4.8.1 - Law, ethical decisions and digital change

Legal protection and its boundaries

Law creates enforceable boundaries for computing, but deciding which rule applies requires the actual purpose, people, actions and jurisdiction.

An action can be legal yet ethically contentious. Some ethical concerns also become legal duties: fairness is part of data protection law, for example. Do not assume that legal and ethical considerations never overlap, or that an organisation's terms automatically settle either question.

Personal information

In the UK, the UK GDPR and Data Protection Act 2018 are central to data protection. The Data (Use and Access) Act 2025 amends rather than replaces them. The examples here use the rules checked on 1 October 2026; an older paper's wording does not freeze the current law. ICO legislation overview.

Organisations must identify an appropriate lawful basis before using personal information. Consent is one possible basis, not a universal requirement for every use. Other bases include contract, legal obligation and public task when their conditions apply. The correct basis depends on the purpose and circumstances. A useful service or a ticked terms box does not by itself establish one. ICO lawful-basis guidance.

The central principles connect legal protection to practical design:

These are a concise guide to the principles, not a substitute for all applicable conditions or exemptions. ICO principles guidance.

For a hypothetical events app, counting attendance may support capacity planning without storing every attendee's long-term location trail. Asking which data the purpose needs is different from asking which data the device can collect. Security helps protect the records retained, but cannot justify collecting unnecessary records. The legal analysis of a real system would also consider the relevant rights and any additional rules for the type of data and activity.

If an organisation relies on consent, it must offer real choice through freely given, specific and informed consent, using an affirmative action and allowing withdrawal. A default selection or vague bundled statement is not enough. Separately, ethical consultation may be valuable even where consent is not the legal basis. Consulting a community and obtaining legally valid individual consent are different actions. ICO consent guidance.

Access to systems

The Computer Misuse Act 1990 addresses unauthorised access and other computer misuse. Intentionally securing access while knowing it is unauthorised can be an offence even if no file is altered. Technical ability to enter is different from permission. An employee may have permission for one area of a system while knowing that another is outside their authority. Acts knowingly unauthorised and intended to impair a computer, or reckless about such impairment, are also covered. CPS Computer Misuse Act guidance.

An authorised security test must stay within the agreed scope. Finding a vulnerability or wishing to improve security does not automatically grant permission to explore another person's system. In a written scenario, identify the authority and intention supplied; do not invent facts or pronounce a real person guilty without evidence.

Copying and publication

Copyright, including the Copyright, Designs and Patents Act 1988 framework, protects original works such as software and photographs. Protection arises automatically; online availability does not mean a work is free to copy. A licence can permit specified uses, and statutory exceptions can apply. Giving the creator's name is not generally a replacement for permission or an applicable exception. GOV.UK copyright overview, using copyright material.

Open-source software still has licence conditions. A project may allow modification and redistribution subject to conditions such as attribution or the applicable licence terms. Check those terms instead of assuming that “free to download” means unrestricted reuse. Rights to copy a photograph also do not settle the privacy effects of publishing the people it depicts.

Ethical reasoning in context

A responsible decision weighs affected people's interests, evidence and alternatives rather than treating technical feasibility as sufficient justification.

The impact lesson traced monitoring, accumulating and analysing information, and worldwide publication. Ethical reasoning asks whether these capabilities should be used in a particular way. Autonomy concerns people's ability to make informed choices; fairness concerns how benefits, burdens and opportunities are distributed; responsibility concerns who should prevent, investigate and correct harm. Privacy, safety, access to information and cultural participation may conflict rather than point to one automatic answer.

A hypothetical deliberately simplifies a situation to isolate a principle. A case study examines a particular situation with more of its competing interests and evidence. Neither method justifies inventing facts. If we imagine that a mapping project improves emergency access, that is an assumption to examine, not evidence that every mapping project actually did so.

Consider this original hypothetical: a company proposes a public street-image service for a remote community. It promises easier directions and better visibility for businesses. The images may identify residents and locations connected to cultural practices. Residents differ in their preferences, connectivity and ability to make a removal request.

First distinguish the choices. Recording an image, analysing it to recognise a person and publishing it worldwide are different uses with different consequences. A service could offer directions without publishing all identifying detail. The company's commercial benefit also differs from a resident's benefit; a profitable service does not demonstrate that burdens are fairly shared.

Then develop the trade-offs. Publication could make local businesses discoverable, yet exposing a private meeting could make participants vulnerable. A practice regarded as public by outsiders may have different expectations locally. Asking only business owners may miss residents who bear the privacy risk. Consulting women, minority groups, people pictured and people without internet access can reveal effects that a single representative cannot describe for everyone. Avoid treating any community as culturally uniform or assuming that unfamiliar practices are inferior.

Compare alternatives and safeguards with their costs and limits. Reducing the photographed area might preserve useful directions while omitting sensitive sites, but make the map less complete. Obscuring identifying details might reduce exposure, but leave a location recognisable. An accessible, timely removal route helps people challenge publication, yet cannot reliably recover every copied image. A staged pilot can produce evidence before wider release, but requires time and may still expose the first participants.

Finally, justify a decision with conditions and responsibility. Approving a restricted pilot, redesigning the service, delaying it until consultation is meaningful, or rejecting an unjustifiable feature can each be defensible if the reasoning fits the evidence. Explain who can act if something goes wrong and what finding would trigger reconsideration. A promise to “be ethical” supplies neither a safeguard nor an accountable person.

Challenges facing legislators

Legislators must write rules that remain effective across changing technologies while balancing protection, legitimate use and enforceability.

Legislators make laws; regulators apply or supervise a particular regulatory framework, and courts interpret law in cases. A law's existence does not mean harmful behaviour is technically impossible. The developer still chooses the algorithm, data and deployment, the operator still chooses how to act on its outputs, and enforcement needs evidence and resources.

These are explanations, not a list of reasons to abandon regulation. A border-crossing service is not automatically outside UK law: scope can be based on users or effects as well as physical location. The challenge is establishing the applicable rule and making it work across jurisdictions, rather than simply claiming that “the internet has no laws”.

The Online Safety Act 2023 provides a current example. Ofcom states that relevant services in scope have illegal-content risk-assessment, protection, record-keeping and review duties. This is a claim about those services, not every program or every website. It illustrates a regulatory response focused on service risks and systems rather than a legislator manually reviewing every post. Ofcom illegal-content duties.

Ofcom also explains that its regulatory responsibilities take account of privacy and freedom of expression. A proposed moderation system therefore raises a real balancing problem: a broad filter may reduce harmful distribution while also removing legitimate material or misunderstanding a minority language. Appeals, context-sensitive decisions and careful measurement may help, but cost resources and can delay protection. This filter example is a reasoned hypothetical, not a claim that every service must use that exact safeguard. Ofcom online-safety overview.

Rapid technical change also makes definitions difficult. Defining a rule solely around one device or method can miss a later method causing the same harm. Conversely, a definition so broad that legitimate research or ordinary communication is caught can deter useful activity. The CPS notes that the Computer Misuse Act leaves “computer” undefined in the statute because a fixed definition could age quickly. This illustrates the choice between specific technological wording and a meaning capable of interpretation. CPS guidance.

For a developed discussion, connect the challenge to a particular information flow or decision. “Technology changes quickly” is an opening; “a new identification method can be deployed widely before a rule written for an older method is updated, leaving uncertainty about protection” explains why it matters. A balanced response can describe a useful regulatory approach and the problem it leaves unresolved without requiring a personal political opinion.