Consequences of Computing and Legislation

Computing does not happen in a vacuum. Every technology that stores personal data, automates a job, connects a billion people or trains a model on the open web has consequences — for individuals, communities, cultures and the planet — that reach far beyond the code itself. A-Level Computer Science asks you to reason about these consequences analytically and even-handedly: to weigh benefits against harms, to recognise that most issues involve genuine trade-offs rather than a simple right and wrong, and to know the legal framework that society has built to govern computing. This lesson surveys the moral, ethical, social, cultural, legal and environmental dimensions of computing using real, current examples discussed neutrally, then sets out the four key Acts of UK law you must know — what each covers, and a scenario for each.

---

Spec Mapping

This lesson covers the consequences-of-computing area of the AQA A-Level Computer Science (7517) specification:

• The moral, ethical, social, cultural, legal and environmental issues that arise from the use of computing, analysed in a balanced, evidence-based way.
• The four key pieces of UK legislation relevant to computing:
  • Data Protection Act 2018 (and its relationship to the UK GDPR),
  • Computer Misuse Act 1990,
  • Copyright, Designs and Patents Act 1988,
  • Regulation of Investigatory Powers Act 2000.
• For each Act: the conduct it governs, and a realistic scenario showing how it applies.

This area is assessed largely through extended-response (essay) questions that reward structured argument, balance and well-supported judgement, so the emphasis here is on reasoning rather than calculation.

---

How to Reason About These Issues

Before the substance, a word on method, because it is what separates top-band answers. The examiner is not looking for opinion or outrage but for analysis and balance:

• Identify the stakeholders — who benefits, who is harmed, who bears the risk (users, companies, employees, wider society, future generations).
• Weigh costs against benefits — almost every computing development brings both; a strong answer presents the tension rather than only one side.
• Recognise trade-offs — privacy versus security, convenience versus autonomy, innovation versus regulation, efficiency versus employment. These rarely have a clean answer.
• Stay neutral in register — discuss controversial matters in calm, academic language; describe positions fairly before evaluating them.
• Support claims with concrete, current examples — grounded reasoning beats abstract assertion.

A final point on register and evidence: examiners explicitly penalise one-sided or emotive writing in this area. Phrases such as "technology is destroying society" or "AI will obviously fix everything" signal an unbalanced answer regardless of how strongly felt. The mark is earned by demonstrating that you can hold both the benefit and the harm of a development in view at once, attribute each to the right stakeholders, and only then offer a measured judgement. This is the same analytical discipline expected in any essay subject — it is simply applied to computing.

We now apply this to each of the six dimensions.

---

The Six Dimensions of Consequence

The categories overlap — a single technology often raises several at once — but it helps to consider each lens in turn.

Moral and ethical issues

Moral issues concern right and wrong conduct; ethical issues concern the principles professionals and organisations ought to follow. In computing these arise constantly:

• Algorithmic bias and fairness. Machine-learning systems trained on historical data can reproduce and amplify the biases in that data — for example, facial-recognition systems that perform less accurately on some demographic groups, or automated recruitment/credit-scoring tools that disadvantage certain applicants. The ethical question is who is accountable for an automated decision, and how fairness and transparency are ensured. There is a genuine tension between the efficiency gains of automation and the duty not to entrench discrimination.
• Autonomous systems and responsibility. Self-driving vehicles and AI medical-diagnosis tools raise the question of who is responsible when an automated system causes harm — the manufacturer, the programmer, the operator? Automated decision-making blurs traditional lines of accountability.
• Professional ethics. Bodies such as the BCS publish codes of conduct; engineers face dilemmas over whether to build systems that could be misused, how to handle discovered security flaws responsibly, and whether to prioritise deadlines over safety.

