F200 TA4: Legal Considerations

1 State three of the data protection principles. 3

One mark for each of the following, to a maximum of 3.

• One valid principle
• A second, different principle
• A third, different principle

Model answer. Data minimisation, purpose limitation, and storage limitation.

2 Explain the difference between a data controller and a data processor, using an example. 4

One mark for each of the following, to a maximum of 4.

• The controller decides the purpose and means of processing
• The processor acts on the controller's instructions
• A valid example of each
• Accountability remains with the controller

Model answer. The controller is the organisation that decides why personal data is processed and how, and the processor is an organisation that processes it on the controller's behalf and only within its instructions. A retailer that stores its customer database with a cloud provider is the controller, and the cloud provider is the processor. The distinction matters because accountability does not transfer with the data: the retailer remains responsible for having a lawful basis, for answering subject access requests and for the security of the processing, and must have a written contract requiring the provider to apply appropriate security, use no further sub-processors without permission, and report any breach to it promptly.

3 A fitness app collects users' step counts, heart rate and location. The company wants to sell aggregated insights to insurers. Explain the legal issues this raises and what the company must do. 6

One mark for each of the following, to a maximum of 6.

• Health data is identified as special category data
• A condition or explicit consent is needed for it
• Purpose limitation is engaged by the new use
• Transparency: users must be told
• Aggregation does not automatically make it anonymous
• A DPIA, or the right to object, or a clear conclusion

Model answer. Heart rate is health information and therefore special category data under the UK GDPR, and location data combined with step counts is close behind it in sensitivity, so the company needs not only a lawful basis but an additional condition, which in a commercial context realistically means explicit consent. Selling insights to insurers is also a new purpose: the data was given so the app could show users their own activity, and purpose limitation means it cannot simply be repurposed, so the company must either obtain fresh, specific, freely given consent for the insurance use or abandon it. Whatever it does must be set out plainly in the privacy notice rather than buried in terms of service, because transparency is a principle in its own right and a consent the user did not understand is not consent. The company should also not assume that aggregation solves the problem: location traces are highly identifying, and an aggregate reported for a small group or compared between two reports can disclose an individual, so it would need a documented minimum group size and suppression rules. Because this is large scale processing of special category data for a purpose with potential significant effects on individuals, a Data Protection Impact Assessment is required before it begins, and users must be able to object and withdraw consent as easily as they gave it.

4 A local council wants to combine data from its housing, council tax and school admissions systems to identify families who may need support. Discuss the legal and ethical issues involved, and what safeguards the council should put in place. 8

One mark for each of the following, to a maximum of 8.

• A lawful basis is identified, probably public task
• Purpose limitation across the three systems is addressed
• Data minimisation is applied
• Special category or children's data is recognised
• A DPIA is required and named
• An ethical issue beyond legality is raised
• Technical and governance safeguards are proposed
• A judgement about whether and how it should proceed

Model answer. The council is likely to have a lawful basis here, since safeguarding and support are part of its public task rather than something requiring consent, but a basis for processing each dataset separately is not automatically a basis for combining them. All three were collected for different statutory purposes, so purpose limitation has to be addressed explicitly: the council must be able to point to the function the combined processing serves and show that it is compatible with the original collection. Data minimisation then constrains the design, because the temptation is to join everything available when the actual question needs a small number of fields; a system built on three indicators is both more lawful and more likely to work than one built on forty. The data involved is among the most sensitive a council holds: school admissions concerns children, housing records can reveal health and disability, and the combination is capable of inferring special category information even where no such field is present, which brings additional conditions into play. Because this is large scale processing of sensitive data about vulnerable people, a Data Protection Impact Assessment is mandatory and should be completed before any system is built, not written up afterwards. Beyond legality there are ethical questions the law does not settle. Families would be surprised to learn that their rent account and their child's school application had been joined to score them, and that surprise matters, because a council depends on people reporting difficulties honestly. A false positive risks stigmatising a family, while a false negative gives false assurance, and the people affected have least power to challenge either. The council should therefore keep a human decision in the loop at all times rather than acting on a score. The safeguards follow: role-based access on least privilege so only the support team sees identified records while analysts work on pseudonymised extracts, full audit logging of every access, a documented retention period with automatic deletion, a named owner for the combined dataset, published information about what is being done and how to object, and a scheduled review of whether the system is producing better outcomes. On balance the council can proceed, but only with the DPIA completed first, the field list cut to the minimum that works, and a standing commitment that the output prompts a human conversation rather than triggering an automated consequence.