Legislation and Privacy
The Acts you must be able to name and apply, what each one actually makes unlawful, and the difference between open source and proprietary software licensing.
The Acts
Data Protection Act 2018
Governs how organisations collect, store and use personal data, implementing the UK's version of GDPR. Data must be:
- processed lawfully, fairly and transparently,
- collected for a specified purpose and not used for an unrelated one,
- adequate and limited to what is necessary,
- accurate and kept up to date,
- kept no longer than necessary,
- kept secure.
It also gives individuals the right to see the data held about them, to have inaccurate data corrected, to have data erased where there is no longer good reason to keep it, and to object to certain uses.
Computer Misuse Act 1990
Creates three offences:
- Unauthorised access to computer material.
- Unauthorised access with intent to commit a further offence.
- Unauthorised modification of computer material, which covers deleting files and spreading malware.
The decisive word in all three is unauthorised. Penetration testing carried out with written permission is lawful; the identical actions without permission are not.
Copyright, Designs and Patents Act 1988
Protects the creator's ownership of original work, including software, music, images, video and text. Copying, distributing or adapting protected work without permission is an infringement. Software is protected as a literary work, which is what gives licence terms legal force.
"This is an offence under section 1 of the Computer Misuse Act 1990, because the employee accessed records they had no authorisation to see" is a full answer. "It is illegal" is not.
Step 1 of 4 Computer Misuse Act 1990
Software licensing
Proprietary software is supplied under a licence that restricts what you may do with it. The source code is not provided, you may not modify or redistribute it, and the number of installations is usually limited.
Open source software is supplied with its source code, under a licence permitting use, modification and redistribution.
| Proprietary | Open source | |
|---|---|---|
| Source code | Not provided | Provided |
| Modification | Not permitted | Permitted |
| Redistribution | Not permitted | Permitted |
| Cost | Usually paid | Usually free of charge |
| Support | From the vendor, often contractual | From the community, no guarantee |
| Development | By one company on its own schedule | By anyone, often faster on fixes |
It means the source is open. Some open source software is sold with a support contract, and plenty of free software is not open source at all. Edexcel distinguishes the two.
Choosing between them
For a school, the argument for open source is cost and freedom to install on any number of machines. The argument against is support: nobody is contractually obliged to fix anything, so the school depends on its own technical staff. For a hospital running critical systems, a support contract with guaranteed response times may be worth far more than the licence fee saved.
- Proprietary software is a finished program. The source code is hidden and the licence limits what you may do.
- Open source software comes with its source code, and the licence lets you modify it and share copies.
- Open source does not mean free of charge. It means the source code is open.
Privacy in practice
Legislation sets the floor. In practice, most privacy loss happens through choices that are entirely lawful.
Data collected as a by-product. Location history, search terms and browsing are collected because the service works better with them, and then retained.
Consent that is not really a choice. A service that is unusable without agreeing to tracking has not obtained a meaningful choice, which is why data protection law requires consent to be freely given.
Aggregation. Individually harmless pieces of data combine into something that is not. Where you are each morning, what you buy, who you message and what you search for together identify you far more precisely than any single one of them.
Permanence. Data once released cannot be recalled. A leaked dataset is copied within hours, and no legal remedy puts it back.
What data is collected, who can see it, and what happens when it leaks. An answer that addresses all three is complete, and one that addresses only the first is not.
- Everything you do online leaves data behind: posts, searches, purchases, location and cookies.
- Companies join the pieces into a profile of you.
- Advertisers, websites and data brokers use the profile, to sell to you or to sell it on.
Key terms you must be able to define
- Data Protection Act 2018
- Legislation governing how organisations collect, store and use personal data.
- Personal data
- Information that can be used to identify a living individual.
- Computer Misuse Act 1990
- Legislation creating offences of unauthorised access to and modification of computer material.
- Copyright, Designs and Patents Act 1988
- Legislation protecting ownership of original work, including software.
- Proprietary software
- Software supplied without source code under a licence restricting modification and redistribution.
- Open source software
- Software supplied with source code under a licence permitting modification and redistribution.
- Consent
- Permission that must be freely given, specific and informed for data processing to be lawful.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
Legislation questions are applied questions, and the marks are for applying rather than reciting.
