How it affects policies and procedures Topic 6 Legislation How it affects policies and procedures

Ensure compliance with: Copyright, Designs and Patents Act 1988 Computer Misuse Act 1990 Data Protection Act 1998 Freedom of Information Act 2000 Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 Health and Safety at Work Act 1974.

What needs to be done? Policies – staff need clear guidance. Procedures – certain actions need to be taken to ensure compliance.

Enforcing and controlling data protection Ensure data staff do not store personal data on portable devices without permission Appointment of data controller Ensure security of personal data Data Protection Act control/enforcement Ensure accuracy of data Notification process Procedures for subject access Training of users who access/use personal data Ensure data is deleted when no longer needed

Enforcing and controlling data protection Security policy – ensures personal data is kept secure by use of: passwords and usernames/user-IDs levels of access (only certain staff can access very personal details, e.g. medical records) firewalls – to prevent access to hackers encryption – to prevent unauthorised access.

Computer Misuse Act 1990 Covers: Deliberately planting or transferring viruses to computer systems to cause damage to programs and data. Using an organisation’s computers to carry out unauthorised work. Hacking into someone else’s computer system with a view to seeing/altering information. Using computers to commit various frauds.

Procedures to prevent problems under the Computer Misuse Act 1990 Acceptable use policy – set out in employment contract. Training to make staff aware of the problems.

Policies to prevent misuse No downloads - to prevent introduction of viruses. No unauthorised work. Ban on users swapping passwords or usernames. Regular audits. Checks on users’ disk space. Scanning of portable media.

Health and Safety at Work Act 1974 Ensuring the health and safety of employees in the workplace.

Health and Safety at Work Act 1974 Health and safety practices/procedures such as: Inspections of work area (chairs, desks, screens, etc.). Policy to allow staff to change tasks. Training to make staff aware of problems and what they can do to reduce their effects. Arranging and paying for eye tests and corrective treatment (e.g., glasses). Ensuring developed software is not frustrating to use.

Exam tip For questions on this topic: make sure that you deal with policies and procedures and not the details of the acts themselves.