Ethical, Legal and Environmental Impacts

1 State two rights that the Data Protection Act 2018 gives an individual. 2

One mark for each of the following, to a maximum of 2.

• The right to see the data held about them
• The right to have inaccurate data corrected, or to have data erased

Model answer. An individual has the right to see the personal data an organisation holds about them, and the right to have inaccurate data corrected. They also have the right to have data erased where there is no longer a good reason to keep it, and to object to certain uses such as marketing.

2 Explain one advantage and one disadvantage of a school using open source software rather than proprietary software. 4

One mark for each of the following, to a maximum of 4.

• Open source software is usually free of licence cost
• Which allows the school to spend the money on something else, or install it on any number of machines
• Support comes from the community rather than a vendor
• So there is no guaranteed response time if something goes wrong, and staff may need more technical skill

Model answer. The advantage is cost and freedom of installation. Open source software is normally free of licence charges and may be installed on any number of machines without counting them, so a school can equip an entire suite for nothing and spend the saved budget elsewhere. It can also be modified if the school has the expertise, for example to remove features that confuse younger pupils. The disadvantage is support. Proprietary software is usually backed by a vendor with a support contract and a guaranteed response time, whereas open source support comes from community forums and volunteers with no obligation to respond at all. If something breaks the week before an exam, the school is dependent on its own technical staff, and that risk is exactly what many organisations pay a licence fee to avoid.

3 A company plans to monitor its employees' work laptops, recording every website visited and every key pressed. Discuss the ethical and legal issues this raises. 8

One mark for each of the following, to a maximum of 8.

• The company has legitimate reasons, such as protecting data and preventing misuse
• Monitoring can detect an attack or a leak early
• Employees have a reasonable expectation of privacy, particularly for incidental personal use
• Keystroke logging could capture personal passwords and private information
• The Data Protection Act requires processing to be lawful, fair, transparent and proportionate
• Employees would have to be informed, and the data secured and kept only as long as needed
• Monitoring can damage trust and morale, and change how people behave at work
• Reaches a justified conclusion, such as proportionate monitoring with clear notice

Model answer. The company has a genuine case. It is responsible for the data on those laptops and can be held to account if that data is lost, so being able to see when a large file is copied to an unauthorised location or when an employee visits a site known to distribute malware allows a problem to be caught early rather than discovered months later. Monitoring also provides evidence if misuse is alleged, which protects the accused employee as much as the company. Against that, employees have a reasonable expectation of privacy even on a work device, because in practice almost every organisation tolerates some incidental personal use, and a keystroke logger does not distinguish between a work document and a personal banking password typed at lunchtime. Capturing credentials for systems the company has no business seeing is a serious intrusion, and it also creates a new risk: the company now holds a store of passwords that would be extremely damaging if it were breached. Legally the Data Protection Act requires that processing personal data is lawful, fair, transparent and proportionate to a specified purpose. Recording every keystroke is very difficult to defend as proportionate when a narrower measure, such as logging access to sensitive files, would achieve the same aim. Employees would have to be told clearly what is recorded and why, the data would have to be kept securely and deleted when no longer needed, and the company would need to be able to justify the necessity of each element. There is also a cultural cost that is easy to overlook. Comprehensive surveillance signals distrust, and organisations that adopt it often find that morale falls and that people become cautious rather than productive. On balance, the company should not implement keystroke logging. It should adopt proportionate monitoring focused on the specific risk it is trying to manage, such as logging access to confidential systems and blocking known malicious sites, set it out in a written policy that every employee is shown and asked to acknowledge, restrict who can see the logs, and delete them on a defined schedule. That protects the company's data and its legal position while remaining defensible as necessary and proportionate.