MskProdComputing
Back to the topic

The mark scheme starts on a new page, so you can print pages one and two for a student and keep the last page yourself. Everything prints in black on white whichever theme you are using.

Edexcel GCSE CS · 5.2

Legislation and Privacy

Section A: 10 multiple choice questions, 10 marks. Section B: 4 written questions, 16 marks. Total 26 marks.

Name

Class

Date

Mark  / 26

Section A

Circle the letter of the correct answer. One mark each.

  1. 1Under which Act would somebody be prosecuted for accessing a school system without permission?1
    1. ACommunications Act 2003
    2. BData Protection Act 2018
    3. CCopyright, Designs and Patents Act 1988
    4. DComputer Misuse Act 1990
  2. 2Which Act requires that personal data is kept no longer than necessary?1
    1. AData Protection Act 2018
    2. BComputer Misuse Act 1990
    3. CCopyright, Designs and Patents Act 1988
    4. DConsumer Rights Act 2015
  3. 3What is the defining feature of open source software?1
    1. AIt has no licence at all
    2. BIt costs nothing in every case
    3. CThe source code is provided and may be modified and redistributed
    4. DIt cannot be used by businesses
  4. 4What is a disadvantage of open source software for an organisation running critical systems?1
    1. AIt cannot be installed on more than one machine
    2. BIt is always more expensive
    3. CThere is no contractual guarantee that a fault will be fixed within a set time
    4. DThe source code cannot be inspected
  5. 5Sharing a paid film with thousands of people online would breach which Act?1
    1. AData Protection Act 2018
    2. BCopyright, Designs and Patents Act 1988
    3. CFreedom of Information Act 2000
    4. DComputer Misuse Act 1990
  6. 6What makes penetration testing lawful?1
    1. AIt is carried out with the system owner's authorisation
    2. BIt never accesses real data
    3. CIt only tests weaknesses that are already public
    4. DIt is done by a qualified professional
  7. 7Which right does the Data Protection Act give an individual?1
    1. AThe right to have inaccurate data about them corrected
    2. BThe right to prevent all data collection by law
    3. CThe right to access any organisation's database
    4. DThe right to be paid for their data
  8. 8What is meant by personal data?1
    1. AData belonging to a private company
    2. BAny data stored on a personal device
    3. CData that has been encrypted
    4. DInformation that can be used to identify a living individual
  9. 9Why is consent required to be freely given under data protection law?1
    1. AIt is required by the Computer Misuse Act
    2. BA service that is unusable without agreeing has not offered a real choice
    3. CWritten consent takes longer to obtain
    4. DIt reduces the amount of data collected
  10. 10Why is aggregation of data a privacy concern?1
    1. AIt makes data harder to encrypt
    2. BAggregated data takes more storage
    3. CIndividually harmless pieces of data combine into something that identifies a person precisely
    4. DIt slows down database queries

Section B

Answer in the space provided. The number of marks tells you how many separate points to make.

  1. 1StateState two principles of the Data Protection Act 2018.2
  2. 2ExplainAn employee at a hospital looks up the medical records of a neighbour who is not their patient. Explain which law this breaches and why.4
  3. 3ExplainExplain one advantage and one disadvantage for a small business of using open source software instead of proprietary software.4
  4. 4DiscussA fitness app collects location data continuously and sells it, in a form the company describes as anonymous, to advertisers. Discuss the privacy issues this raises.6

Mark scheme

Section A

1D2A3C4C5B6A7A8D9B10C

Section B

1 State two principles of the Data Protection Act 2018. 2

One mark for each of the following, to a maximum of 2.

  • Data must be collected for a specified purpose and used only for that purpose
  • Data must be kept secure, accurate, or no longer than necessary

Model answer. Personal data must be collected for a specified and lawful purpose and not then used for an unrelated one. It must also be kept secure, kept accurate and up to date, and retained no longer than is necessary for the purpose it was collected for.

2 An employee at a hospital looks up the medical records of a neighbour who is not their patient. Explain which law this breaches and why. 4

One mark for each of the following, to a maximum of 4.

  • Identifies the Computer Misuse Act 1990
  • Because the access was unauthorised, even though the employee has a legitimate account
  • Identifies the Data Protection Act 2018
  • Because the personal data was used for a purpose other than the one it was collected for

Model answer. This breaches the Computer Misuse Act 1990, specifically the offence of unauthorised access to computer material. It does not matter that the employee has a legitimate account on the system: their authorisation extends only to the records they need for their own work, and accessing a record outside that is access they were not authorised to make. It also breaches the Data Protection Act 2018, because the neighbour's medical data was collected for the purpose of providing their care and was then used for an entirely unrelated personal purpose, which is not lawful, fair or transparent processing. The hospital itself may also be at fault if its access controls did not limit staff to the records their role requires.

3 Explain one advantage and one disadvantage for a small business of using open source software instead of proprietary software. 4

One mark for each of the following, to a maximum of 4.

  • Open source software is usually free of licence charges
  • So it can be installed on any number of machines and the money spent elsewhere
  • Support comes from the community rather than a vendor
  • So there is no guaranteed response if something goes wrong, and more technical skill may be needed in house

Model answer. The advantage is cost and freedom of use. Open source software normally carries no licence fee and may be installed on as many machines as the business needs without counting them, so a small business can equip itself for nothing and spend the saved money on something else. It can also be modified if the business has, or can hire, the expertise. The disadvantage is support. Proprietary software is usually sold with a support contract that obliges the vendor to respond within an agreed time, whereas open source support comes from community forums where nobody has any obligation to help. If a critical system fails on a busy day the business is dependent on whatever technical skill it has in house, and for a small business that may be nobody at all.

4 A fitness app collects location data continuously and sells it, in a form the company describes as anonymous, to advertisers. Discuss the privacy issues this raises. 6

One mark for each of the following, to a maximum of 6.

  • Continuous location data is highly revealing about a person's life
  • Users may not realise how much is collected or what it is used for
  • Consent must be freely given, specific and informed to be lawful
  • Anonymised location data can often be re-identified from patterns
  • The Data Protection Act requires a specified purpose and adequate security
  • Reaches a reasoned conclusion about what the company should do

Model answer. Continuous location data is among the most revealing information a person can give away. Where a phone spends every night is a home address, where it spends every weekday is a workplace or a school, and a regular visit to a particular clinic or place of worship reveals things a person may never have chosen to disclose. Users are unlikely to appreciate that when they install a fitness app, because the collection is a by-product of a feature they wanted and the resale is described in terms almost nobody reads. That matters legally as well as ethically: data protection law requires consent to be freely given, specific and informed, and consent buried in a long agreement for a purpose the user did not anticipate does not meet that standard. The company's claim that the data is anonymous deserves particular scrutiny. Stripping names from location traces does not make them anonymous, because the pattern itself identifies the person: the combination of one home and one workplace is close to unique. Data sold as anonymous can therefore be re-identified, at which point the protection the company relied on has never existed. The company should stop selling location data by default. If it wants to offer it commercially, it should be a separate, clearly explained, opt-in choice that is not required to use the app, the data should be genuinely aggregated rather than merely de-named, and the company should be able to show that it meets the requirements of purpose limitation and security under the Data Protection Act 2018.