← Back to subjects
0
AQA A-level Computer Science (7517) · Consequences of uses of computing
Mini-Lesson

Consequences of uses of computing

This mini-lesson covers AQA 4.8 — Consequences of uses of computing. It is worth real marks and is the section most often answered badly, because vague opinion earns nothing. Name the Act, name the stakeholder, and argue both sides.

  • Moral, ethical, legal and cultural issues — and the difference between them
  • The Computer Misuse Act 1990
  • The Data Protection Act 2018 and UK GDPR
  • The Copyright, Designs and Patents Act 1988
  • Algorithmic bias, surveillance and the digital divide
  • Automation and the future of work

Work through each screen, answer the questions as you go (some are recall, some are calculations you must actually work out) and collect ⭐ stars. Press Start when you're ready.

4.8 · Framework

Legal, moral, ethical, cultural — they are not synonyms

The examiner is testing whether you can tell these apart. Use the right word.

TypeQuestion it asksExample
LegalDoes it break a law?Accessing a system without authorisation (Computer Misuse Act)
MoralIs it right or wrong by an individual's values?Reading a partner's messages without asking
EthicalDoes it meet a professional code of conduct?A BCS member deploying a model they know is biased
CulturalHow does it change how a society lives?Social media reshaping political discourse

The key insight: legal and moral are independent. Selling users' browsing data may be perfectly legal and still be wrong. Whistleblowing may be illegal and still be right. An answer that treats "legal" and "right" as the same word cannot reach the top band.

4.8 · The law

The Computer Misuse Act 1990

Passed after hackers broke into Prince Philip's Prestel mailbox and the courts found that no existing law covered it. It creates offences of unauthorised action:

SectionOffenceMaximum sentence
1Unauthorised access to computer material2 years
2Unauthorised access with intent to commit a further offence5 years
3Unauthorised acts impairing the operation of a computer (e.g. malware, DoS)10 years
3AMaking or supplying tools to commit these offences2 years

The word that decides every case is "unauthorised". A penetration tester running the identical attack with written permission commits no offence. The technique is not the crime — the lack of authorisation is. Note also that section 1 requires no damage at all: merely looking is enough.

Calculate

Your turn — the Computer Misuse Act

1A person writes malware that takes down a hospital's booking system. This is an offence under section 3 (unauthorised acts impairing operation). What is the maximum prison sentence, in years?
years
Hint: Section 1 carries 2 years, section 2 carries 5. Section 3 is the most serious of the three listed in the table.
4.8 · The law

The Data Protection Act 2018 and UK GDPR

Governs the processing of personal data — any information from which a living individual can be identified. Its principles: data must be

  • processed lawfully, fairly and transparently;
  • collected for specified, explicit purposes (purpose limitation);
  • adequate, relevant and limited to what is necessary (data minimisation);
  • accurate and kept up to date;
  • kept no longer than necessary (storage limitation);
  • processed securely (integrity and confidentiality).

Rights of the data subject include the right to be informed, of access (a subject access request), to rectification, to erasure ("to be forgotten"), and not to be subject to purely automated decision-making with legal effects.

Enforcement: the ICO can fine up to 4% of global annual turnover or £17.5 million, whichever is higher. A personal data breach must be reported to the ICO within 72 hours.

Calculate

Your turn — GDPR penalties

2A company with a global annual turnover of £500 million commits a serious breach. Applying the 4% of global turnover ceiling, what is the maximum fine, in £ millions?
£ million
Hint: Work out 4% of 500. (The alternative ceiling is £17.5 m — the regulator applies whichever is higher.)
4.8 · The law

Copyright and investigatory powers

The Copyright, Designs and Patents Act 1988 protects original creative works — including source code, images, music, film and text — automatically, with no need to register. It is infringed by copying, distributing or adapting a work without the owner's permission.

  • Open source licences (GPL, MIT) do not abandon copyright — they use it, granting specific permissions on specific conditions.
  • Patents protect an invention, not an expression, and must be applied for.

The Regulation of Investigatory Powers Act 2000 (RIPA) governs state surveillance: interception of communications, access to communications data, and the power to demand decryption keys. It exists to make surveillance lawful and accountable — and it is the constant battleground between security and privacy.

