no further sub-processors without permission, and report any breach to it promptly.
- LHealth data is identified as special category data
- LA condition or explicit consent is needed for it
- LPurpose limitation is engaged by the new use
- LTransparency: users must be told
- LAggregation does not automatically make it anonymous
- LA DPIA, or the right to object, or a clear conclusion
Heart rate is health information and therefore special category data under the UK GDPR, and location data combined with step counts is close behind it in sensitivity, so the company needs not only a lawful basis but an additional condition, which in a commercial context realistically means explicit consent. Selling insights to insurers is also a new purpose: the data was given so the app could show users their own activity, and purpose limitation means it cannot simply be repurposed, so the company must either obtain fresh, specific, freely given consent for the insurance use or abandon it. Whatever it does must be set out plainly in the privacy notice rather than buried in terms of service, because transparency is a principle in its own right and a consent the user did not understand is not consent. The company should also not assume that aggregation solves the problem: location traces are highly identifying, and an aggregate reported for a small group or compared between two reports can disclose an individual, so it would need a documented minimum group size and suppression rules. Because this is large scale processing of special category data for a purpose with potential significant effects on individuals, a Data Protection Impact Assessment is required before it begins, and users must be able to object and withdraw consent as easily as they gave it.
- LA lawful basis is identified, probably public task
- LPurpose limitation across the three systems is addressed
- LData minimisation is applied
- LSpecial category or children's data is recognised
- LA DPIA is required and named
- LAn ethical issue beyond legality is raised
- LTechnical and governance safeguards are proposed
- LA judgement about whether and how it should proceed
The council is likely to have a lawful basis here, since safeguarding and support are part of its public task rather than something requiring consent, but a basis for processing each dataset separately is not automatically a basis for combining them. All three were collected for different statutory purposes, so purpose limitation has to be addressed explicitly: the council must be able to point to the function the combined processing serves and show that it is compatible with the original collection. Data minimisation then constrains the design, because the temptation is to join everything available when the actual question needs a small number of fields; a system built on three indicators is both more lawful and more likely to work than one built on forty. The data involved is among the most sensitive a council holds: school admissions concerns children, housing records can reveal health and disability, and the combination is capable of inferring special category information even where no such field is present, which brings additional conditions into play. Because this is large scale processing of sensitive data about vulnerable people, a Data Protection Impact Assessment is mandatory and should be completed before any system is built, not written up afterwards. Beyond legality there are ethical questions the law does not settle. Families would be surprised to learn that their rent account and their child's school application had been joined to score them, and that surprise matters, because a council depends on people reporting difficulties honestly. A false positive risks stigmatising a family, while a false negative gives false assurance, and the people affected have least power to challenge either. The council should therefore keep a human decision in the loop at all times rather than acting on a score. The safeguards follow: role-based access on least privilege so only the support team sees identified records while analysts work on pseudonymised extracts, full audit logging of every access, a documented retention period with automatic deletion, a named owner for the combined dataset, published information about what is being done and how to object, and a scheduled review of whether the system is producing better outcomes. On balance the council can proceed, but only with the DPIA completed first, the field list cut to the minimum that works, and a standing commitment that the output prompts a human conversation rather than triggering an automated consequence.