Content Area 4: Legislation and Regulatory Requirements

Rate each point. Be honest: 'Secure' means you could answer an exam question on it now without notes.

Health and Safety at Work Act 1974: key points

Employees also have duties: take reasonable care of themselves and others, cooperate with the employer, and not misuse anything provided for safety.

Display screen equipment (DSE): implications for employers

The Health and Safety (Display Screen Equipment) Regulations 1992 apply to workers who use screens daily for an hour or more at a time. This includes most software developers.

Health and Safety at Work Act 1974

Main UK law setting out the duties of employers and employees to keep the workplace safe.

Display screen equipment (DSE)

Devices with a screen: monitors, laptops, tablets, smartphones used for work.

DSE workstation assessment

A check of a user's desk, chair, screen, keyboard and working habits to reduce health risks.

The spec groups mitigation into three areas: adequate training (staff know how to set up and use equipment safely), a safe working environment (furniture, lighting, electrics), and safe working practices (breaks, reporting faults, keeping walkways clear).

Musculoskeletal disorder

Injury or pain in muscles, joints or tendons, e.g. back pain or repetitive strain injury (RSI).

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 control how organisations collect, use and store personal data. They are enforced by the Information Commissioner's Office (ICO).

Purpose of the legislation

• Protect individuals' personal data and privacy.
• Give individuals rights over their data (to see it, correct it, have it deleted, object to its use).
• Make organisations responsible and accountable for how they handle personal data.
• Build trust so people are willing to use digital services.

The eight principles

Practise: which principle is being broken?

Effect on organisations and individuals

Personal data

Any information that can identify a living person, directly or indirectly.

Data subject

The living person the personal data is about.

Data controller

The organisation that decides why and how personal data is processed.

Data processor

An organisation that processes personal data on behalf of a controller, e.g. a cloud payroll provider.

Information Commissioner's Office (ICO)

The UK regulator for data protection. It can investigate, issue fines and enforce compliance.

Subject access request (SAR)

A request from an individual to see the personal data an organisation holds about them.

The Computer Misuse Act (CMA) makes it a criminal offence to access or interfere with computer systems without permission.

Practise: which section?

Consequences for company and employee

Employee awareness

• Staff should know that accessing data or systems they are not authorised to use is a crime, even out of curiosity and even if they work there.
• Organisations raise awareness through training, the acceptable use policy, login banners ('Unauthorised access is an offence under the Computer Misuse Act 1990'), and access controls that only give staff the permissions they need.
• Penetration testers must have written permission defining exactly what they may test; without it, the same actions are CMA offences.

Computer Misuse Act 1990

UK law that makes unauthorised access to and interference with computer systems a criminal offence.

The Equality Act 2010 protects people from discrimination in employment, education and when using services.

The nine protected characteristics

1. Age
2. Disability
3. Gender reassignment
4. Marriage and civil partnership
5. Pregnancy and maternity
6. Race
7. Religion or belief
8. Sex
9. Sexual orientation

Revision tip: group them to remember all nine: the body (age, disability, sex, pregnancy and maternity), identity (gender reassignment, sexual orientation, race), beliefs (religion or belief) and relationships (marriage and civil partnership).

Types of discrimination

Practise: which type of discrimination?

Where individuals are protected

• At work: recruitment, pay, terms and conditions, promotion, training, dismissal.
• In education: schools, colleges, universities.
• When using services: shops, banks, websites and apps, public services, transport.
• Public bodies must also consider equality when making decisions (Public Sector Equality Duty).
• Employers and service providers must make reasonable adjustments for disabled people, e.g. screen reader software, accessible websites.

When to take action: time limits

Protected characteristic

One of nine characteristics protected from discrimination under the Equality Act 2010.

Direct discrimination

Treating someone less favourably because of a protected characteristic.

Indirect discrimination

A rule or practice that applies to everyone but puts people with a protected characteristic at a particular disadvantage, without good justification.

Harassment

Unwanted behaviour related to a protected characteristic that violates someone's dignity or creates a hostile environment.

Victimisation

Treating someone badly because they made or supported a discrimination complaint.