The exam-ready argument on encryption backdoors: a backdoor that lets the state read a criminal's messages is a backdoor that exists in everyone's device — and mathematics cannot tell a police officer from a criminal. There is no such thing as a vulnerability only good people can use.

Quick check

Which Act?

?An employee copies their company's proprietary source code and uploads it to a public repository. They had legitimate access to the code. Which law is most directly breached?
4.8 · Ethics

Algorithmic bias and automated decisions

An algorithm trained on historical data learns the patterns in that history — including its injustices. This is algorithmic bias, and it is not a bug in the code. It is the data faithfully reproduced.

  • A recruitment model trained on a decade of a firm's hires learns to prefer the kind of candidate that firm historically hired.
  • A predictive-policing model trained on arrest data sends more officers where more arrests were previously made — and so generates more arrests there. The feedback loop proves itself right.
  • Facial recognition trained on unrepresentative faces has measurably higher error rates for under-represented groups.

The specific harms: the model is opaque (nobody can explain a single decision), it operates at enormous scale, and its output carries a false air of mathematical objectivity. A biased human interviewer harms dozens of people; a biased model harms millions and is believed.

The law responds: UK GDPR gives a right not to be subject to a solely automated decision with legal or similarly significant effects, and a right to meaningful information about the logic involved. The professional duty is to audit models for disparate impact before deployment, not after.

4.8 · Society

Automation, employment and the digital divide

Automation is not new — but it now reaches cognitive work: legal discovery, radiology, translation, code generation. Argue it properly, with both sides:

OpportunityRisk
Dangerous, repetitive work is removed from humansStructural unemployment — jobs vanish faster than workers can retrain
Productivity rises; goods get cheaperGains flow to capital owners, widening inequality
New categories of work are createdThe new jobs need different skills, often in different places

The digital divide is the gap between those with meaningful access to technology and those without — by income, geography (rural broadband), age and disability. As essential services move online, the divide stops being about convenience and becomes about exclusion from ordinary life: banking, benefits, GP appointments, schoolwork.

Environmental cost: data centres consume a significant and growing share of global electricity, and rapid hardware turnover produces e-waste containing lead, mercury and cadmium — frequently exported to countries with the weakest protections. Include it: it is a legitimate consequence of computing and it is a marking point.

Quick check

Algorithmic bias

?A bank's loan-approval model, trained on 20 years of past decisions, systematically rejects applicants from certain postcodes. The code contains no reference to ethnicity or postcode as a protected feature. What is the best explanation?
Quick check

Data protection

?A retailer keeps the full purchase history and home address of every customer for 25 years, long after any commercial need has passed. Which data protection principle does this most clearly breach?
Sort it

Which Act has been broken?

Tap a scenario, then tap the Act it breaches.

💻 Computer Misuse Act

🔒 Data Protection Act

©️ Copyright Act

Match it

Match the GDPR principle

Tap an item on the left, then its partner on the right.

Requirement
Principle
Recap

The big ideas to know

Four lenses: legal (law) · moral (right/wrong) · ethical (professional code) · cultural (society) — they can disagree

Computer Misuse Act 1990: s1 access (2 yrs) · s2 with intent (5) · s3 impairment (10) · s3A tools (2) — it all turns on unauthorised

Data Protection Act 2018: six principles · subject rights · ICO fines up to 4% of global turnover · 72-hour breach report

Copyright 1988: protects source code and creative works automatically; open-source licences use copyright, not abandon it

Algorithmic bias: the model learns the injustice in its training data — at scale, opaquely, and with a false air of objectivity

Society: automation and structural unemployment · digital divide → exclusion · data centres and e-waste

That is the whole of AQA 4.8. Press Finish to see your score.

🏆

Mini-lesson complete!

⭐⭐⭐

You've worked through Consequences of uses of computing for AQA A-level Computer Science (7517). 🎉

Your stars: 0 / 0

Next: test yourself in the Evaluate stage Confidence Quiz, then lock it in with Verify.

📣 Smashed it? Share your score

Challenge a mate to beat your stars, or show a parent how you got on.

→ Back to all subjects