Social issues

Social issues concern the effects on how people live and interact:

• The digital divide. Access to computing and high-speed internet is uneven — by income, geography and age — so those without it are increasingly disadvantaged in education, employment and access to services as more move online. This is both a social and an equality concern.
• Employment and automation. Automation and AI displace some jobs (routine manufacturing, data entry, increasingly some "knowledge" work) while creating others (data science, AI oversight, new industries). The balanced view recognises both the disruption to existing workers and the historical pattern of new roles emerging — and the genuine question of transition: reskilling, and who bears the cost.
• Health, wellbeing and social media. Social platforms connect people and enable communities and activism, but raise documented concerns about misinformation, online harassment, addictive design and effects on mental health, especially among young people. A neutral analysis weighs connection and access to information against these harms.

Cultural issues

Cultural issues concern effects on shared values, identity and ways of life:

• Globalisation of culture. The internet spreads ideas, language and media worldwide, which can enrich cultural exchange but also raises concern about homogenisation — dominant cultures and languages crowding out local ones online.
• Changing norms. Computing reshapes cultural expectations around privacy, communication, work-life boundaries and how knowledge is shared (open-source, Wikipedia, online education). Different societies and generations adapt differently, sometimes causing friction.
• Filter bubbles and echo chambers. Personalisation algorithms can narrow the range of viewpoints individuals encounter, with cultural and democratic implications that researchers continue to debate.

Legal issues

Legal issues concern where computing meets the law — addressed by the four Acts below — covering data protection, unauthorised access, intellectual property and lawful surveillance. A recurring theme is that technology often outpaces legislation: lawmakers struggle to keep statutes current with AI, cryptocurrencies, deepfakes and cross-border data flows, so the legal framework is continually playing catch-up. The Computer Misuse Act, for instance, was passed in 1990 — before the web existed in any recognisable form — yet still has to be stretched to cover modern offences it was never written to anticipate.

A further legal complication unique to computing is jurisdiction. The internet is global, but laws are national: data about a UK citizen may be stored on a server in another country, processed by a company headquartered in a third, and accessed by an attacker in a fourth. Which country's law applies, and how it can be enforced across borders, is genuinely difficult — a UK Act cannot easily compel a foreign operator, and conduct that is illegal in one country may be lawful in another. This is why data-protection rules increasingly govern the transfer of personal data abroad, and why international cooperation is needed to prosecute cybercrime. The lesson for an analytical answer is that "there ought to be a law against it" is rarely the whole story: a law must also be enforceable against actors who may be beyond the reach of the courts that made it.

Environmental issues

Environmental issues concern computing's physical footprint, which is substantial and growing:

• Energy consumption. Data centres and networks consume a large and rising share of global electricity, and the training and running of large AI models is notably energy-intensive. Set against this, computing also enables efficiency (smart grids, optimised logistics, remote working that cuts travel) — a real two-sided picture.
• Electronic waste (e-waste). Rapid hardware turnover generates large volumes of e-waste containing toxic materials; much is exported to countries with weaker safeguards, raising environmental-justice concerns. Counterweights include recycling schemes, "right to repair" movements and more efficient hardware.
• Resource extraction. Manufacturing devices requires mining rare-earth and other materials, with environmental and ethical implications in supply chains.

Exam Tip: In an essay, do not simply list issues. Pick the most relevant, and for each present both sides and a reasoned judgement. "AI improves diagnostic speed (benefit) but its training data can embed bias, raising accountability questions (harm); on balance, deployment is justified only with auditing and human oversight (judgement)." That benefit–harm–judgement shape is what lifts an answer into the top band.

---

The Four Key Acts

UK law addresses computing through four central statutes. You must know what each covers and be able to apply it to a scenario.

Act	Year	Governs / makes an offence of	Key idea
Data Protection Act	2018	How personal data about living people is collected, stored and processed (implements the UK GDPR)	Protects individuals' personal data and privacy
Computer Misuse Act	1990	Unauthorised access to computer systems and data; hacking; malware	Makes hacking and unauthorised access criminal
Copyright, Designs and Patents Act	1988	Intellectual property — copying/distributing software, music, images, text without permission	Protects creators' rights in their work
Regulation of Investigatory Powers Act	2000	Lawful interception and surveillance of communications by public bodies	Regulates state surveillance powers

A frequent exam trap is confusing the first two: the Data Protection Act governs how organisations handle personal data they are entitled to hold, whereas the Computer Misuse Act is about gaining access you were never authorised to have. Keep "data handling" versus "unauthorised access" firmly distinct.

