Legal, Moral, Cultural and Ethical Issues
The five acts you must name, the ethical frameworks that make an argument rigorous, and how to structure the extended response so it reaches the top level.
Legislation
Data Protection Act 2018
Implements GDPR in UK law. Personal data must be processed lawfully, fairly and transparently, collected for specified purposes, adequate and limited to what is necessary, accurate, kept no longer than necessary, and kept secure.
Individual rights include access, rectification, erasure, restriction of processing, portability and objection. Organisations must report serious breaches to the Information Commissioner within 72 hours.
Computer Misuse Act 1990
- Unauthorised access to computer material
- Unauthorised access with intent to commit or facilitate further offences
- Unauthorised acts with intent to impair, or recklessness as to impairing, the operation of a computer
The third offence covers denial of service attacks and the deliberate spreading of malware.
Copyright, Designs and Patents Act 1988
Protects intellectual property including software, music, film, images and writing. Note the distinction: copyright protects the expression of an idea and arises automatically, while a patent protects an invention and must be applied for.
Open source licensing gives users the right to view, modify and redistribute the source, sometimes with a copyleft requirement that derived works remain open. Proprietary licensing restricts users to running the compiled program.
Regulation of Investigatory Powers Act 2000
Governs the interception of communications and surveillance by public bodies. It permits monitoring under specified conditions and requires authorisation, and it is significant to computing because it defines when providers can be compelled to assist.
Wireless Telegraphy Act 2006 and Freedom of Information Act 2000
The former regulates the radio spectrum and makes unauthorised use of a wireless network an offence. The latter gives a right to request information held by public authorities.
Step 1 of 4 Computer Misuse Act 1990
- Proprietary software is a finished program. The source code is hidden and the licence limits what you may do.
- Open source software comes with its source code, and the licence lets you modify it and share copies.
- Open source does not mean free of charge. It means the source code is open.
Ethics and writing the extended answer
Frameworks that make an argument rigorous
- Consequentialism. Judge an action by its outcomes. A system is justified if the total benefit exceeds the total harm. The difficulty is that outcomes are uncertain and it can justify harming a minority for the majority.
- Deontology. Judge an action against duties and rights, regardless of outcome. Some things are wrong even if they produce good results, such as reading private messages without consent.
- Virtue ethics. Ask what a person of good character would do, focusing on honesty, responsibility and care.
Naming a framework and applying it turns an opinion into an argument, which is what the top mark band requires.
The recurring themes
- Automation and employment. Jobs are removed and created, but rarely in the same places or requiring the same skills, so the costs and benefits fall on different people.
- Algorithmic decision making. Systems trained on historical data reproduce historical bias while appearing objective. Accountability is unclear when nobody can explain a decision.
- Privacy and surveillance. Individually harmless data points combine into a detailed picture of a person's life.
- The digital divide. Moving services online excludes those without access, who are frequently those most dependent on the services.
- Environmental cost. Manufacturing, energy consumption and e-waste, weighed against reduced travel and more efficient systems.
- Censorship and free expression. Who decides what is removed, and by what process.
- Intellectual property in the age of AI. Whether training a model on copyrighted work is fair use, and who owns what a model generates.
Structuring the extended response
The high mark questions are levels marked, so the structure matters as much as the content.
- One sentence of context. Identify what is at stake and who is affected.
- Three developed paragraphs. Each takes one issue, states the point, explains the mechanism, names the specific group affected and acknowledges the counterargument.
- A conclusion that decides. Give a judgement with a reason, and where appropriate a condition under which your view would change.
Development, balance and a supported conclusion. Eight separate assertions score in the bottom band. Three fully developed arguments with a genuine counterpoint and a reasoned conclusion score in the top one.
A worked opening
An employer introduces software that monitors every keystroke made by employees working from home.
