Why Do We Need Computing Legislation?
As computing technology has advanced, existing laws have been unable to cover new types of criminal and unethical behaviour. Specific legislation has been introduced to protect individuals and organisations from the misuse of technology and to regulate how data can be collected, stored, and used.
AQA requires knowledge of four key acts: the Computer Misuse Act 1990, the Data Protection Act 2018 / UK GDPR, and the Copyright, Designs and Patents Act 1988.
Computer Misuse Act 1990 (CMA)
⚖️ Computer Misuse Act 1990
Introduced to criminalise unauthorised access to computer systems. Amended in 2006 to address new threats including malware distribution. Enforced by the police and National Crime Agency (NCA).
S.1Unauthorised access to computer material — e.g. using someone else's password to log in to their account, or guessing credentials. No malicious intent required — access alone is the offence.Up to 2 yrs / fine
S.2Unauthorised access with intent to commit further offences — e.g. accessing a bank's systems with intent to commit fraud. More serious because criminal intent is present.Up to 5 yrs / fine
S.3Unauthorised modification of computer material — e.g. deleting/encrypting files (ransomware), planting malware, altering records without permission. Includes DoS attacks.Up to 10 yrs / fine
S.3AMaking, supplying or obtaining articles for use in computer misuse offences — e.g. writing malware tools, selling exploit kits, distributing ransomware. Added in 2006 to address the growing trade in hacking tools.Up to 2 yrs / fine
Data Protection Act 2018 & UK GDPR
🛡 Data Protection Act 2018 / UK GDPR
The DPA 2018 incorporates the EU's General Data Protection Regulation (GDPR) into UK law. It replaces the old DPA 1998. Enforced by the Information Commissioner's Office (ICO), which can issue fines of up to £17.5 million or 4% of global turnover.
1Lawful, fair and transparent — must have legal basis for processing
2Purpose limitation — data collected for specific, explicit purposes only
3Data minimisation — only collect what is necessary
4Accuracy — data must be kept up to date
5Storage limitation — not kept longer than necessary
6Integrity and confidentiality — appropriate security measures
7Accountability — controller is responsible for demonstrating compliance
Rights of Data Subjects
| Right | Meaning |
|---|
| Access | Subject Access Request (SAR) — right to see what data is held about you |
| Erasure | Right to be forgotten — request deletion of your data |
| Rectification | Right to correct inaccurate or incomplete data |
| Portability | Right to receive your data in a machine-readable format to transfer to another service |
| Restriction | Right to limit how your data is used while a complaint is resolved |
| Objection | Right to object to processing for direct marketing |
Copyright, Designs and Patents Act 1988 (CDPA)
©️ Copyright, Designs and Patents Act 1988
Protects the intellectual property rights of creators of original works, including software, music, books, films, and images. Key facts:
- Copyright is automatic — no registration needed when work is created
- Lasts 70 years after the creator's death for most works
- Software copyright: the source code, object code, and related materials are protected
- Software piracy = illegally copying, distributing, or using software without a licence
- Plagiarism = presenting someone else's work as your own, even without copying code verbatim
- Exceptions: fair dealing allows limited use for education and criticism
Creative Commons — a licensing system that allows creators to specify what others can do with their work (e.g. use freely if attributed, no commercial use, share-alike). Not a separate law — a way of operating under copyright law.
Comparison of Acts
| Act | Protects | Key body | Typical penalty |
|---|
| CMA 1990 | Computer systems from unauthorised access/modification | Police / NCA | Up to 10 years custody |
| DPA 2018 / UK GDPR | Individuals' personal data | ICO | Fines up to £17.5m or 4% turnover |
| CDPA 1988 | Creators' intellectual property | Courts / Rights holders | Unlimited fine / 10 yrs custody |
Exam tip: Know all three sections (S.1, S.2, S.3) of the CMA and be able to classify scenarios. For the DPA, know at least 4 of the 7 UK GDPR principles and the key rights of data subjects. For the CDPA, know that copyright is automatic, covers software, and that piracy = illegal copying. The ICO enforces the DPA — not the police (unless it becomes a criminal matter).
⚠️ Common Mistakes
- Saying the DPA 2018 replaces GDPR — the DPA 2018 implements GDPR into UK law; they work together (the combined legislation is often called "UK GDPR").
- Confusing CMA Section 1 and Section 3 — S.1 is just accessing without permission; S.3 is modifying/damaging the system (requires higher intent / has higher penalty).
- Saying copyright must be registered — it is NOT registered in the UK; it is automatic the moment an original work is created.
- Thinking only police enforce these laws — the ICO enforces data protection and can issue massive civil fines without criminal prosecution.