Name the Act and the specific breach. Which Act, which principle or offence, and which fact in the scenario triggers it.
Distinguish the Acts cleanly. Personal data is the Data Protection Act. Unauthorised access is the Computer Misuse Act. Copying software or music is the Copyright Act. Mixing them up loses the mark even when the reasoning is sound.
Get licensing right. Open source means the source is available and may be modified, not that it costs nothing, and the disadvantage that carries marks is the absence of guaranteed support.
Mistakes that cost marks here
- Saying open source means free of charge.
- Using the Data Protection Act for a hacking scenario, or the Computer Misuse Act for a data handling one.
- Saying an organisation may keep personal data indefinitely. It must be kept no longer than necessary.
- Forgetting that authorisation is what makes penetration testing lawful.
- Naming an Act without saying what in the scenario breaches it.
The Computer Misuse Act exists because of a prosecution that failed. Two journalists accessed a mailbox belonging to the Duke of Edinburgh in 1984, and the courts found no law clearly covered it. Parliament wrote one.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LData must be collected for a specified purpose and used only for that purpose
- LData must be kept secure, accurate, or no longer than necessary
Personal data must be collected for a specified and lawful purpose and not then used for an unrelated one. It must also be kept secure, kept accurate and up to date, and retained no longer than is necessary for the purpose it was collected for.
- LIdentifies the Computer Misuse Act 1990
- LBecause the access was unauthorised, even though the employee has a legitimate account
- LIdentifies the Data Protection Act 2018
- LBecause the personal data was used for a purpose other than the one it was collected for
This breaches the Computer Misuse Act 1990, specifically the offence of unauthorised access to computer material. It does not matter that the employee has a legitimate account on the system: their authorisation extends only to the records they need for their own work, and accessing a record outside that is access they were not authorised to make. It also breaches the Data Protection Act 2018, because the neighbour's medical data was collected for the purpose of providing their care and was then used for an entirely unrelated personal purpose, which is not lawful, fair or transparent processing. The hospital itself may also be at fault if its access controls did not limit staff to the records their role requires.
- LOpen source software is usually free of licence charges
- LSo it can be installed on any number of machines and the money spent elsewhere
- LSupport comes from the community rather than a vendor
- LSo there is no guaranteed response if something goes wrong, and more technical skill may be needed in house
The advantage is cost and freedom of use. Open source software normally carries no licence fee and may be installed on as many machines as the business needs without counting them, so a small business can equip itself for nothing and spend the saved money on something else. It can also be modified if the business has, or can hire, the expertise. The disadvantage is support. Proprietary software is usually sold with a support contract that obliges the vendor to respond within an agreed time, whereas open source support comes from community forums where nobody has any obligation to help. If a critical system fails on a busy day the business is dependent on whatever technical skill it has in house, and for a small business that may be nobody at all.
- LContinuous location data is highly revealing about a person's life
- LUsers may not realise how much is collected or what it is used for
- LConsent must be freely given, specific and informed to be lawful
- LAnonymised location data can often be re-identified from patterns
- LThe Data Protection Act requires a specified purpose and adequate security
- LReaches a reasoned conclusion about what the company should do
Continuous location data is among the most revealing information a person can give away. Where a phone spends every night is a home address, where it spends every weekday is a workplace or a school, and a regular visit to a particular clinic or place of worship reveals things a person may never have chosen to disclose. Users are unlikely to appreciate that when they install a fitness app, because the collection is a by-product of a feature they wanted and the resale is described in terms almost nobody reads. That matters legally as well as ethically: data protection law requires consent to be freely given, specific and informed, and consent buried in a long agreement for a purpose the user did not anticipate does not meet that standard. The company's claim that the data is anonymous deserves particular scrutiny. Stripping names from location traces does not make them anonymous, because the pattern itself identifies the person: the combination of one home and one workplace is close to unique. Data sold as anonymous can therefore be re-identified, at which point the protection the company relied on has never existed. The company should stop selling location data by default. If it wants to offer it commercially, it should be a separate, clearly explained, opt-in choice that is not required to use the app, the data should be genuinely aggregated rather than merely de-named, and the company should be able to show that it meets the requirements of purpose limitation and security under the Data Protection Act 2018.