"The central tension here is between an employer's legitimate interest in verifying that work is being done and an employee's reasonable expectation of privacy in their own home. Legally the employer is not necessarily prohibited from monitoring, but under the Data Protection Act 2018 any such processing must be lawful, proportionate and transparent, which means covert keystroke logging would almost certainly be unlawful and even disclosed monitoring must be limited to what is genuinely necessary rather than gathering everything possible. Ethically, a deontological analysis is unfavourable to the employer: keystroke logging captures private messages, medical searches and banking activity conducted on the same device, and the fact that some of this is incidental does not remove the intrusion, because employees have a right to privacy that does not depend on whether the employer intends to exercise it. A consequentialist analysis is more finely balanced, since productivity gains are real, but the evidence suggests surveillance corrodes trust..."
Notice that each sentence does work: it names the framework, applies it to this scenario, identifies the specific harm, and anticipates the counterargument.
Key terms you must be able to define
- Data Protection Act 2018
- UK legislation implementing GDPR and governing the processing of personal data.
- Computer Misuse Act 1990
- Legislation creating offences of unauthorised access to and impairment of computer systems.
- Copyright, Designs and Patents Act 1988
- Legislation protecting intellectual property including software.
- Regulation of Investigatory Powers Act 2000
- Legislation governing interception of communications and surveillance by public bodies.
- Patent
- Legal protection for an invention, which must be applied for, unlike copyright.
- Open source licence
- A licence granting the right to view, modify and redistribute source code.
- Consequentialism
- Judging an action by whether its outcomes produce more benefit than harm.
- Deontology
- Judging an action against duties and rights rather than by its outcomes.
- Algorithmic bias
- Systematic unfairness in automated decisions, usually inherited from the training data.
- Digital divide
- The gap between those with reliable access to technology and those without.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
- Name the correct act with its year for any scenario, without hesitation
- Distinguish copyright, which is automatic, from a patent, which must be applied for
- Name and apply at least one ethical framework rather than simply asserting a view
- Identify the specific group affected in every paragraph, never just people in general
- Always acknowledge the strongest counterargument, then say why you still hold your position
- End with a judgement and, where you can, the condition that would change it
Mistakes that cost marks here
- Listing impacts without developing any of them, which caps the answer in the bottom band.
- Writing a one sided answer, which cannot reach the top band however correct it is.
- Confusing the Computer Misuse Act with the Copyright Act.
- Saying copyright must be registered. It arises automatically. Patents must be applied for.
- Omitting a conclusion, which loses marks even after a strong discussion.
- Asserting an opinion with no framework or reasoning behind it.
The Computer Misuse Act was passed in 1990 after two hackers who broke into Prestel, including the Duke of Edinburgh's mailbox, were acquitted because no existing law actually covered what they had done.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LThe right to access the personal data held about them
- LThe right to have inaccurate data corrected, or erased in certain circumstances
Individuals have the right of access, meaning they can request and receive a copy of the personal data an organisation holds about them, together with information about how and why it is being processed. They also have the right to rectification, requiring inaccurate data to be corrected, and in certain circumstances the right to erasure, requiring their data to be deleted.
- LCopyright protects the expression of an idea such as code, text or music
- LCopyright arises automatically as soon as the work is created
- LA patent protects an invention or process and must be formally applied for
Copyright protects the particular expression of an idea, such as the source code a programmer writes, a piece of music or a photograph, and it arises automatically the moment the work is created in a fixed form, with no need to register or apply for anything. A patent protects an invention or a novel technical process rather than an expression of it, and it does not arise automatically: an application must be made, examined and granted, and the invention must be genuinely new and non obvious. The distinction matters in software because the code itself is protected by copyright as soon as it is written, whereas an underlying algorithm or technique may in some jurisdictions be patentable, which is a separate and far more contested question.
