Ethical, Legal and Environmental Impacts
The four Acts you must be able to name, open source against proprietary licensing, and how to structure the extended answer that carries the most marks on the paper.
The four Acts
Data Protection Act 2018
Governs how organisations handle personal data, implementing the UK's version of GDPR. It requires that data is:
- processed lawfully, fairly and transparently,
- collected for a specified purpose and not used for another,
- adequate and limited to what is necessary,
- accurate and kept up to date,
- kept no longer than necessary,
- kept secure.
It also gives individuals rights: to see the data held about them, to have inaccurate data corrected, to have data erased, and to object to certain uses.
Computer Misuse Act 1990
Creates three offences:
- Unauthorised access to computer material.
- Unauthorised access with intent to commit a further offence.
- Unauthorised modification of computer material, which covers deleting files and spreading malware.
The word doing the work in all three is unauthorised. It is why penetration testing with written permission is lawful and the same actions without it are not.
Copyright, Designs and Patents Act 1988
Protects the creator's ownership of original work, including software, music, images and text. Copying, distributing or adapting protected work without permission is an infringement. Software is covered as a literary work, which is why licence terms have legal force.
Software licences
Proprietary software is sold under a licence that restricts what you may do. The source code is not provided, you may not modify or redistribute it, and support comes from the vendor.
Open source software is distributed with its source code and a licence that permits use, modification and redistribution. It is usually free of charge, and support comes from the community rather than a company.
| Proprietary | Open source | |
|---|---|---|
| Source code | Not available | Available |
| Modification | Not permitted | Permitted |
| Cost | Usually paid | Usually free |
| Support | From the vendor, often guaranteed | From the community, no guarantee |
| Security | Fewer people can inspect it | Anyone can inspect it, but anyone can also find flaws |
It means the source is open. Some open source software is sold, and much free software is not open source. The exam distinguishes them.
Step 1 of 4 Computer Misuse Act 1990
- Proprietary software is a finished program. The source code is hidden and the licence limits what you may do.
- Open source software comes with its source code, and the licence lets you modify it and share copies.
- Open source does not mean free of charge. It means the source code is open.
Ethical and environmental issues
The specification names a set of technologies and expects you to discuss their impacts.
Cyber security and hacking. Attacks cost organisations money and cost individuals their privacy. The same skills used to defend systems are used to attack them, which is why authorisation is the ethical line.
Mobile technologies and wireless networking. They allow work and contact from anywhere, which brings flexibility but also the expectation of being permanently available. Wireless coverage is uneven, so those in poorer or more rural areas get a worse service, which is one form of the digital divide.
Cloud storage. Convenient, backed up and reachable from anywhere, but it places personal data in the hands of a company that may be in another country under different laws, and it is unusable without a connection.
Wearable technologies and computer based implants. A fitness tracker or a smart insulin pump can improve health and independence enormously. Both also generate a continuous record of a person's body, which raises questions about who may see it, how long it is kept and what happens if it is breached or if a device fails.
Autonomous vehicles. They could reduce collisions caused by human error and give mobility to people who cannot drive. They also raise questions about liability when one crashes, about the loss of driving jobs, and about how a vehicle should be programmed to behave in a situation where harm is unavoidable.
Environmental impacts
- Manufacturing devices consumes rare metals, extracted with significant environmental and human cost.
- Data centres consume very large amounts of electricity for both power and cooling.
- Electronic waste is often exported and dismantled unsafely, releasing toxic material.
- Against that: video conferencing removes journeys, smart systems reduce energy use, and digital documents remove paper.
- Ethical: questions of right and wrong, such as fairness, privacy and responsibility.
- Legal: the laws that apply, which you must be able to name.
- Cultural: how technology changes the way people live, communicate and work.
- Environmental: the materials and energy technology uses, and the savings it can make.
- Mining rare metals damages land.
- Making a device uses energy, water and chemicals.
- Using it needs electricity, including at the data centres.
- Throwing it away creates e-waste, with toxic metals in landfill.
- Recycling recovers materials, which go back into making new devices.
- Reduce, reuse and recycle, in that order of importance.
Writing the extended answer
The impacts question carries the largest single mark allocation on the paper, and it is marked by levels rather than by counting points.
Structure that reliably reaches the top band:
- Set out the situation in one sentence. Show you understand what is being asked.
- Give the case for. Two or three developed points, each with a consequence: not "it is convenient" but "it is convenient, which means staff can work from home and the company needs less office space".
- Give the case against. The same standard of development. This is where most answers thin out.
- Say who is affected. Different stakeholders want different things. The company, the customer, the employee and the wider public rarely agree, and naming that tension is what level three answers do.
- Reach a conclusion and justify it. A conclusion is not a summary. It is a judgement, and it must follow from what you actually wrote.
An answer with excellent arguments and no conclusion cannot reach the top band, because the question asked you to evaluate and you did not. One sentence beginning "On balance" is enough, provided it commits.
Ethical, legal, cultural, environmental and privacy. Explicitly labelling which one each of your points falls under makes the range of your answer visible to the examiner in a way that prose alone does not.
