1.5.2 Legislation — OCR J277

🔒

Unlock Everything

£7.99/month

or £59/year

Subscribe now →

UK Legislation for Computing

OCR J277 requires knowledge of three key pieces of UK legislation that govern how computers and data are used:

Computer Misuse Act 1990

Passed to address hacking and unauthorised access to computer systems. Creates three criminal offences:

Section	Offence	Max sentence
Section 1	Unauthorised access to computer material (hacking)	12 months / fine
Section 2	Unauthorised access with intent to commit further offences (e.g. accessing a system to steal bank details)	5 years
Section 3	Unauthorised modification of computer material (e.g. deploying malware, deleting files, launching DoS attacks)	10 years

Examples covered: installing a virus, accessing someone else's email account without permission, launching a DDoS attack, SQL injection to steal data, installing a keylogger.

Data Protection Act / UK GDPR 2018 / ongoing

The Data Protection Act 2018 implements the EU's GDPR into UK law. It governs how personal data (any data that can identify an individual) must be handled. The law is enforced by the Information Commissioner's Office (ICO).

The 7 Data Protection Principles:

Principle	Meaning
1. Lawfulness, fairness & transparency	Data must be collected lawfully with the individual's knowledge
2. Purpose limitation	Only collected for specified, explicit, and legitimate purposes
3. Data minimisation	Only collect what is necessary — no more
4. Accuracy	Data must be kept accurate and up to date
5. Storage limitation	Not kept longer than necessary
6. Integrity & confidentiality	Processed securely — protected from unauthorised access
7. Accountability	The organisation is responsible for compliance

Individual rights under GDPR: Right to access (Subject Access Request), right to be forgotten (erasure), right to correct inaccurate data, right to portability (receive your data in a reusable format).

Key terms: Data subject = the individual the data is about. Data controller = the organisation deciding how data is used. Data processor = processes data on behalf of a controller. Breaches must be reported to the ICO within 72 hours.

Protects the intellectual property of creators. In computing, this covers software, websites, digital images, music, and films. Copyright is automatic — creators do not need to register it.

Aspect	Detail
What's protected	Software source code, digital music, films, images, written content, databases
Duration	Author's life + 70 years (for literary/artistic works)
Infringement	Copying/distributing software without a licence, pirating films/music, using images without permission
Penalties	Civil damages (compensation) and criminal prosecution (up to 10 years)
Licences	Proprietary: must pay; Open source: free but conditions apply; Creative Commons: various permissions granted

Freedom of Information Act 2000

Gives individuals the right to access information held by public authorities (government bodies, NHS, councils, police). Organisations must respond within 20 working days. Certain information is exempt (e.g. national security).

Comparison of Acts

Act	Main purpose	Who it protects	Enforced by
Computer Misuse Act 1990	Criminalise unauthorised computer access & modification	Computer system owners, data holders	Police, Crown Prosecution Service
Data Protection Act / UK GDPR 2018	Regulate personal data handling	Individuals (data subjects)	ICO (Information Commissioner's Office)
Copyright Act 1988	Protect intellectual property	Creators, developers, authors	Civil courts, Trading Standards
Freedom of Information Act 2000	Transparency of public bodies	General public	ICO

Exam tip: Know all three offences in the Computer Misuse Act and their sentences. For DPA/GDPR: memorise the 7 principles and key rights. For the Copyright Act: know what is protected and what constitutes infringement. Questions often give a scenario and ask you to name the relevant act and explain which part applies — always justify your answer.

⚠️ Common Mistakes

Saying "the Data Protection Act was passed in 2018" — the original DPA was 1998; the 2018 Act updated it to comply with GDPR
Confusing Computer Misuse Act sections: Section 1 = access only; Section 2 = access + intent; Section 3 = modification/damage
Saying copyright must be registered — it is automatic from the moment of creation
Confusing data controller and data processor — controller decides how data is used; processor acts on instructions
Forgetting the ICO — it is the enforcement body for DPA/GDPR, not the police

✅ Notes completed!

▶

Video coming soon

Click slide or press arrow keys to navigate

Worksheet — 1.5.2 Legislation

8 questions · 25 marks

Q1Name the three offences created by the Computer Misuse Act 1990 and give the maximum sentence for each.[6]

✅ Mark scheme

Section 1: Unauthorised access to computer material [1] — 12 months / fine [1]; Section 2: Unauthorised access with intent to commit further offences [1] — 5 years [1]; Section 3: Unauthorised modification of computer material [1] — 10 years [1].

Q2A student uses a school computer to log into another student's email account without permission. Which section of the Computer Misuse Act applies? Justify your answer.[2]

✅ Mark scheme

Section 1 [1] — unauthorised access to computer material (assuming no further criminal intent is stated) [1]. If intent to use the access for another crime (e.g. fraud) is present, Section 2 would apply.

Q3State four of the seven Data Protection Act principles.[4]

✅ Mark scheme

Any four: Lawfulness/fairness/transparency; Purpose limitation; Data minimisation; Accuracy; Storage limitation; Integrity and confidentiality; Accountability. [1] each.

Q4What is the difference between a data controller and a data processor?[2]

✅ Mark scheme

Data controller: the organisation/person who determines the purposes and means of processing personal data [1]; Data processor: processes personal data on behalf of, and under the instructions of, the data controller [1].

Q5What does the Copyright, Designs and Patents Act 1988 protect? Give two examples in a computing context.[3]

✅ Mark scheme

Protects intellectual property — the creative work of authors and developers [1]; computing examples: software source code [1]; digital music/films [1]; website design and content [1]; databases [1]. Two needed.

Q6A company collects customer email addresses to send newsletters, then sells them to a third-party marketing firm. Which law are they breaking and why?[3]

✅ Mark scheme

Data Protection Act / GDPR [1]; the purpose limitation principle — data collected for one purpose (newsletters) cannot be used for another purpose (marketing by a third party) without consent [1]; also violates lawfulness/fairness as customers didn't agree to data sharing [1].

Q7Is copyright automatic or must it be registered? How long does copyright last?[2]

✅ Mark scheme

Q8A hacker installs ransomware on a hospital's computer system, encrypting all patient files and demanding payment. Which section of the Computer Misuse Act have they broken and why?[3]

✅ Mark scheme

Section 3 [1] — unauthorised modification of computer material [1]; the ransomware has encrypted (modified) the files without authorisation, preventing legitimate access to the data [1]. Section 1 also applies (gaining access), and Section 2 may apply (access with intent to commit blackmail).

out of 25 — self-mark above

Topic Quiz

Question 1 of 15

You scored

out of 15

Card 1 of 15

Click to reveal definition

🎉

Complete!

Term	Definition

UK Legislation for Computing

Freedom of Information Act 2000

Comparison of Acts

Worksheet — 1.5.2 Legislation

Mini Test — 1.5.2 Legislation