- LThe system learns patterns from historical data
- LPast decisions may contain discrimination which the system reproduces
- LThe output appears objective because it comes from a computer, so it is trusted more
- LNames a group likely to be disadvantaged
- LAccountability is unclear when no one can explain an individual decision
- LRecognises legitimate benefits such as consistency, speed and better risk pricing
- LApplies an ethical framework or gives a genuine counterargument
- LReaches a supported conclusion with a safeguard or recommendation
The central issue is that a system trained on twenty years of the company's own decisions learns the patterns present in those decisions, and it cannot distinguish patterns that reflect genuine risk from patterns that reflect historical unfairness. If past underwriters systematically quoted higher premiums to applicants from particular postcodes, and those postcodes correlate strongly with ethnicity or income, the system will reproduce that behaviour faithfully while never being told to consider ethnicity at all, because a proxy variable carries the information. The harm is compounded by how the output is perceived: a decision produced by an algorithm appears objective and mathematical, so it is scrutinised far less than an equivalent human judgement would be, and an applicant who suspects unfairness has no visible decision to challenge. This connects directly to accountability. If nobody at the company can explain why a particular applicant was quoted a particular premium, then in practice no one is answerable for it, and both regulators and the applicant are left unable to test whether the decision was lawful. A deontological analysis is unfavourable here: applicants have a right to be assessed on their own circumstances rather than on statistical associations with people who share an incidental characteristic, and that right does not depend on whether the aggregate outcome is efficient. The benefits are nonetheless real and should not be dismissed. An automated system applies the same criteria to every applicant, removing the inconsistency and individual prejudice of human underwriters having a bad day, it produces decisions in seconds rather than days, and more accurate risk pricing genuinely can reduce premiums for lower risk customers who were previously overcharged by cruder models. A consequentialist would weigh these gains seriously. On balance the company should not deploy the system in the form described. The defensible position is to use it, but with specific safeguards: auditing outputs for disparate impact across protected characteristics rather than only checking that such characteristics are absent from the inputs, requiring that every decision can be explained in terms an applicant would understand, retaining human review for any decision the model is uncertain about or that falls outside normal ranges, and retraining on data that has itself been examined for historical bias. Without those, the system does not remove human prejudice, it automates it and removes the ability to see it.
- LBefore it, unauthorised access to a computer was not clearly a criminal offence
- LExisting laws such as those on theft and criminal damage did not apply to data
- LProsecutions failed, so specific legislation was introduced
Before 1990 there was no offence in UK law that clearly covered gaining access to a computer system without permission. The existing legislation had been written for a physical world: theft required an intention to permanently deprive someone of property, and criminal damage required damage to tangible property, neither of which fitted a situation where data had been read or copied but nothing physical had been taken or broken. This became untenable when prosecutions of individuals who had demonstrably broken into systems collapsed because no applicable offence could be identified. The Computer Misuse Act was passed to close that gap, creating specific offences of unauthorised access, unauthorised access with intent to commit a further offence, and unauthorised acts intended to impair the operation of a computer, the last of which now covers denial of service attacks and the deliberate distribution of malware.
- LSystematic unfairness in the decisions an automated system produces
- LIt usually arises from the training data rather than from deliberate intent
- LBecause the system learns and reproduces patterns present in that data
- LDescribes a mitigation such as auditing outputs, diversifying training data or requiring explainability
Algorithmic bias is systematic unfairness in the decisions produced by an automated system, where particular groups are consistently disadvantaged relative to others. It normally arises not from any deliberate intent by the developers but from the training data, because a machine learning system finds and reproduces whatever patterns exist in the examples it is shown. If that data is unrepresentative, or if it records past decisions that were themselves discriminatory, the system learns those patterns and applies them to new cases while appearing entirely neutral. One effective mitigation is regular auditing of outputs for disparate impact: rather than only checking that protected characteristics are absent from the inputs, which is inadequate because proxy variables carry the same information, the organisation measures whether outcomes differ significantly across groups and investigates any disparity it finds. This should be combined with requiring that decisions be explainable, so that an individual affected can be told why a decision was reached and can challenge it.