Legal, Moral, Cultural and Ethical Issues

1 State two rights that the Data Protection Act 2018 gives to individuals. 2

One mark for each of the following, to a maximum of 2.

• The right to access the personal data held about them
• The right to have inaccurate data corrected, or erased in certain circumstances

Model answer. Individuals have the right of access, meaning they can request and receive a copy of the personal data an organisation holds about them, together with information about how and why it is being processed. They also have the right to rectification, requiring inaccurate data to be corrected, and in certain circumstances the right to erasure, requiring their data to be deleted.

2 Explain the difference between copyright and a patent. 3

One mark for each of the following, to a maximum of 3.

• Copyright protects the expression of an idea such as code, text or music
• Copyright arises automatically as soon as the work is created
• A patent protects an invention or process and must be formally applied for

Model answer. Copyright protects the particular expression of an idea, such as the source code a programmer writes, a piece of music or a photograph, and it arises automatically the moment the work is created in a fixed form, with no need to register or apply for anything. A patent protects an invention or a novel technical process rather than an expression of it, and it does not arise automatically: an application must be made, examined and granted, and the invention must be genuinely new and non obvious. The distinction matters in software because the code itself is protected by copyright as soon as it is written, whereas an underlying algorithm or technique may in some jurisdictions be patentable, which is a separate and far more contested question.

3 An insurance company uses a machine learning system trained on twenty years of its own decisions to determine premiums. Discuss the ethical issues raised. 8

One mark for each of the following, to a maximum of 8.

• The system learns patterns from historical data
• Past decisions may contain discrimination which the system reproduces
• The output appears objective because it comes from a computer, so it is trusted more
• Names a group likely to be disadvantaged
• Accountability is unclear when no one can explain an individual decision
• Recognises legitimate benefits such as consistency, speed and better risk pricing
• Applies an ethical framework or gives a genuine counterargument
• Reaches a supported conclusion with a safeguard or recommendation

Model answer. The central issue is that a system trained on twenty years of the company's own decisions learns the patterns present in those decisions, and it cannot distinguish patterns that reflect genuine risk from patterns that reflect historical unfairness. If past underwriters systematically quoted higher premiums to applicants from particular postcodes, and those postcodes correlate strongly with ethnicity or income, the system will reproduce that behaviour faithfully while never being told to consider ethnicity at all, because a proxy variable carries the information. The harm is compounded by how the output is perceived: a decision produced by an algorithm appears objective and mathematical, so it is scrutinised far less than an equivalent human judgement would be, and an applicant who suspects unfairness has no visible decision to challenge. This connects directly to accountability. If nobody at the company can explain why a particular applicant was quoted a particular premium, then in practice no one is answerable for it, and both regulators and the applicant are left unable to test whether the decision was lawful. A deontological analysis is unfavourable here: applicants have a right to be assessed on their own circumstances rather than on statistical associations with people who share an incidental characteristic, and that right does not depend on whether the aggregate outcome is efficient. The benefits are nonetheless real and should not be dismissed. An automated system applies the same criteria to every applicant, removing the inconsistency and individual prejudice of human underwriters having a bad day, it produces decisions in seconds rather than days, and more accurate risk pricing genuinely can reduce premiums for lower risk customers who were previously overcharged by cruder models. A consequentialist would weigh these gains seriously. On balance the company should not deploy the system in the form described. The defensible position is to use it, but with specific safeguards: auditing outputs for disparate impact across protected characteristics rather than only checking that such characteristics are absent from the inputs, requiring that every decision can be explained in terms an applicant would understand, retaining human review for any decision the model is uncertain about or that falls outside normal ranges, and retraining on data that has itself been examined for historical bias. Without those, the system does not remove human prejudice, it automates it and removes the ability to see it.

4 Explain why the Computer Misuse Act 1990 was necessary. 3

One mark for each of the following, to a maximum of 3.

• Before it, unauthorised access to a computer was not clearly a criminal offence
• Existing laws such as those on theft and criminal damage did not apply to data
• Prosecutions failed, so specific legislation was introduced

Model answer. Before 1990 there was no offence in UK law that clearly covered gaining access to a computer system without permission. The existing legislation had been written for a physical world: theft required an intention to permanently deprive someone of property, and criminal damage required damage to tangible property, neither of which fitted a situation where data had been read or copied but nothing physical had been taken or broken. This became untenable when prosecutions of individuals who had demonstrably broken into systems collapsed because no applicable offence could be identified. The Computer Misuse Act was passed to close that gap, creating specific offences of unauthorised access, unauthorised access with intent to commit a further offence, and unauthorised acts intended to impair the operation of a computer, the last of which now covers denial of service attacks and the deliberate distribution of malware.

5 Explain what is meant by algorithmic bias and describe one way an organisation could reduce it. 4

One mark for each of the following, to a maximum of 4.

• Systematic unfairness in the decisions an automated system produces
• It usually arises from the training data rather than from deliberate intent
• Because the system learns and reproduces patterns present in that data
• Describes a mitigation such as auditing outputs, diversifying training data or requiring explainability

Model answer. Algorithmic bias is systematic unfairness in the decisions produced by an automated system, where particular groups are consistently disadvantaged relative to others. It normally arises not from any deliberate intent by the developers but from the training data, because a machine learning system finds and reproduces whatever patterns exist in the examples it is shown. If that data is unrepresentative, or if it records past decisions that were themselves discriminatory, the system learns those patterns and applies them to new cases while appearing entirely neutral. One effective mitigation is regular auditing of outputs for disparate impact: rather than only checking that protected characteristics are absent from the inputs, which is inadequate because proxy variables carry the same information, the organisation measures whether outcomes differ significantly across groups and investigates any disparity it finds. This should be combined with requiring that decisions be explainable, so that an individual affected can be told why a decision was reached and can challenge it.