Computing legislation

The Data Protection Act 2018 and UK GDPR, the Computer Misuse Act 1990, the Copyright, Designs and Patents Act 1988 and the Regulation of Investigatory Powers Act 2000, applied to a robot's delivery log.

A14.7Software development, law and ethicsA level45 min

Do this lesson in the simulator

At GCSE you learned to name the Computer Misuse Act, the Data Protection Act and the Copyright, Designs and Patents Act, and to match each to a situation (F12.2 and F12.3). At A level you need more detail: what each law requires or forbids, the principles and rights inside data protection law, and a fourth Act, the Regulation of Investigatory Powers Act 2000. You also need to apply them to a system you are designing, because a developer is responsible for building software that lets its users obey the law.

The delivery robot keeps a log: who each parcel was for, which room, when, and a note. That log is personal data, and it is the thread through this lesson.

The Data Protection Act 2018 and UK GDPR

In the UK, personal data is governed by the UK General Data Protection Regulation (UK GDPR) together with the Data Protection Act 2018, which replaced the Data Protection Act 1998. They are enforced by the Information Commissioner's Office (ICO).

The words you need:

  • Personal data: any information relating to an identified or identifiable living person: a name, a room booking linked to a name, a photo, an IP address.
  • Data subject: the person the data is about.
  • Data controller: the organisation that decides why and how the data is processed (the school).
  • Data processor: an organisation that processes data on the controller's behalf (the company hosting the robot's cloud log).
  • Special category data: more sensitive data, such as health, ethnicity, religion, and biometric data used to identify someone, which needs extra protection.

The seven principles

Personal data must be:

Principle What it means for the delivery log
Lawfulness, fairness and transparency there is a lawful basis, and staff are told what is logged and why
Purpose limitation collected to track deliveries, not reused to monitor how often a teacher is in their room
Data minimisation only what is needed: the free-text note is not needed
Accuracy kept correct and up to date
Storage limitation kept no longer than needed: delete records after, say, 30 days
Integrity and confidentiality (security) protected against unauthorised access, loss or damage, for example by encryption and access control
Accountability the controller must be able to show it complies, with records and policies

Processing needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Consent is not the only one, and is often not the most suitable.

The rights of the data subject

Data subjects have rights, including the right to be informed; of access (a subject access request, normally answered free of charge within one month); to rectification; to erasure; to restrict processing; to data portability; to object; and rights about automated decision-making and profiling, so that important decisions about people are not made solely by a machine without safeguards (lesson A14.8).

The ICO can issue fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, for the most serious breaches, and a serious data breach must usually be reported to the ICO within 72 hours.

Designing for data protection

The law expects data protection by design and by default: privacy is built into the system, not added afterwards. Two techniques:

  • Anonymisation removes identifying details so the data can no longer be linked to a person. Truly anonymous data is no longer personal data.
  • Pseudonymisation replaces identifiers with codes, and keeps the key that links codes to people separately and securely. It reduces the risk if the log leaks, but it is still personal data, because the key can re-identify people.
# pseudonymise: names become codes, and the key is kept apart from the data
log = [("Sam Okoye", "C3"), ("Leo Brandt", "B12"), ("Sam Okoye", "C4")]
key = {}
for name, room in log:
    if name not in key:
        key[name] = "P" + str(len(key) + 1)
    print(key[name], room)
print("key, stored separately:", key)

Run this in the simulator

The Computer Misuse Act 1990

The Computer Misuse Act makes hacking and malware crimes. Its offences, as amended since 1990:

Section Offence Example
1 Unauthorised access to computer material logging in to the robot's admin page with a guessed password, just to look
2 Unauthorised access with intent to commit or facilitate a further offence getting in to the school system to change exam marks or steal card details
3 Unauthorised acts with intent to impair the operation of a computer, or reckless as to whether it does releasing malware, deleting files, a denial of service attack on the robot's server
3ZA Unauthorised acts causing, or creating a risk of, serious damage an attack on a hospital or power network
3A Making, supplying or obtaining articles for use in these offences selling a password-cracking kit to someone who will use it

The penalties rise with the section, from up to 2 years in prison for section 1, to 5 years for section 2, 10 years for section 3, and up to life for section 3ZA where the damage is to human welfare or national security. The key word throughout is unauthorised: a penetration tester with written permission commits no offence. Section 1 needs no damage and no success: knowingly trying to get in without authorisation is enough.

