Learning Outcome 3
Understand the issues and constraints in relation to the use of business information in organisations

Aminath Inasha Afeef

Understand the issues and constraints in relation to the use of business information in organisations
● Legal issues: relevant data protection legislation eg Data Protection Act 1998, Freedom of Information Act 2000; other relevant legislation, eg Computer Misuse Act 1990 ● Ethical issues: codes of practice, eg on use of email, internet, ‘whistle blowing’; organisational policies; information ownership ● Operational issues: security of information; backups; health and safety; organisational policies; business continuance plans; costs, eg additional resources required, cost of development; impact of increasing sophistication of systems, eg more trained personnel, more complex software

Legal Issues

Legal Issues
● When companies deal with business information, what legal issues will they have to be concerned about? ● There are various items of legislation (law) to protect the use of business information.
○ ○ ○ ○ Data Protection Act 1998 Freedom of information Act 2000 Computer Misuse Act 1990 Other relevant legislation

Data Protection Act 1998
● Many businesses store and use information about people. ● The Data Protection Act protects the information held about people from being misused. ● According to the Data Protection Act, the information stored by businesses on databases must be: ○ obtained fairly and lawfully ○ used only for the purposes stated during collection ○ adequate, relevant and not excessive in relation to the intended use ○ accurate and up to date ○ not kept for longer than necessary

Data Protection Act 1998
○ processed in line with your rights ○ subject to procedures to prevent unlawful processing, accidental loss, destruction and damage to personal data ○ protected from transfer to an area outside the European Economic Area (EEA) unless adequate protection exists for that data in the area.

Freedom of Information Act 2000
● The Freedom of Information Act came into effect in 2005. ● It provides individuals or organisations with the right to request information held by a public authority. ● The public authority must tell the applicant whether it holds the information, which it must supply within 20 working days, in the requested format.

Freedom of Information Act 2000 Exemptions
● if the cost of a request for information exceeds an appropriate limit, the public authority may decide whether a greater public interest is being served by denying the request or supplying the information. ● If there is a dispute between an applicant and a public authority about a request for information, the Information Commissioner's Office may investigate and deem whether the information should be released or not.

Freedom of Information Act 2000 Affecting Organisation
● The organisations that are affected by the act are:
○ Publicly funded organisations ○ Government departments ○ Local Authorities ○ Police and Police Authorities ○ National Health Service ○ The armed forces

Computer Misuse Act 1990
● a law in the UK that legislates against certain activities using computers
○ hacking into other people's systems, ○ misusing software or helping a person to gain access to protected files on someone else's computer.

● The Computer Misuse Act is split into three sections and makes illegal:
○ unauthorised access to computer material ○ unauthorised access to computer systems with intent to commit another offence ○ unauthorised modification of computer material.

Ethical Issues

Ethical Issues
Business ethics - moral principles concerning acceptable and unacceptable behaviour by businesses ● Codes of practice exist in organisations to maintain business ethics on: ○ use of email ○ Internet ○ whistle-blowing ○ organisational policies ○ information ownership

E-Mail
● Many organisations today have a code of practice on the correct use of email.

Internet
● Many companies also have codes of practice on the use of the Internet and what their employees can and cannot use the Internet for. ● There are also codes of practice which govern selling on the Internet, which many businesses adhere to.

Whistle-blowing
● A whistle-blower is an employee who raises a concern about a business practice - either to management within the company or to an outside organisation(for example, the press). ● The concern may relate to fraud, crime, danger or any other serious risk that could impact on customers, colleagues, shareholders, the public, the environment or the organisation's reputation.

Whistle-blowing
● A worker can report things that aren’t right, are illegal or if anyone at work is neglecting their duties, including: ○ someone’s health and safety is in danger ○ damage to the environment ○ a criminal offence ○ the company isn’t obeying the law (like not having the right insurance) ○ covering up wrongdoing

Organisational Policies
● Organisations may have many policies to ensure that their businesses practices with regard to information can be done more ethically. ● This could be anything from how they manage information to ensuring marketing and other business practices are fair and just. ● What policies do you think a college will have regarding student private information? How about tutor information?

