Document Management

Document management is synonymous with information management and can feed into the information strategy. It should be encoded within a policy.

It should comprise

• Creation -
• Classification - sensitivity, ownership and custody includes labelling
• Transmission - respond to risk of inadvertent transmission (e.g logical and physical access control, clear desk, clear screen, storage encryption policies), deliberate attempts to access or steal documents and confidentiality of documents sent to 3rd parties*
• Retention & - should take into account commercial value and regulatory requirements. May be a minimum/maximum rule
• Destruction  - should require heightened control where the risks associated with failure to destroy are high. Ideas include destruction certificates, outsourcing, management oversight, formal destruction process.

*Transmission conditions for sensitive data sent to third parties might include the following;

• Management responsibilities and procedures for controlling and notifying transmission,despatch and receipt.
• Minimum standards for packaging and transmission.
• Responsibilities and liabilities in the event of loss of data.
• Use of an agreed labelling system for sensitive or critical information, ensuring that the labels are immediately understood and that the information is appropriately protected.
• Information ownership and responsibilities for data protection.
• Technical standards for recording and reading information.
• Any special controls that may be required to protect information in transit, such as passwords.
• Splitting the consignment into more than one delivery and/or despatching

 Should take into account the particular security risks related to traffic travelling via the internet.

Databases

Databases are application that store data. They fall into a number of types;

• hierarchical
• networked database systems
• relational
• object oriented

Knowledge

Knowledge has the following properties. Intangible, Not exhaustive, Sharing increases it

Explicit and tacit (tangible and intangible(know-how)) Knowledge management steps are as follows

Identify/create, Collect/codify, Store (in a repository of sorts) Diffuse/use

Data Protection Act 1998

The Act required member states ‘to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal
data’. It came into force on 1 March 2000. It covers computer and manual records.

The Act contains the following principles. Personal Data (shall)/(shall not) be

1. Processed fairly and lawfully, and not be processed unless certain conditions are met
2. Obtained for specified and lawful purposes and not be further processed in any manner incompatible with those purposes.
3. Adequate, relevant and not excessive in relation to the purpose for which they are processed.
4. Accurate and, where necessary, kept up to date.
5. Kept for longer than is necessary for its purpose. 
6. Processed in accordance with the rights of data subjects under the Act. 
7. Appropriate measures shall be taken against unauthorised or unlawful processing of personal data.
8. Transferred to a country outside the EEA unless that country has an adequate level of protection for the rights and freedoms of data subjects.

The legislation enshrines the following rights;

• Right of ACCESS - max fee of £10
• Right to PREVENT processing if likely to cause distress or damage.
• Right to prevent processing for MARKETING
• Right in relation to AUTOMATED decision
• Right to COMPENSATION
• Rectification, blocking, erasure and destruction
• Request for ASSESSMENT

 

Legislation & Regulation

The following legislation relates to computer security and/or information.

• Copyright Designs & Patent Act 1988
• Computer Misuse Act 1990
• Data Protection Act 1998
• Human Rights Act 1998 - basically the right to privacy which may restrict the rights of organisations to monitor work email.
• Freedom of Information Act 2000 - provides the general right of access to recorded information held by public bodies. Public authorities are required to maintain a publication scheme.

Information

This section begins with the information pyramid describing the relationship between data, information, knowledge and wisdom. Wisdom isn't mentioned again. Challenges related to data, knowledge and information management are covered. Information management is described under the heading of 'document' management.