Data Protection and Computer Misuse Legislation
Data Protection Act, Computer Misuse Act, and Ethical Issues
Legislation and ethics in computing are examined at A-Level to ensure students understand the legal framework and moral responsibilities surrounding technology. You need to know specific acts, their provisions, and be able to discuss ethical dilemmas.
Data Protection Act 2018 (UK GDPR)
The DPA 2018 implements the EU's General Data Protection Regulation (GDPR) in UK law. It governs how personal data is collected, stored, processed, and shared.
Key terminology:
| Term | Meaning |
|---|---|
| Personal data | Any information relating to an identifiable living person |
| Special category data | Sensitive data: race, health, religion, biometrics, political opinions |
| Data subject | The person whose data is held |
| Data controller | The organisation that decides how and why data is processed |
| Data processor | A third party that processes data on behalf of the controller |
| ICO | Information Commissioner's Office — the UK regulator |
The Seven Data Protection Principles
| # | Principle | Meaning |
|---|---|---|
| 1 | Lawfulness, fairness, transparency | Data must be processed legally and openly |
| 2 | Purpose limitation | Collected for specified, explicit purposes only |
| 3 | Data minimisation | Only collect data that is necessary |
| 4 | Accuracy | Data must be kept accurate and up to date |
| 5 | Storage limitation | Not kept longer than necessary |
| 6 | Integrity and confidentiality | Protected against unauthorised access, loss, or damage |
| 7 | Accountability | The data controller must demonstrate compliance |
Data Subject Rights
Individuals have the right to:
- Access their data (Subject Access Request — free, within 1 month)
- Rectification — have inaccurate data corrected
- Erasure ("right to be forgotten") — have data deleted in certain circumstances
- Restrict processing — limit how their data is used
- Data portability — receive their data in a machine-readable format
- Object to processing (especially for direct marketing)
- Not be subject to automated decision-making (including profiling) without human review
Lawful Bases for Processing
Data can only be processed if at least one lawful basis applies:
- Consent — the individual has given clear consent
- Contract — processing is necessary to fulfil a contract
- Legal obligation — required by law
- Vital interests — to protect someone's life
- Public task — necessary for a task in the public interest
- Legitimate interests — the controller's interest, balanced against the individual's rights
Penalties
The ICO can issue fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious breaches.
Computer Misuse Act 1990
The CMA makes certain computer-related activities criminal offences. It was introduced in response to hacking cases where existing law was inadequate.
Three main offences:
| Section | Offence | Maximum penalty |
|---|---|---|
| Section 1 | Unauthorised access to computer material (basic hacking — accessing data you shouldn't) | 2 years imprisonment |
| Section 2 | Unauthorised access with intent to commit further offences (hacking to steal money, commit fraud) | 5 years imprisonment |
| Section 3 | Unauthorised modification of computer material (creating/spreading viruses, DDoS attacks, deleting data) | 10 years imprisonment |
Section 3A (added 2006): Making, supplying, or obtaining articles for use in offences under Sections 1-3 (e.g., creating hacking tools).
Other Relevant Legislation
| Act | Key provisions |
|---|---|
| Copyright, Designs and Patents Act 1988 | Protects creative works (software, text, music); illegal to copy, distribute, or modify without permission |
| Regulation of Investigatory Powers Act 2000 (RIPA) | Governs surveillance, interception of communications; ISPs can be required to provide data |
| Freedom of Information Act 2000 | Right to access information held by public authorities |
| Equality Act 2010 | Requires digital services to be accessible (relevant to web accessibility standards) |
Ethical Issues in Computing
Ethics are moral principles that guide behaviour. Unlike laws, ethical standards are not enforced by courts but by professional codes and social norms.
Artificial Intelligence Ethics
| Issue | Concern |
|---|---|
| Bias in AI | Training data may encode historical biases (racial, gender); AI amplifies them |
| Job displacement | Automation replacing human workers (manufacturing, customer service, driving) |
| Autonomous weapons | Lethal decisions made without human oversight |
| Deepfakes | AI-generated fake video/audio used for misinformation |
| Transparency | "Black box" AI systems — decisions can't be explained |
Privacy and Surveillance
| Issue | Concern |
|---|---|
| Mass surveillance | Government monitoring of communications (Snowden revelations) |
| Corporate data collection | Tech companies tracking behaviour for targeted advertising |
| Facial recognition | Used without consent; high error rates for certain demographics |
| Smart devices | IoT devices collecting data in homes (smart speakers, cameras) |
Digital Divide
The gap between those with access to technology and those without:
- Economic: Cost of devices and internet access
- Geographic: Rural areas with poor connectivity
- Educational: Lack of digital literacy skills
- Generational: Older adults less comfortable with technology
Environmental Impact
- E-waste: Discarded electronics contain hazardous materials; often exported to developing countries
- Energy consumption: Data centres consume enormous amounts of electricity
- Planned obsolescence: Devices designed to become outdated quickly, encouraging waste
- Rare earth mining: Materials for electronics extracted in environmentally destructive ways
Intellectual Property
- Software piracy: Copying and distributing software without permission
- Open source vs proprietary: Ethical arguments for and against freely sharing code
- Patent trolls: Companies that acquire patents solely to sue others
- Fair use: Where does legitimate use of copyrighted material end?
Professional Bodies
- BCS (British Computer Society): The UK's professional body for IT; maintains a code of conduct covering public interest, professional competence, duty to the profession, and duty to relevant authority
- ACM / IEEE: International bodies with their own codes of ethics
Exam Tips
- Know the seven DPA principles — you may be asked to apply them to a specific scenario
- For the Computer Misuse Act, distinguish between the three sections — the level of intent increases from 1 to 3
- Ethical questions require balanced discussion — present arguments for AND against, then give a reasoned conclusion
- When discussing AI ethics, use specific examples (biased hiring algorithms, self-driving car dilemmas)
- The DPA applies to living individuals only; it protects personal data, not business data
- A Subject Access Request must be fulfilled within one month and is free — these details are commonly examined
- For essay-style questions, structure your answer with clear paragraphs: introduce the issue, explain the law/ethical principle, apply to the scenario, conclude