Data Protection Act 2018

The Data Protection Act 2018 governs the processing of personal data — information relating to an identifiable living individual — and implements the UK General Data Protection Regulation (UK GDPR) in domestic law. It sets out principles that organisations ("data controllers") must follow: personal data must be processed lawfully, fairly and transparently; collected for specified purposes and not used beyond them; adequate, relevant and limited to what is necessary (data minimisation); accurate and kept up to date; not kept longer than necessary; and kept secure. It grants individuals ("data subjects") rights, including the right to be informed, the right of access to their data, the right to rectification, the right to erasure ("right to be forgotten"), and rights around automated decision-making. The regulator is the Information Commissioner's Office (ICO), which can levy substantial fines.

Scenario. An online retailer suffers a breach because it stored customers' names, addresses and payment details in an inadequately secured database, and it had also been keeping data of customers who closed their accounts years earlier. Under the DPA 2018 the retailer has breached the security principle (failing to protect the data) and the storage-limitation principle (keeping data longer than necessary). Affected individuals may exercise their rights, and the ICO can investigate and impose a fine. (Note: the wrongdoing here is the retailer's handling of data it was entitled to collect — contrast the next Act.)

Computer Misuse Act 1990

The Computer Misuse Act 1990 criminalises unauthorised access to computer material. It defines (in broad terms) three principal offences of increasing seriousness:

1. Unauthorised access to computer material (e.g. logging into an account you have no right to access) — the basic "hacking" offence.
2. Unauthorised access with intent to commit a further offence (e.g. breaking in intending to commit fraud).
3. Unauthorised acts with intent to impair the operation of a computer or data, recklessly or otherwise — covering, for example, distributing malware, ransomware, or launching denial-of-service attacks.

The Act is what makes hacking, malware authorship and unauthorised data tampering criminal, regardless of whether financial loss results.

Scenario. An employee discovers a colleague's password and logs into the company HR system to read salary records they are not permitted to see. Even though they damaged nothing and stole nothing, simply accessing a system they were not authorised to use is an offence under section 1 of the Computer Misuse Act 1990. If they had gone on to alter records or plant malware, the more serious offences would apply. (Contrast the DPA: here the issue is access the person was never entitled to, not how authorised data was handled.)

Copyright, Designs and Patents Act 1988

The Copyright, Designs and Patents Act 1988 protects intellectual property — the rights of creators in their original work. In computing it covers software, source code, music, films, images, written content and databases: copying, distributing, adapting or publishing such work without the rights-holder's permission is an infringement. Copyright arises automatically on creation (no registration needed) and lasts for a defined period. The Act underpins software licensing (proprietary licences, and notably open-source licences, which use copyright to grant freedoms under conditions) and makes software piracy, illegal file-sharing and plagiarism of code unlawful.

Scenario. A developer copies large sections of source code from a commercial library — or a user downloads and shares copyrighted films and music — without a licence or permission. Both infringe copyright under the CDPA 1988, exposing them to civil action (and, for commercial-scale piracy, criminal penalties). Conversely, the Act is what lets an open-source author require that anyone redistributing their code keeps it open — copyright enabling sharing on the author's terms.

Regulation of Investigatory Powers Act 2000

The Regulation of Investigatory Powers Act 2000 (RIPA) regulates the powers of public bodies to carry out surveillance and the interception of communications. It sets out when and how authorities (such as the police and security services) may lawfully intercept communications, access communications data, and conduct covert surveillance, and it requires appropriate authorisation for each. Its purpose is to balance the legitimate needs of law enforcement and national security against individuals' right to privacy — and it has been the focus of ongoing public debate about the proper limits of state surveillance, illustrating directly the privacy-versus-security trade-off.