- [Craig] When new computer technologies are introduced, a number of issues need to be considered
in addition to the technical feasibility of any solution.
These include ethical, privacy, legal, environmental and cultural issues.
In this video, we take a look at legislation relevant to computer science.
(uplifting piano jingle)
There are many laws which have relevance to the field of computer science and technology.
Some of these are quite old and have had to evolve and adapt to take account of technology.
Others have been created more recently, purely due to the impact and effect of technology.
The three areas of legislation or acts of parliament you need to be aware of for your GCSE exam
are the Data Protection Act 2018, and this includes the UK's recent implementation of GDPR,
the Computer Misuse Act of 1990 and the Copyright Designs and Patents Act 1998.
The Data Protection Act 2018 is an updated piece of UK legislation
which is designed to protect an individual's personal data.
Prior to 2018, it already provided a great deal of protection to UK citizens,
but it has since been updated and made even more robust
by fully implementing all of the general data protection regulations set down by the European Union.
It provides various rights and guarantees under law, and these are known as its basic principles.
The first is fair, lawful and transparent processing.
Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
This means that all data controllers must only process data for the purpose they acquired it
and with consideration of the data subject's rights.
The next principle is purpose limitation.
Data must only be collected for specified, explicit and legitimate purposes
and not further processed in a manner that is incompatible with those purposes.
The only exception to this purpose is relating to public interest and scientific or historical research.
The next process is data minimisation.
This means only holding as much data about a person as is necessary.
Data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are being processed.
For example, if you were collecting data to post a catalogue, you only need the person's name and address.
You do not need their date of birth or gender; it's not relevant.
The next principle is accuracy.
The data you collect must be accurate and, where necessary, kept up to date.
Every reasonable step must be taken to ensure that personal data that isn't accurate is corrected.
To fulfil this principle, you must update data if a customer notifies you of a change.
You must also erase the data if it's no longer necessary,
and under the regulation, data subjects have the right to rectification,
and this must be fulfilled within a month.
The next principle is data retention periods.
Data you hold must be kept in a form which permits identification of data subjects
for no longer than is necessary for the purposes for which the personal data is processed.
You may store it for longer for archiving purposes in the public interest, scientific or historical research purposes.
The next principle is that of data security.
The data you hold must be processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage
using appropriate technical or organisational measures.
The last principle is accountability.
Now, accountability is a new principle in the Data Protection Act so it can comply with GDPR.
In order to do this, data controllers must be able to prove that their data protection measures are sufficient.
They must have appropriate technical and organisational procedures,
which include suitable privacy policies and keeping sufficient records of their processing activities.
Another piece of legislation you have to be aware of is the Computer Misuse Act of 1990,
and this is in example of a piece of legislation which had to be created in order to keep up with technology.
This Act makes it illegal to make any unauthorised access to data
with the intent to commit further offences or with the intent to modify data - e.g., via viruses.
By bringing in this Act, there's a whole series of online activities which are now illegal.
Some examples are on the screen like the planting of viruses, hacking, data theft and fraud.
You also need to be aware of the Copyright Designs and Patents Act of 1998.
Now, this is an example of a piece of legislation which has been around for a long time
but has had to evolve in order to keep up with technology.
This Act makes it illegal to copy any work without the owner or copyright-holder's permission.
In terms of IT, this now relates to work such as a digital file, an image, a piece of software, an algorithm.
Owning the copyright doesn't stop others from copying it, but it does allow only the owner to bring action in the courts.
Here is a quick summary of the three pieces of legislation that you need to be aware of for the exam.
Whilst being asked to state specific points from the acts of parliament,
you are also likely to be given a scenario and asked to apply the Act in context.
For example, you may get an exam question as follows.
"Fred has a small farm that provides fresh produce to local customers."
"He intends to set up a new website featuring his produce and allowing customers to sign up for a weekly delivery to their home."
"What are the legal issues Fred should consider?"
Here, you'd have to contextualise your answer to the scenario,
talking about the various acts of legislation such as the Data Protection Act.
What is it that Fred has to do? What are his responsibilities?
(uplifting piano jingle)