Key terms you must be able to define
- Data Protection Act 2018
- Legislation governing how organisations collect, store and use personal data.
- Computer Misuse Act 1990
- Legislation creating offences of unauthorised access to and modification of computer material.
- Copyright, Designs and Patents Act 1988
- Legislation protecting the creator's ownership of original work, including software.
- Proprietary software
- Software supplied without source code under a licence restricting modification and redistribution.
- Open source software
- Software supplied with its source code under a licence permitting use, modification and redistribution.
- Digital divide
- The gap between those with good access to technology and those without.
- Electronic waste
- Discarded electronic equipment, which contains toxic materials and is often disposed of unsafely.
- Stakeholder
- A person or group affected by a decision or a technology.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
This topic is where the largest marks are, and where the most are thrown away.
Develop every point. A claim is half a mark. A claim with a consequence is a whole one. Get into the habit of writing "which means" after every assertion.
Name the Act, do not describe it vaguely. "This would be an offence under the Computer Misuse Act 1990, specifically unauthorised access to computer material" is precise. "It is illegal" is not.
Argue both sides even when you have a clear view. An answer that only argues one way cannot reach the top band however well written it is, because evaluation requires weighing.
Conclude, and make the conclusion follow. The examiner is looking for a judgement supported by your own argument, not a restatement of the question.
Mistakes that cost marks here
- Saying open source means free of charge. It means the source code is available.
- Giving one sided answers to an evaluate question, which caps the mark however good the writing is.
- Listing impacts without developing any of them into consequences.
- Confusing the Acts. Personal data is the Data Protection Act, unauthorised access is the Computer Misuse Act, copying software is the Copyright Act.
- Ending an extended answer without a conclusion.
The Computer Misuse Act was passed in 1990 after two journalists accessed the Duke of Edinburgh's mailbox and could not be convicted, because at the time no law clearly covered unauthorised access to a computer.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LThe right to see the data held about them
- LThe right to have inaccurate data corrected, or to have data erased
An individual has the right to see the personal data an organisation holds about them, and the right to have inaccurate data corrected. They also have the right to have data erased where there is no longer a good reason to keep it, and to object to certain uses such as marketing.
- LOpen source software is usually free of licence cost
- LWhich allows the school to spend the money on something else, or install it on any number of machines
- LSupport comes from the community rather than a vendor
- LSo there is no guaranteed response time if something goes wrong, and staff may need more technical skill
The advantage is cost and freedom of installation. Open source software is normally free of licence charges and may be installed on any number of machines without counting them, so a school can equip an entire suite for nothing and spend the saved budget elsewhere. It can also be modified if the school has the expertise, for example to remove features that confuse younger pupils. The disadvantage is support. Proprietary software is usually backed by a vendor with a support contract and a guaranteed response time, whereas open source support comes from community forums and volunteers with no obligation to respond at all. If something breaks the week before an exam, the school is dependent on its own technical staff, and that risk is exactly what many organisations pay a licence fee to avoid.
- LThe company has legitimate reasons, such as protecting data and preventing misuse
- LMonitoring can detect an attack or a leak early
- LEmployees have a reasonable expectation of privacy, particularly for incidental personal use
- LKeystroke logging could capture personal passwords and private information
- LThe Data Protection Act requires processing to be lawful, fair, transparent and proportionate
- LEmployees would have to be informed, and the data secured and kept only as long as needed
- LMonitoring can damage trust and morale, and change how people behave at work
- LReaches a justified conclusion, such as proportionate monitoring with clear notice
The company has a genuine case. It is responsible for the data on those laptops and can be held to account if that data is lost, so being able to see when a large file is copied to an unauthorised location or when an employee visits a site known to distribute malware allows a problem to be caught early rather than discovered months later. Monitoring also provides evidence if misuse is alleged, which protects the accused employee as much as the company. Against that, employees have a reasonable expectation of privacy even on a work device, because in practice almost every organisation tolerates some incidental personal use, and a keystroke logger does not distinguish between a work document and a personal banking password typed at lunchtime. Capturing credentials for systems the company has no business seeing is a serious intrusion, and it also creates a new risk: the company now holds a store of passwords that would be extremely damaging if it were breached. Legally the Data Protection Act requires that processing personal data is lawful, fair, transparent and proportionate to a specified purpose. Recording every keystroke is very difficult to defend as proportionate when a narrower measure, such as logging access to sensitive files, would achieve the same aim. Employees would have to be told clearly what is recorded and why, the data would have to be kept securely and deleted when no longer needed, and the company would need to be able to justify the necessity of each element. There is also a cultural cost that is easy to overlook. Comprehensive surveillance signals distrust, and organisations that adopt it often find that morale falls and that people become cautious rather than productive. On balance, the company should not implement keystroke logging. It should adopt proportionate monitoring focused on the specific risk it is trying to manage, such as logging access to confidential systems and blocking known malicious sites, set it out in a written policy that every employee is shown and asked to acknowledge, restrict who can see the logs, and delete them on a defined schedule. That protects the company's data and its legal position while remaining defensible as necessary and proportionate.