The answersDownload the PDF
Worksheet

A14.7 Computing legislation

Software development, law and ethics · A level · OCR H446 1.5.1, AQA 7517 4.8.1 · about 45 min

BugBotLab
NameClassDate

What this lesson is about

The Data Protection Act 2018 and UK GDPR, the Computer Misuse Act 1990, the Copyright, Designs and Patents Act 1988 and the Regulation of Investigatory Powers Act 2000, applied to a robot's delivery log.

Questions 6 marks in all

  1. [1 mark]A student guesses a teacher's password and reads their emails, without changing anything. Which offence have they committed?

    1. AUnauthorised access to computer material, under the Computer Misuse Act 1990
    2. BNo offence, because nothing was damaged
    3. CBreach of copyright under the Copyright, Designs and Patents Act 1988
    4. DAn offence under the Regulation of Investigatory Powers Act 2000

  2. [1 mark]A delivery log keeps records for three years though they are only needed for a month. Which data protection principle does this break?

    1. AStorage limitation
    2. BAccuracy
    3. CPurpose limitation
    4. DLawfulness, fairness and transparency

  3. [1 mark]Which Act sets out when public bodies may intercept communications and require a person to hand over encryption keys?

    1. AThe Regulation of Investigatory Powers Act 2000
    2. BThe Computer Misuse Act 1990
    3. CThe Copyright, Designs and Patents Act 1988
    4. DThe Data Protection Act 2018

  4. [1 mark]A log replaces names with codes, and the key linking codes to names is stored separately. Is it still personal data?

    1. AYes: it is pseudonymised, and the key can re-identify people
    2. BNo: it has no names in it
    3. CNo: codes are never personal data
    4. DOnly if it is stored in the cloud

  5. [1 mark]Which of these are rights of a data subject under UK GDPR?

    Tick every answer that is true.

    1. AThe right of access
    2. BThe right to erasure
    3. CThe right to rectification
    4. DThe right to see anyone else's data
    5. EThe right to free software

  6. [1 mark]Under the Copyright, Designs and Patents Act 1988, when does a program you write become protected by copyright?

    1. AAutomatically, as soon as it is written
    2. BOnly after it is registered with a government office
    3. COnly if it is sold
    4. DOnly if it has a licence file

The task: keep the log lawful

The delivery robot's log breaks two data protection principles: it keeps records for too long, and it keeps a note it does not need. Fix it, and pseudonymise the names. records is a list of tuples (day, name, room, item, note): day is a whole number (the day of the school year the delivery was made), and the rest are strings. TODAY is today's day number, and RETENTION_DAYS is how many days a record may be kept. 1. Go through the records in order. A record is too old if TODAY - day is more than RETENTION_DAYS: delete it (leave it out) and count it. 2. For each kept record, pseudonymise the name: the first new name met gets the code P1, the next new name P2, and so on, stored in a dictionary key from name to code. The same name always gets the same code. 3. Print each kept record as <day> <code> <room> <item>, leaving out the name and the note. 4. Print deleted: <n>. 5. Sam Okoye has made a subject access request. Using key, count the kept records that belong to Sam Okoye, and print access request for Sam Okoye: <n> records. Compare with RETENTION_DAYS in your code, and make the codes with your dictionary. The robot stays still.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

TODAY = 40
RETENTION_DAYS = 30
records = [
    (5, "Amira Khan", "B12", "textbooks", "left at door"),
    (12, "Sam Okoye", "C3", "laptop", "signed"),
    (15, "Leo Brandt", "B12", "printer paper", "no answer"),
    (22, "Sam Okoye", "C3", "charger", "signed"),
    (31, "Amira Khan", "A1", "keys", "signed"),
    (38, "Sam Okoye", "C4", "textbooks", "signed"),
]

Plan your program here, then type it in and press Run.

QR code
Do it on the robot
www.bugbotlab.com/learn/a14-7-computing-legislation/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

  1. Is the pseudonymised log personal data? Explain your answer using the word key.
  2. A teacher asks for the robot to photograph each person who collects a parcel, "for security". Which principles must the school consider, and would a photo be special category data?
  3. A student finds the robot's admin page has no password and changes its route "as a joke". Which sections of the Computer Misuse Act could apply, and why does the missing password not make it legal?