Computer Science Legislation

The Data Protection Act 2018 works alongside the UK General Data Protection Regulation (UK GDPR). Together, they regulate how organisations, including businesses and government departments, handle personal data. They do not ban useful record-keeping: a school can, for example, hold guardians’ contact details so that it can contact them in an emergency. However, the organisation must follow data protection rules.

Personal data must be:

• Used fairly, lawfully and transparently. An organisation must have a lawful reason for processing it and be clear about how it is used.
• Collected for specified, explicit purposes. Information collected for one stated purpose is not automatically available for unrelated uses.
• Adequate, relevant and limited to what is necessary. Collect enough information for the task, but not unnecessary extra details.
• Accurate and, where necessary, kept up to date. Incorrect details should be corrected.
• Kept for no longer than necessary. Records should not be retained indefinitely without a continuing need.
• Handled securely. Protect information against unauthorised access or use, accidental loss, destruction and damage.

Consider a school’s emergency-contact records. It should explain why it needs the information, collect relevant contact details, update changed telephone numbers and restrict access to appropriate staff. Collecting unrelated information or leaving the records accessible to everyone would not meet these responsibilities.

Individuals also have rights over their personal data. These include being informed about its use, accessing it, having inaccurate information corrected and, in appropriate circumstances, having it erased or restricting its processing. These rights have exceptions: a request to delete information does not always mean an organisation must immediately remove every record.

Sensitive information, such as health data, religious beliefs and racial or ethnic background, has stronger legal protection. The central idea is that organisations may process personal data, but must do so lawfully and responsibly—not simply because the information is available to them.

Computer Misuse Act 1990: permission to access and change systems

The Computer Misuse Act 1990 was introduced to bring activities such as computer hacking within the law. Its central distinction is between authorised and unauthorised actions. Being technically able to enter a system is not the same as having permission.

Three important forms of computer misuse are:

• Unauthorised access to computer material. For example, a pupil discovers a teacher’s password, logs into the teacher’s account and opens files without permission. Reading the files is enough; the pupil does not have to change them.
• Unauthorised access with intent to commit further offences. This involves accessing a system without permission with the intention of committing another offence, such as fraud. The intention to commit the further offence distinguishes it from access alone.
• Unauthorised modification of computer material. For example, a pupil accesses school records and changes their test result without permission. Deleting another person’s files or introducing malware to damage a system are other examples of unauthorised interference.

By contrast, a teacher opening records they are authorised to use, or an administrator making an authorised change, is not committing these offences. Permission must cover the particular action: being allowed to read a file does not necessarily mean being allowed to alter it.

Copyright, Designs and Patents Act 1988: protecting creative work

The Copyright, Designs and Patents Act 1988 protects intellectual property. In computing, copyright applies to work such as software, photographs, web content, music and films. It gives the copyright owner control over how protected work is used, helping prevent others from exploiting it without permission.

Copyright protection arises automatically for qualifying original work. The creator does not have to register it or add a copyright symbol for protection to exist.

Without the relevant permission, actions that can infringe copyright include:

• copying protected work;
• distributing copies, whether sold or given away;
• renting or lending copies to the public;
• performing, showing or playing the work in public;
• making an adaptation;
• putting the work on the internet.

For example, downloading a film and uploading copies for other people without the copyright owner’s permission infringes copyright. Similarly, copying protected software and distributing it to classmates is not automatically allowed just because no money changes hands.

The owner can give permission for particular uses. A photographer might authorise a school to publish a photograph on its website, or a software licence might permit installation and use of a program. The user must stay within that permission: permission to use a program does not automatically include permission to distribute copies. Specific legal exceptions also exist, so not every use without express permission is necessarily an infringement.

Choosing the relevant legislation

Use the action to identify the law. An organisation keeping inaccurate customer addresses raises a data protection issue. Someone entering another person’s account without permission raises a computer misuse issue. Someone distributing unauthorised copies of a film raises a copyright issue.

One incident can involve more than one law. Unauthorised access to a customer database concerns computer misuse, while an organisation’s failure to protect the personal information in that database can also raise data protection issues.

Personal data must be used lawfully, fairly and transparently; for specified purposes; limited to what is necessary; accurate; retained only as needed; and kept secure.

Individuals have rights including access and correction. Erasure and other rights have exceptions.

Computer misuse essentials

Distinguish unauthorised access, unauthorised access intending further offences, and unauthorised modification or interference. Access alone can be an offence: changing data is not required.

Copyright essentials

Protection is automatic for qualifying original work. Copying, distributing, adapting or publishing protected work generally needs relevant permission unless a legal exception applies.

Permission covers particular actions—not every possible use. Several laws may apply to one incident.