Information Ownership
● The concept of information ownership is simple if you create information in your dayto-day work, then you should be responsible for it. ● Suppose you write a report following a member of staff's annual review. This report is obviously confidential to some degree - it should only be viewed by a select group of people.

Information Ownership
● Since you created the report, this makes you the information owner. ● As the information owner, you are responsible for protecting this document to an appropriate degree. ● If you own information, you have to protect the information's confidentiality and act with integrity when anything has to be altered with regard to the information.

Today’s Activity
● Create 3 groups ● Each group will be given one of the following topics 1. Email policy 2. Internet Use policy 3. Whistle-blowing policy and procedure ● Research these policies used by different organisations and create a sample policy for your organisation.

Today’s Activity
● When you do research try to get information from various sources. This makes sure your information is valid and reliable ● Always cite your information so that the other person will know where you got the information

Operational Issues

Operational Issues
● Organisations have to store and manage countless pieces of information, with some being far more important than others. Lying at the heart of any information system are two fundamental issues of ensuring that:
○ the organisation receives the information it requires ○ the appropriate member(s) of staff receives the information

Operational Issues
● To make sure that information is managed appropriately, a number of policies and procedures have to be put in place, concerning:
○ ○ ○ ○ ○ security of information backups health and safety organisational policies business continuance plans.

Security of Information
● Information security management deals with maintaining the integrity and availability of organisational information and knowledge. ● It is important for businesses to have the right information available as and when they need it, in order to make good business decisions. ● For this reason, information is kept in IT systems most of the time ● As reliance on technology increases what are the risks faced by companies?

Security of Information
● IT security policy ○ should take account of common risks to the information that business relies on decision making ○ secure login identification ○ controls and limits access

Backups
● Large businesses have developed business continuity programmes to try to minimise the risk of losing vital business information stored on IT servers. ● This involves producing backups of information stored on the servers - some companies will create a backup every hour, while others will do so less frequently. ● This means that if the 'live' information is destroyed or damaged,a copy is available so the business can continue with as little disruption as possible.

Health and Safety
● Although it is unlikely that computer equipment will be dangerous in itself, it can be used in ways that can be a hazard to health of staff. ● Bad posture, incorrect positioning of equipment and susceptibility to repetitive strain injury (RSI) are health and safety risks that employers are legally required to take seriously.

Health and Safety
● Employers should carry out regular workstation assessments to make sure that computer screens are at the right level, and so on. ● If an employee suffers from RSI, they may be provided with ergonomic equipment(such as a keyboard or a mouse) which is designed tohelp reduce the risk of injury.

Organisational Policies
● Organisational policies that relate to the use of business information can help make sure that decisions affecting staff:
○ ○ ○ ○ are understandable and consistent meet legal requirements take full account of their impact contribute to productive working relationships

Organisational Policies
● Policies help make sure that staff have guidance to help them comply with legislation - for example, an organisational policy on the storage and usage of customer data should work within the requirements of the Data Protection Act. ● They should also help ensure that consistent decisions are made, which can be as important in internal communications as they are in handling customers.

Business Continuance Plans
● Business continuance plans are the steps that a company puts into place to make sure it is capable of surviving a worst-case scenario. ○ regular backups ● The business might consider natural disasters (such as flooding or fire), accidents (such as human error) or malicious attacks (such as a deliberate breach of security, or hacking into the computer systems) in its planning. ● As a result of the plan, employees may need to change the way they work - for example, storing information on a central server rather than on their personal hard drive.

Costs
● Ultimately, when deciding what policies to adopt and what measures to take, businesses need to consider the implementation and maintenance costs versus the benefits to the organisation. Some key considerations are
○ additional resources needed - would the business need to purchase new equipment or employ additional staff? ○ cost of development - is the solution already available (for example, as an off-the-shelf product or

Increasing Sophistication
● One of the consequences of an increasing reliance on technology - and the increasing complexity of that technology - is that employees need to be trained to use the equipment and software required to do their job. ● However, in addition to the cost of developing and implementing the software, the business would need to make sure that all their staff were trained to use the software effectively.