Why Privacy Matters
Privacy is the right of individuals to control information about themselves. Computing makes vast amounts of personal data easy to collect, share, and misuse. Privacy concerns include:
- Data collected without the individual's knowledge
- Data shared with third parties without consent
- Data used for purposes beyond what the individual agreed to
- Security breaches exposing sensitive personal information
Data Protection Principles
Data protection laws (such as the UK's Data Protection Act and the EU's GDPR) are built on a set of core principles. Organisations that handle personal data must:
| Principle | What it means |
|---|
| Lawful, fair, transparent | Data must be processed lawfully, and individuals must be told how it's used |
| Purpose limitation | Data must only be collected for specified, explicit, and legitimate purposes |
| Data minimisation | Only collect the minimum data needed — no more |
| Accuracy | Data must be kept accurate and up to date |
| Storage limitation | Data must not be kept longer than necessary |
| Integrity and confidentiality | Data must be stored securely to prevent unauthorised access or loss |
| Accountability | Organisations must demonstrate compliance with these principles |
Individual Rights Under Data Protection Law
- Right of access — individuals can request copies of their own personal data (Subject Access Request)
- Right to rectification — individuals can have inaccurate data corrected
- Right to erasure — individuals can request that their data be deleted ("right to be forgotten")
- Right to data portability — individuals can request their data in a machine-readable format
- Right to object — individuals can object to processing of their data for certain purposes (e.g., marketing)
Freedom of Information
The Freedom of Information Act gives the public the right to access information held by public authorities (governments, councils, public bodies). This promotes transparency and accountability in government.
- Requests must typically be responded to within 20 working days
- Some information is exempt (e.g., national security, personal data of individuals)
Surveillance and Monitoring
Governments and employers may use technology to monitor individuals. This raises tension between:
- Security — surveillance can prevent crime and terrorism
- Privacy — excessive surveillance infringes on individual rights
Examples: CCTV networks, monitoring employee emails and internet use, facial recognition systems.
Exam tip: Data protection questions often ask you to "state a principle" or "explain a right". Learn the 7 GDPR principles and the 5 key individual rights. For 4-6 mark questions, give the principle/right and then explain what it means in practice with an example.
⚠️ Common Mistakes
- Confusing the Freedom of Information Act (about public authority data) with data protection law (about personal data)
- Saying data must be deleted after a specific number of years — the law says data should not be kept "longer than necessary" (this depends on the purpose)