Legal, Moral, Cultural and Ethical Issues

What Legal, Moral, Cultural and Ethical Issues covers

Legal, Moral, Cultural and Ethical Issues is examined on component 01 of OCR Computer Science, Computer systems. 73 recall questions across 7 subtopics.

The 7 subtopics

Each one has its own page.

• Computing related legislation: Data Protection Act 1998Recall questions on the Data Protection Act 1998, its eight principles, data subjects, controllers and processors, subject access requests, sensitive personal data, exemptions, breach scenarios, enforcement by the Information Commissioner, automated decisions and its repeal.Open →
• Computing related legislation: Computer Misuse Act 1990Recall questions on the Computer Misuse Act 1990, why it was needed, its offences of unauthorised access, access with intent and impairing a computer, exceeding authorised access, penetration testing, hacking tools, ransomware and proving intent.Open →
• Computing related legislation: Copyright, Designs and Patents Act 1988Recall questions on the Copyright, Designs and Patents Act 1988, what it protects and for how long, moral rights, copyright compared with patents and trade marks, permitted acts for software, licences, copying public code, and civil and criminal infringement.Open →
• Computing related legislation: Regulation of Investigatory Powers Act 2000Recall questions on the Regulation of Investigatory Powers Act 2000, content and communications data, notices to disclose encryption keys, safeguards and scope creep, workplace interception, and applying the four main computing Acts to scenarios.Open →
• Moral and ethical issues: computers in the workforce, automated decision making and artificial intelligenceRecall questions on arguments about computers destroying or creating jobs, job polarisation, automating a warehouse, automated decision making and its objections, the COMPAS and 2020 grading cases, and the benefits, risks and responsibility of artificial intelligence.Open →
• Moral and ethical issues: environmental effects, censorship, monitoring behaviour and analysing personal informationRecall questions on the environmental costs and benefits of computing, replacing school laptops, internet censorship and filtering, monitoring behaviour at work and elsewhere, and analysing personal information, re-identification, filter bubbles and loyalty card data.Open →
• Moral and ethical issues: piracy, offensive communications, layout, colour and character setsRecall questions on digital piracy and its harm, laws on offensive online communications and real-name policies, accessible screen layout, internationalising interfaces, colour models, colour vision deficiency and cultural colour meanings, ASCII and Unicode, and encoding bugs.Open →

What you need to know

Answer each one before you reveal it.

Take Legal, Moral, Cultural and Ethical Issues further

The same content, four other ways.

Commonly confused

Pairs that lose marks when they are blurred together.

• The Data Protection Act 1998 vs The Computer Misuse Act 1990

  The Data Protection Act 1998: the statute governing how personal data about living individuals may be held and used. The Computer Misuse Act 1990: the statute creating offences of unauthorised access to and impairment of computer material.

• The Copyright, Designs and Patents Act 1988 vs The Regulation of Investigatory Powers Act 2000

  The Copyright, Designs and Patents Act 1988: the statute protecting original works and setting out which acts only the owner may do. The Regulation of Investigatory Powers Act 2000: the statute governing when public bodies may use covert investigatory techniques.

• The content of a communication vs Communications data

  The content of a communication: what was actually said or written, the body of the message itself. Communications data: everything about a message other than what it said, such as who, when and where.

Questions from this topic

Each one with the model answer underneath.

1. 1

   The Data Protection Act 1998 gets quoted in exam answers as though it protects computers. What does it actually protect, and who does it place the duty on?

   Model answer

   It protects people, not machines, and not data in general. Its subject matter is personal data: data relating to a living individual who can be identified either from that data alone, or from that data together with other information that the data controller holds or is likely to hold. The person the data is about is the data subject. The duty falls on the data controller, the person or organisation that decides why and how the data is processed, and on any data processor acting on the controller's instructions. Data about a dead person, or about a company rather than an individual, falls outside it, as does data that has been genuinely anonymised so no individual can be identified. Important point of fact: the 1998 Act is the legislation you should write about in the exam, but it is no longer the law. It was repealed on 25 May 2018 and replaced by the Data Protection Act 2018 working alongside the UK General Data Protection Regulation.

2. 2

   State the eight data protection principles set out in the Data Protection Act 1998.

