Ethics & Legal
Contents
Background information
Disclaimer this is not legal advice, the writer not a lawyer please seek professional legal counsel
This page is about protecting your self against any possible legal issues that may occur when dealing with customers. as well as the ethical issues that maybe faced within this field
This advice is focused on the UK only!
Legal
To be expanded upon
- Data protection laws(GDPR,DPA)
- Consent and Authorization requirements Templates As mentioned above, the best way to obtain and prove you had consent to access data is through a well documented paper trail. In the references section of this page, you will find templates for such agreements.
- Confidentiality obligations
- Intellectual property rights This extends far beyond the scope of even this entire website, but is important to note, all the data on the device is considered the intellectual property of the owner (unless pre-existing agreements state otherwise)
- Contractual Obligations Contracts are an important element as they state clearly and most importantly in a well documented fashion what both parties agreed upon and expect at the of the transaction, such as price, chance of recovery, what happens in the case of data loss, and expected time frame for the work, and any other factor that could be contested in a court of law.
- Liability for Data loss or damage Responible and risk management are two more key reasons why have a well documented contract in writing that clearly outlines and lists any and all risks that can occur when preforming data recovery procedures.
- Data breach reporting obligations By law in the UK you have 72 hours(3 days) to report any breach to the Information Commissioner office(ICO) once you become aware of a breach, also depending of the svenality of the breach you maybe also require,
- Consumer protection Laws These laws exist to try and prevent unethical pratices such as fair treatment regardless of a invdiuals apperence,bielfs and or personal charateristics.
- Legal obligation to report illegal material This is where it starts to get complcated both legally and ethically, as the clients privacy is the top factor, unless you discover material such as child abuse,plans to commit iilegal acts such as murders,robberaies and or terrorism.
Data protection laws such as the General data protection regulations 2016(GDPR) and the data protection act 2018(DPA) are two key pieces of leggislation to keep in mine when working with other peoples data espially if its considered
to be personally identifiable information(PII) such as names, address, pictures of people, as any data belongs to a resisdent of the UK or the EU is subject to these laws even if you are not within these places
is heavily regulated and carries major fines if the regulations and acts aren't followed.
The two key points of GDPR and the DPA that you need to watch out for are
1.Consent is Key
In order to work with the data on patient drives in any capitcy the owner of the data have given their consent for that particular part of the data to be accessed, and their consent must not have been withdrawn.(criminal cases function
differently, but consent is still required.
2. Un-consental access to date is considered to be the same as obtaining the data through methods such as stealing or hacking under UK law as per the computer misuse act 1990.
This is why having documented consent for you to the data recovery technician to access the data that belongs to the client is so important to protect yourself legally.
This extends beyond simply not providing details of a customer's data without prior consent, you as a data handler are responsible for having the proper security measures and policies in place to ensure that customer's data
remains confidential and the only people who can access it are the people required to, for the amount of time they're required too. Nobody should have access to data they do not need access too.
this means that even if you see an idea on someone's laptop, phone or desktop, you can not take it and pass it off as your own for any reason.
Without a contract there is no proving that you told the client it would be 500 pounds to complete the job, espically if the client refuses to pay for the work conducted or on time (without a payment plan worked out), this can lead to a lengthy,
legal battle that is likely to cost well over the initial 500 pound fee, as well as the reputational damage that often occurs regardless of the legal outcome.
and that the client understands and accepts these risks, as well as if data is lost then you as the person who preformed the procedure are not at fault.
It should also detail which party is liable for damages should they occur. For example if a package is damaged in shipping after the procedure has been completed, who is responsible?,
the device as not been packaged securely, then it could fall to you and not the shipping company or the client.
to notify each indivual that there as been a data breach and they may have been affected.
They also prevent companies from presenting either false or missleading information to possible/actual clients. as well as taking advice of a clients situation.
Such as a client needs data recovery services because they are despriate to recover images of a loved one, this does not include a client needing data recovery services
quickly or within a certain time frame.
if you do come across such things, you should stop immidately disconntect the drive and notify the police immidaely of the situation, assuming you do not have a company policy in place for this.
Ethics
To be expanded upon
- Privacy and Confiedntiality
- Data Ownership
- Intergrity and Honesty
- Environmental considerations(E-waste)
Step-by-step guide with images
Insert step-by-step walkthrough with images and summary text here
Flow chart of order of operations
Insert a flow chart of steps and actions for each task (create using diagram)
Related Topics
Topics such as desoldering to chip off or firmware dumping for disk PCB repairs
Templates
External references in wiki references can just be cited through the keyword link
- Reference 1: Template for permission to handle personal data(GDPR)
- Reference 2: Client commication log
- Reference 3: Data recovery report
- Reference 4: NDA
- Reference 5: Service agreement for data recovery