The Copyright, Designs and Patents Act 1988

This Act protects original work, including computer programs, which it treats as literary works. Copyright is automatic, lasts for the author's life plus 70 years, and belongs to the author, or to the employer if the work was made as part of a job.

Without the owner's permission it is an infringement to copy, distribute, adapt, rent or publish a protected work: that includes pirated software, and copying another project's code into yours. The owner can sue for infringement, and making or dealing in infringing copies as a business is a criminal offence. What you may do depends on the licence: open source licences grant rights to copy and change, proprietary licences restrict them (lesson A10.1). The Act does allow some limited uses, such as a lawful user making a necessary back-up copy of a program.

The Regulation of Investigatory Powers Act 2000

RIPA sets out when and how public bodies, such as the police, the security services and some other authorities, may carry out surveillance and investigate communications, so that these intrusions are lawful and proportionate. It covers:

  • interception of communications, such as reading emails or listening to calls, which needs a warrant;
  • access to communications data: who contacted whom, when and from where, rather than the content;
  • covert surveillance and the use of informants;
  • the power to require a person to hand over encryption keys or decrypt protected data; refusing is an offence.

It also allows communication service providers to be required to help. Much of its interception and communications data regime has since been replaced by the Investigatory Powers Act 2016, but RIPA is the Act the specifications name. The debate around it, security against privacy, is a classic ethics question.

Which law applies?

Real cases often break several laws. If a student guesses the robot's admin password and downloads the delivery log: the Computer Misuse Act section 1 (access without authorisation) and, if they meant to sell the data, section 2; the school may have broken data protection law if the password was weak, because it failed to keep personal data secure; and if they copy the robot's firmware to sell, copyright. A top answer names each law, the specific part, and why it applies.

Task: keep the log lawful

The delivery robot's log breaks two data protection principles: it keeps records for too long, and it keeps a note it does not need. Fix it, and pseudonymise the names.

records is a list of tuples (day, name, room, item, note): day is a whole number (the day of the school year the delivery was made), and the rest are strings. TODAY is today's day number, and RETENTION_DAYS is how many days a record may be kept.

  1. Go through the records in order. A record is too old if TODAY - day is more than RETENTION_DAYS: delete it (leave it out) and count it.
  2. For each kept record, pseudonymise the name: the first new name met gets the code P1, the next new name P2, and so on, stored in a dictionary key from name to code. The same name always gets the same code.
  3. Print each kept record as <day> <code> <room> <item>, leaving out the name and the note.
  4. Print deleted: <n>.
  5. Sam Okoye has made a subject access request. Using key, count the kept records that belong to Sam Okoye, and print access request for Sam Okoye: <n> records.

Compare with RETENTION_DAYS in your code, and make the codes with your dictionary. The robot stays still.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

TODAY = 40
RETENTION_DAYS = 30
records = [
    (5, "Amira Khan", "B12", "textbooks", "left at door"),
    (12, "Sam Okoye", "C3", "laptop", "signed"),
    (15, "Leo Brandt", "B12", "printer paper", "no answer"),
    (22, "Sam Okoye", "C3", "charger", "signed"),
    (31, "Amira Khan", "A1", "keys", "signed"),
    (38, "Sam Okoye", "C4", "textbooks", "signed"),
]

Challenges

  1. Is the pseudonymised log personal data? Explain your answer using the word key.
  2. A teacher asks for the robot to photograph each person who collects a parcel, "for security". Which principles must the school consider, and would a photo be special category data?
  3. A student finds the robot's admin page has no password and changes its route "as a joke". Which sections of the Computer Misuse Act could apply, and why does the missing password not make it legal?