Know the Law

Three Acts, by name and year

This specification names three pieces of legislation, and it wants them **precisely: the full name and the year**. "That computer law from the nineties" earns nothing. - **The Data Protection Act 2018** - **The Computer Misuse Act 1990** - **The Copyright, Designs and Patents Act 1988** **Each one protects something different, and that is how you choose between them.** Ask what was harmed: - A **system** was accessed without permission → Computer Misuse Act - **Someone's information** was mishandled → Data Protection Act - **Work somebody created** was copied without permission → Copyright, Designs and Patents Act Learn the question, not just the three definitions. The exam gives you situations, not labels.

What each Act covers

The three Acts, and the one you are least likely to think of.

Match each situation to its Act

Which law has been broken?

An employee is allowed to use the customer database for their job. Out of curiosity, they look up a neighbour's record and read it. Which Act is most clearly engaged, and why?

• The Data Protection Act 2018, because personal data was used for a purpose it was not collected for, which breaches how the organisation is required to handle it
• The Computer Misuse Act 1990, because they accessed a computer
• The Copyright, Designs and Patents Act 1988, because they read something they did not create
• None; they had a valid login

Authorisation is the whole test

The Computer Misuse Act catches people out because students expect a law about computers to be about damage. It is not. **The offence is accessing a system you were not permitted to access.** Whether you changed anything, stole anything or caused any harm is a separate question that affects how serious it is, not whether it happened. **The Act sets out three offences, in rising order of seriousness:** 1. **Unauthorised access** to computer material - the basic offence 2. **Unauthorised access with intent** to commit a further offence, such as fraud 3. **Unauthorised acts intended to impair** the operation of a computer, which covers malware and attacks designed to bring a service down So a student who logs into a teacher's account, reads a page and logs out again has committed the first offence. **Nothing was broken, and it is still a crime.**

The three offences

Select the TWO accurate statements about the Computer Misuse Act 1990.

• Accessing a system without permission is an offence even if nothing is altered, taken or damaged
• Deliberately impairing a computer's operation, such as by releasing malware, is a separate and more serious offence
• An offence is only committed if the system suffers measurable damage
• It governs how organisations must store customers' personal data

Duties and rights

The Data Protection Act works in two directions at once, and a full answer mentions both.

The law in a paragraph

Unauthorised access to a computer system is an offence under the _____ Act _____. How organisations collect, store and use personal data is governed by the _____ Act _____. Copying or distributing someone else's original work without permission breaches the Copyright, Designs and Patents Act _____. Under the first of these, an offence is committed even where _____ has been caused.

Order the offences by seriousness

Put these Computer Misuse Act offences in order, from the least serious to the most.

• Gaining access to a system without permission, and doing nothing further
• Gaining access without permission in order to commit a further offence, such as fraud
• Carrying out an unauthorised act intended to impair how a computer operates, such as releasing malware

Spot the breaches

A description of how a small company handles its records. Tap the TWO practices that breach the Data Protection Act.

• Customer records are collected at the point of sale and staff are trained on how to handle them.
• Records of customers who have not ordered anything for fifteen years are still held, because nobody has deleted them
• . Access is limited to staff who need it, and the office computers are password protected.
• The customer list is sold to a marketing firm, although customers were told it was only for processing their orders
• . Backups are encrypted and stored securely off site.

When does copyright begin? ©️

A student writes an original program for a project. When does copyright in that code exist, and what does it give them?

• Automatically, as soon as the code is created. It gives them the right to control whether others copy, distribute or adapt it, which is what makes a licence meaningful
• Only once they register it with a government office
• Only once the code is published or sold
• Only if they add a copyright symbol to the file

Naming the right Act

**"A former employee still has a working login. They use it to download the customer database and pass it to a competitor. Identify the legislation involved and explain how it applies. (6 marks)"** "Two Acts are engaged, and they cover different parts of what happened. **The Computer Misuse Act 1990** applies to the access itself. The person no longer works for the company, so their permission to use the system has ended regardless of whether the login still functions. That is unauthorised access to computer material, and downloading the database in order to pass it on is access with intent to commit a further offence. **The Data Protection Act 2018** applies to what was taken. The database holds personal data, and passing it to a competitor uses it for a purpose the customers never agreed to and were never told about. The company also has a duty to keep that data secure, and leaving a former employee's login active is a failure of that duty. So the individual is liable under the Computer Misuse Act, and both the individual and the company have a Data Protection issue - the company for the account it left open." **Three things that answer does.** It names each Act **in full with its year**. It says which **part** of the situation each Act covers, rather than listing both and hoping. And it notices that the **company** is also at fault, not only the individual - which is the point that separates a good answer from a complete one.

An incident at school

A student is found to have logged into the school network using a teacher's account. Work through what has happened legally.

• The student says they changed nothing and only looked at one page. Does that matter?
• The page they viewed listed other students' home addresses. What does that add?
• The student also copied a licensed piece of school software onto their own laptop. Which Act covers that?

Your turn: apply the law

A company discovers that an employee has been selling customer email addresses to advertisers, using a colleague's login to reach the records. Explain the legislation involved.

• Name each Act involved in full, with its year
• For each one, say which part of the situation it covers and why
• Explain whether an offence under the Computer Misuse Act depends on damage being caused
• Identify one thing the company itself may have got wrong, not just the employee