Ethics & Legal: Difference between revisions
No edit summary |
No edit summary |
||
| Line 129: | Line 129: | ||
To be expanded upon | To be expanded upon | ||
<ul> | <ul> | ||
<li> Data protection laws( | <li> Data protection laws(GDPR,DPA)</li> | ||
<li> Consent and Authorization requirements(the template below)</li> | <p> Data protection laws such as the General data protection regulations 2016(GDPR) and the data protection act 2018(DPA) are two key pieces of leggislation to keep in mine when working with other peoples data espially if its considered</br> to be personally identifiable information(PII) such as names, address, pictures of people, as any data that is transmitted into either the UK or the EU is subject to these laws even if you are not within these places</br> | ||
< | is heavily regulated and carries major fines if the regulations and acts aren't followed. </br> | ||
<li> | |||
The two key points of GDPR and the DPA that you need to watch out for are </br> | |||
1.Consent is Key</br> | |||
In order to work with the data on patient drives in any capitcy the owner of the data have given their consent for that particular part of the data to be accessed, and their consent must not have been withdrawn.(criminal cases function </br> differently, but consent is still required. | |||
</br> | |||
2. Un-consental access to date is considered to be the same as obtaining the data through methods such as stealing or hacking under UK law as per the computer misuse act 1990.</br> | |||
This is why having documented consent for you to the data recovery technician to access the data that belongs to the client is so important to protect yourself legally. </p> | |||
</br> | |||
<li> Consent and Authorization requirements (the template below)</li> | |||
</p>As mentioned above, the best way to obtain and prove you had consent to access data is through a well documented paper trail. In the references section of this page, you will find templates for such agreements. </p> | |||
<li> Confidentiality obligations</li> | |||
<p> This extends beyond simply not providing details of a customer's data without prior consent, you as a data handler are responsible for having the proper security measures and policies in place to ensure that customer's data </br> | |||
remains confidential and the only people who can access it are the people required to, for the amount of time they're required too. Nobody should have access to data they do not need access too.</br> | |||
<li> Intellectual property rights</li> | <li> Intellectual property rights</li> | ||
This extends far beyond the scope of even this entire website, but is important to note, all the data on the device is considered the intellectual property of the owner(unless pre-existing argreements state otherwise)</br> | |||
this means that even if you see a idea on someones laptop,phone or desktop, you <B> can not </B> take it and pass it off as your own for any reason. | |||
<li> Contractual Obligations</li> | <li> Contractual Obligations</li> | ||
<li> Liability for Data loss or damage </li> | <li> Liability for Data loss or damage </li> | ||
<li> Data breach reporting obligations </li> | <li> Data breach reporting obligations </li> | ||
Revision as of 20:51, 12 February 2025
Contents
Background information
Disclaimer this is not legal advice, the writer not a lawyer please seek professional legal counsel
This page is about protecting your self against any possible legal issues that may occur when dealing with customers. as well as the ethical issues that maybe faced within this field
This advice is focused on the UK only!
Legal
To be expanded upon
- Data protection laws(GDPR,DPA)
- Consent and Authorization requirements (the template below) As mentioned above, the best way to obtain and prove you had consent to access data is through a well documented paper trail. In the references section of this page, you will find templates for such agreements.
- Confidentiality obligations
- Intellectual property rights This extends far beyond the scope of even this entire website, but is important to note, all the data on the device is considered the intellectual property of the owner(unless pre-existing argreements state otherwise)
- Contractual Obligations
- Liability for Data loss or damage
- Data breach reporting obligations
- Consumer protection Laws
- Legal obligation to report illegal material
Data protection laws such as the General data protection regulations 2016(GDPR) and the data protection act 2018(DPA) are two key pieces of leggislation to keep in mine when working with other peoples data espially if its considered
to be personally identifiable information(PII) such as names, address, pictures of people, as any data that is transmitted into either the UK or the EU is subject to these laws even if you are not within these places
is heavily regulated and carries major fines if the regulations and acts aren't followed.
The two key points of GDPR and the DPA that you need to watch out for are
1.Consent is Key
In order to work with the data on patient drives in any capitcy the owner of the data have given their consent for that particular part of the data to be accessed, and their consent must not have been withdrawn.(criminal cases function
differently, but consent is still required.
2. Un-consental access to date is considered to be the same as obtaining the data through methods such as stealing or hacking under UK law as per the computer misuse act 1990.
This is why having documented consent for you to the data recovery technician to access the data that belongs to the client is so important to protect yourself legally.
This extends beyond simply not providing details of a customer's data without prior consent, you as a data handler are responsible for having the proper security measures and policies in place to ensure that customer's data
remains confidential and the only people who can access it are the people required to, for the amount of time they're required too. Nobody should have access to data they do not need access too.
this means that even if you see a idea on someones laptop,phone or desktop, you can not take it and pass it off as your own for any reason.
Ethics
To be expanded upon
- Consent and authorization
- Privacy and Confiedntiality
- Data Ownership
- Intergrity and Honesty
- Minimzing harm
- Legal and regulatory compliance(it is ethically to comply with the law)
- Legal obligation to report illegal material
- Avoiding Exploitation of client in distress
- Environmental considerations(E-waste)
Step-by-step guide with images
Insert step-by-step walkthrough with images and summary text here
Flow chart of order of operations
Insert a flow chart of steps and actions for each task (create using diagram)
Related Topics
Topics such as desoldering to chip off or firmware dumping for disk PCB repairs
Further reading
External references in wiki references can just be cited through the keyword link
- Reference 1: Template for permission to handle personal data(GDPR)
- Reference 2: Client commication log
- Reference 3: Data recovery report
- Reference 4: NDA
- Reference 5: Service agreement for data recovery