Data Protection Act Exam Questions

• D Privacy (1)
• The only correct answer is D. The correct answer is privacy.
• A is not correct because consent is giving permission for personal data to be collected or used
• B is not correct because misuse is using personal data in a way that is not allowed or not intended
• C is not correct because ownership is about who legally controls or holds the personal data

• C Ownership (1)
• The only correct answer is C. The correct answer is ownership.
• A is not correct because consent is permission given to collect or use personal data
• B is not correct because misuse is using personal data for a purpose it was not collected for, or in an improper way
• D is not correct because privacy is keeping personal data private and free from unauthorised access

• A Consent (1)
• The only correct answer is A. The correct answer is consent.
• B is not correct because misuse is using personal data for an improper purpose
• C is not correct because ownership is who owns or controls the data
• D is not correct because privacy is keeping personal data private and free from unauthorised viewing

• B Misuse (1)
• The only correct answer is B. The correct answer is misuse.
• A is not correct because consent is the permission a customer gives for their data to be used, not an employee using it for another purpose
• C is not correct because ownership is who legally controls the data, not how the data is used
• D is not correct because privacy is keeping personal data secret from unauthorised people, not using it for another purpose

Award one mark for any of the following up to a maximum of two marks:

• Keeping personal information secret/private (1)
• Controlling who can see/access/use your personal data (1)
• Being free from observation/tracking/surveillance (1)
• The right to keep information about yourself to yourself (1)

Do not accept 'the data is kept secure/safe' on its own (this is data protection, not privacy).

Award one mark for any of the following up to a maximum of two marks:

• Who has legal rights/control over the data (1)
• The person or organisation that the data belongs to (1)
• The right to decide how the data is used/shared/sold (1)
• The right to control access to the data (1)

Do not accept 'owning the device/hardware where the data is stored' (this is ownership of equipment, not data).

Award one mark for any of the following up to a maximum of two marks:

• Permission/agreement given by an individual (1)
• For their personal data to be collected/used/processed (1)
• Given freely, without pressure (1)
• The individual is told/understands what their data will be used for (1)

Allow agree, agreement, approve, approval, 'a user says yes', opting in for permission/agreement.

Award the second mark only where the answer also states that permission/agreement is given; 'personal data is collected' on its own is not a definition of consent.

Do not accept 'consent is a legal requirement' (this says why consent is needed, not what it means).

Do not accept 'the user accepts the terms and conditions' on its own (it does not say what is being agreed to, e.g. the use of personal data).

Do not accept 'a company tells the user what data it will collect' on its own (no permission is given).

Do not accept 'consent can be withdrawn at any time' on its own (this is a right of the individual, not a definition of consent).

Award one mark for any of the following up to a maximum of two marks:

• Used without consent/permission (1)
• Shared/sold with/to third parties without consent (1)
• Used for a purpose different from the one it was collected for (1)
• Accessed/copied by someone who is not authorised (1)
• Used to commit identity theft/fraud (1)
• Altered/changed without authorisation so that the data is inaccurate (1)

Accept used for advertising/marketing only as an example of used without consent, not as a separate way.

Do not award two marks for the same idea, e.g. shared with third parties and sold to other companies are one way.

Do not accept "the data is lost" or "the data is stolen" on its own; losing or stealing data is a security breach, not misuse.

Award up to two marks for a linked description such as:

• Cookies store a record of the pages/sites a user visits (1) so their browsing habits can be tracked over time (1)
• Cookies can track a user across multiple websites (1) so data about their activity can be shared/sold to third parties (1)
• Cookies collect personal data (1) so it can be used/sold for purposes the user did not consent to (1)
• Cookies are stored on the user's device (1) so anyone else with access to the device can see which sites they have visited (1)

Allow 'cookies store/record data about a user's visits' as the first point, even if tracking is not named.

Do not accept responses about deleting/blocking cookies, or about cookies making a website work (e.g. remembering a shopping basket), unless they are linked to a privacy issue.

Do not accept generic answers such as 'cookies can be hacked' or 'cookies contain personal data' without a development.

Do not award credit for 'cookies are viruses' or 'cookies steal data'.