   Model answer

   Personal data must be: (1) processed fairly and lawfully, and only where a stated condition for processing is met; (2) obtained for one or more specified and lawful purposes, and not further processed in a way incompatible with those purposes; (3) adequate, relevant and not excessive for those purposes; (4) accurate and, where necessary, kept up to date; (5) not kept for longer than is necessary for the purpose; (6) processed in accordance with the rights of data subjects under the Act; (7) protected by appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage; (8) not transferred outside the European Economic Area unless the destination country ensures an adequate level of protection for the rights of data subjects. The 2018 replacement regime keeps very similar principles but merges them into six and adds an explicit accountability principle requiring the controller to be able to demonstrate compliance.

3. 3

   Distinguish between a data subject, a data controller and a data processor, and give an example of each in a single scenario.

   Model answer

   The data subject is the living individual the personal data is about. The data controller is the person or organisation that determines the purposes for which and the manner in which the data is processed, and it is the controller who carries the legal responsibility. The data processor processes the data on the controller's behalf and on its instructions, without deciding the purpose. In one scenario: a secondary school stores pupil records. Each pupil is a data subject. The school is the data controller, because it decides what to record and why. The cloud provider hosting the management information system is a data processor, because it stores and backs up the data but has no say in what is collected or what it is used for. If the school decides to sell the records to a revision company, that decision is the controller's and the liability is the school's.

4. 4

   What is a subject access request, and what could a person get from one under the 1998 Act?

   Model answer

   A subject access request is a request made by a data subject to a data controller for the personal data the controller holds about them. Under the 1998 Act the controller had to be told in writing, could charge a small fee (generally up to ten pounds, capped lower at two pounds for a credit reference file and higher at up to fifty pounds for health and education records), and had to respond within forty days. The subject was entitled to be told whether their data was being processed, to be given a description of the data, the purposes of processing and who it might be disclosed to, to receive a copy of the information in intelligible form, and to be told any information available about the source of the data. Certain material could be withheld, for example where disclosing it would also reveal information about another identifiable person who had not consented. Under the current 2018 regime the request need not be in writing, the fee has gone in ordinary cases, and the deadline is one month.

5. 5

   The 1998 Act treated some categories of information as needing extra protection. Which categories, and why does that classification matter for a system designer?

   Model answer

   The Act called these sensitive personal data: racial or ethnic origin; political opinions; religious beliefs or other beliefs of a similar nature; trade union membership; physical or mental health or condition; sexual life; the commission or alleged commission of any offence; and any proceedings for an offence, their disposal or the sentence. Processing these lawfully required an additional condition to be satisfied on top of the ordinary conditions, typically explicit consent or a specific statutory ground such as medical purposes or equal-opportunity monitoring. It matters to a designer because it changes the engineering: these fields normally warrant stricter access control, separate storage or encryption, tighter audit logging, shorter retention, and an explicit consent-capture step in the interface rather than a pre-ticked box. The current regime keeps the idea under the label special category data and adds biometric and genetic data used for identification.

6. 6

   Why could a police force keep a database of suspects without letting each suspect see their entry, if the Act gave a right of access?

   Model answer

   Because the Act contained exemptions that switched off some of its provisions in defined circumstances. The most relevant here is the crime and taxation exemption, which disapplied the subject access right and the first principle where compliance would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax. Other exemptions covered national security, journalism, literature and art, regulatory activity, and processing purely for domestic or recreational purposes by an individual. An exemption is narrow and conditional: it applies only so far as compliance would actually cause the prejudice in question, so a force cannot refuse every request as a matter of blanket policy. The same structure of exemptions survives in the 2018 Act.

What is inside Levo

Six ways to work the same material.

Legal, Moral, Cultural and Ethical Issues revision questions

What does Legal, Moral, Cultural and Ethical Issues cover in OCR A-Level Computer Science?

7 subtopics: computing related legislation: data protection act 1998, computing related legislation: computer misuse act 1990, computing related legislation: copyright, designs and patents act 1988, computing related legislation: regulation of investigatory powers act 2000, moral and ethical issues: computers in the workforce, automated decision making and artificial intelligence, moral and ethical issues: environmental effects, censorship, monitoring behaviour and analysing personal information and moral and ethical issues: piracy, offensive communications, layout, colour and character sets. Each one has its own page with questions and model answers.

How is Legal, Moral, Cultural and Ethical Issues organised?

By the OCR H446 specification, subtopic by subtopic, so it matches the order you are taught it in.