Intellectual property law lets creators own and control their creations, so others cannot copy them for profit. The spec names three types:

• In the UK, software code on its own is generally not patentable ('as such'); it is protected by copyright, which is automatic. A software-based invention can sometimes be patented if it makes a technical contribution.
• Work created by an employee as part of their job usually belongs to the employer. Side projects can be disputed if they use company time, equipment or knowledge, so check your contract.
• Registration makes it much easier to prove ownership and take action against copying.

Intellectual property (IP)

Creations of the mind, such as inventions, designs and creative works, that can be legally owned.

Unregistered design right

Automatic protection for the shape or configuration of a product, without applying.

Registered design

A design registered with the Intellectual Property Office, protecting its appearance for up to 25 years.

Patent

Legal protection for a new invention that gives the owner the right to stop others making, using or selling it, for up to 20 years.

The internet crosses borders: an attacker in one country can target a business in another, and data is stored in data centres worldwide. Some offences are covered by international law.

International law in cyberspace

• The Budapest Convention on Cybercrime (Council of Europe) is an international treaty, signed by the UK and many other countries, to harmonise cybercrime laws and help countries cooperate on investigations and extradition.
• Existing international law, including the UN Charter, applies to how states behave in cyberspace, e.g. state-sponsored attacks on another country's infrastructure.
• Problems: not every country has signed; attackers operate from countries that will not extradite; evidence is hard to gather across borders.
• UK CMA offences can be prosecuted where there is a 'significant link' to the UK, e.g. the victim's computer is in the UK.

International law and surveillance

• Article 8 of the European Convention on Human Rights (part of UK law through the Human Rights Act 1998) gives a right to respect for private life and correspondence.
• Government surveillance must be lawful, necessary and proportionate. In the UK this is governed by the Investigatory Powers Act 2016.
• Courts have ruled against bulk surveillance programmes that lacked adequate safeguards.
• Data transfers between countries depend on whether the destination protects personal data adequately, including from state surveillance (link to principle 8 of data protection).

4.1.7 Making judgements about digital legislation

You may be asked to judge how legislation affects organisations, society and individuals. Consider both sides:

Budapest Convention

The Council of Europe Convention on Cybercrime: an international treaty to harmonise cybercrime laws and help countries cooperate.

4.2.2 How codes of conduct influence professional behaviour

Code of conduct

A set of rules and expected behaviours for members of an organisation or profession.

Practise: which body?

Industry standard

An agreed specification or set of best practices that products, processes or services should meet.

An acceptable use policy (AUP) is a document that sets out how employees, students or customers may use an organisation's IT systems. Users usually have to agree to it before getting an account.

Purpose of an AUP

• Protect the organisation's systems and data from misuse and security threats.
• Make expectations clear so staff know what is and is not allowed.
• Protect the organisation legally: it can show it took reasonable steps and can discipline staff who break the rules.
• Protect the organisation's reputation.

Typical content

4.2.5 Whistleblowing

Whistleblowing is reporting wrongdoing in an organisation: crime, danger to health and safety, environmental damage, breaking the law, or covering any of these up. In a digital context this could be a company knowingly hiding a data breach or releasing unsafe software.

• The Public Interest Disclosure Act 1998 protects workers from dismissal or unfair treatment for whistleblowing in the public interest.
• A whistleblowing procedure tells staff how to raise concerns safely and confidentially (who to report to, including outside bodies such as the ICO).
• Importance: wrongdoing is found and stopped early; protects the public; protects staff from retaliation; organisations can fix problems before they become scandals.

4.2.6 Making judgements about guidelines

Guidelines (codes, standards, AUPs) are not laws, but they shape behaviour. Benefits: consistent, high-quality, trustworthy work and fewer incidents. Drawbacks: cost and time to implement and audit, can feel restrictive, and only work if staff are trained and they are enforced.

Acceptable use policy (AUP)

A document setting out how employees or users may and may not use an organisation's IT systems.

Whistleblowing

Reporting wrongdoing within an organisation, such as illegal activity or danger to the public.

Flashcards

Every Quick recall definition on this page. Click the card to flip it; use the arrow keys to move.

Random questions on CA4 from the course question bank. Pick a topic or question type, answer in your head or on paper, then check. Your score is saved on this device.

Allow about 85 minutes.

My corrections: what I need to go back over