Award up to two marks for a linked description such as:

• The user has the right to agree to their personal data being collected (1) so they know what it will be used for (1)
• Consent allows the user to refuse/opt out (1) so their privacy is respected (1)
• Data protection legislation requires a lawful reason for processing personal data (1) so collecting the location data without consent would be misuse (1)
• The user can withdraw their consent at any time (1) so the app must stop collecting/using the data (1)

Accept agreement and refusal of consent as alternatives for the same point; do not award both.

Do not accept responses that only describe how consent is obtained (e.g. a tick box or a pop-up) without saying why it should be obtained.

Do not accept 'so the app can work' or 'to make the app better' unless it is linked to the user's agreement/privacy.

Do not accept 'so the data is secure' or 'to keep the user safe'; these are about security, not why consent should be obtained.

Award up to two marks for a linked description such as:

• The employee could change/alter a student's grade/details (1) without permission so that the record is no longer accurate (1)
• The employee could share/copy/sell the records to people outside the school (1) without the students' consent (1)
• The employee could look at/view records they do not need to see for their job (1) out of curiosity (1)
• The employee could delete/remove records (1) so the school no longer has accurate information (1)

Do not accept responses about hacking or stealing a password, as the employee already has access.

Do not accept responses that describe the data being lost or not kept secure without an act of misuse by the employee.

Ignore answers that repeat the question (e.g. the employee misuses the data).

Award up to two marks for a linked explanation such as:

• Visitors lose control over who knows their browsing habits/activities (1) because details of the pages they view are collected and stored (1)
• The visitor is tracked without their consent/knowledge (1) because the pages they visit are recorded without them being asked (1)
• The visitor can be identified/linked to their browsing history (1) because data about their visits is stored and may be shared with third parties (1)
• Personal information about the visitor's interests is worked out without them sharing it (1) because the pages they view are used to build a profile for targeted advertising (1)

For both marks, the expansion must follow/associate with the statement.

Allow other valid privacy points, e.g. the visitor is tracked without their consent (1), where the linked reason says how the browsing data is recorded or used (1).

Allow 'a profile of the visitor's interests/behaviour is built' (1) as the privacy point; a second mark needs a linked reason, e.g. that this information is worked out without the visitor choosing to share it.

Do not accept 'it is private' or 'they lose privacy' without saying what information is revealed or how it is used.

Do not accept 'information is collected' or 'data is stored' on its own without saying why this is a privacy issue.

Do not award answers that only describe data being hacked, stolen or kept secure; these are security issues, not privacy issues.

Award up to two marks for a linked explanation such as:

• Consent is required by data protection legislation (1) so the gym could be fined/prosecuted if it collects data without consent (1)
• The member has a choice about whether their data is collected (1) because they can refuse/say no (1)
• The member can be told what their data will be used for (1) so they know what they are agreeing to (1)
• The member has the right to withdraw consent (1) so the gym must stop using the data if the member changes their mind (1)
• The gym builds trust with members (1) because members know their data is being handled properly (1)

For both marks, the expansion must follow/associate with the statement.

Allow 'the member has a right to privacy' as a statement (1) if it is expanded with a reason such as the member controls who can see their data (1).

Do not accept 'the gym needs it' or 'it is the law/a legal requirement' without expansion as to what the law requires or what happens if it is broken.

Do not accept 'so the gym can use the data' without saying how consent protects the member or meets the law.

Do not accept answers about keeping data accurate or secure; these are data protection requirements but they are not about consent.

Award up to two marks for a linked explanation such as:

• The customer may receive more spam/unwanted marketing (1) because their email address/contact details have been sold/shared (1)
• The customer may lose money (1) because their card/bank details have been used fraudulently (1)
• The customer may have their identity stolen (1) so accounts/credit can be opened in their name (1)
• The customer may be targeted with scam/phishing messages (1) because criminals have obtained their contact details (1)

For both marks, the expansion must follow/associate with the statement.

Allow other valid effects on the customer where a linked reason is given, e.g. feeling embarrassed/distressed (1) because their private information has been made public (1)

Do not accept 'they lose privacy' without saying what happens to the customer as a result.

Do not accept an expansion that only says the shop holds the data, e.g. 'because the shop has their email address'; the reason must say how the data was misused.

Do not accept answers about the online shop being fined or losing customers; the question asks about the effect on the customer.