Moral, Ethical and Legal Issues
Why Ethics and Law Matter in IT
Technology has transformed how we live, work and communicate — but it has also created new ways for individuals and organisations to cause harm, whether intentionally or accidentally. Ethics in IT means thinking carefully about the impact our choices have on other people, from sharing someone's photo without asking to building a system that stores private health records. Laws exist to enforce the most serious of these expectations, but our personal sense of right and wrong — our moral compass — matters just as much.
This lesson examines the key moral and ethical issues raised by modern IT, and then looks at the specific laws that protect computer users in the United Kingdom. Knowing these laws by name and date is essential — name them correctly.
Moral and Ethical Issues
Privacy and Security
Privacy is one of the most contested issues in the digital age. Every time you use a website, app or search engine, data about you can be collected, stored and analysed. Some of this is harmless — a streaming service remembering your viewing history — but the same technology can be used to build detailed profiles of individuals without their knowledge or meaningful consent. The moral question is whether organisations have the right to gather and profit from this data, even when users technically agreed to lengthy terms and conditions that most people never read.
Security goes hand in hand with privacy. When companies collect large volumes of personal data, they take on a responsibility to protect it. Poor security practices — weak passwords, unencrypted databases, unpatched software — can lead to breaches that expose millions of people to identity theft, fraud and harassment.
Cookies are small text files stored on your device by websites. Multinational companies use them to track browsing behaviour across many sites, building detailed profiles of your interests, habits and purchasing patterns — often without users fully realising it.
Cookies and Data Collection by Multinational Companies
Large technology companies such as search engines and social media platforms generate enormous revenue by selling advertising based on user data. Cookies allow these companies to follow users across the web, recording which pages they visit, how long they stay and what they purchase. The ethical concern is that this tracking is often opaque — users consent to a broad privacy policy without understanding that their data may be sold to third parties, used to influence their political views or shared with government agencies.
The scale of data collection by multinational companies is staggering. A single large platform may hold data on billions of individuals. This creates a power imbalance: ordinary users have little control over how their information is used, while corporations and advertisers benefit commercially.
Monitoring of Individuals
Individuals can be monitored in many ways — employers checking staff emails, governments intercepting private communications, or apps tracking a phone's GPS location. Some monitoring is legitimate: parents using parental controls to protect young children, or employers monitoring company devices to prevent data leaks. However, covert or excessive monitoring raises serious ethical questions about trust, autonomy and human rights. The line between reasonable oversight and invasive surveillance is often unclear, and different people will draw it in different places.
Something can be legal yet still ethically questionable. An employer might have the legal right to read staff emails on company devices, but if employees are not told this is happening, many would consider it a breach of trust. Ethics is about what we ought to do, not just what we are allowed to do. Monitoring without transparency undermines personal dignity and can damage relationships between institutions and the individuals they serve.
Impact of Data Loss or Damage
When data is lost, corrupted or stolen, the consequences can be severe. At a personal level, someone whose bank details are exposed in a breach may face fraud, financial loss and months of stress resolving the problem. At an organisational level, a hospital losing patient records could delay treatment and put lives at risk. For businesses, a major breach can destroy customer trust overnight and result in large regulatory fines. Morally, this means everyone involved in storing or handling data — from software developers to system administrators — carries a responsibility to treat that data with care.
Data loss or damage can affect individuals through identity theft and financial harm, and organisations through regulatory fines, reputational damage and loss of customer trust. Under UK GDPR, a personal data breach likely to risk people's rights and freedoms must be reported to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours.
Laws That Protect Computer Users
The United Kingdom has a range of laws designed to protect individuals and ensure technology is used responsibly. You need to know the full name and year of each one.
General Data Protection Regulation (GDPR) 2018
The General Data Protection Regulation (GDPR), which came into force in 2018, is the main law governing how personal data must be handled. It gives individuals the right to access data held about them, correct inaccurate data and request deletion (the "right to be forgotten"). Organisations must have a clear lawful basis for processing personal data — for example, consent, a contractual obligation or a legitimate interest. GDPR applies to any organisation that processes the data of UK or EU citizens, regardless of where the organisation is based.
Data Protection Act (DPA) 1998
Before GDPR, the Data Protection Act 2018 was the primary data-protection law in the UK. It set out eight principles governing the use of personal data, including that data must be processed fairly and lawfully, held for specified purposes only, kept accurate and up to date, not retained longer than necessary, and kept secure. When GDPR was adopted in 2018, the Data Protection Act was updated (the Data Protection Act 2018 incorporated GDPR into UK law), but examination questions sometimes refer to the original 1998 Act, so you should be familiar with both.
Computer Misuse Act 1990
The Computer Misuse Act 1990 criminalises three main offences: unauthorised access to computer material (for example, guessing someone's password to read their emails), unauthorised access with intent to commit further offences (such as breaking into a company's server to steal financial data), and unauthorised modification of computer material (including installing malware or deleting files). This law is the primary weapon against hacking, ransomware attacks and other forms of cybercrime in the UK.
The three offences are: (1) unauthorised access to computer material — simply logging into a system without permission; (2) unauthorised access with intent to commit or facilitate further offences — breaking in with the aim of committing fraud or theft; (3) unauthorised modification of computer material — deliberately altering, deleting or corrupting data or programs, which includes deploying viruses or ransomware.
Communications Act 2003
The Communications Act 2003 covers the misuse of electronic communications networks. It makes it an offence to send grossly offensive, indecent, obscene or menacing messages using a public electronic communications network, which includes social media, messaging apps and email. This law is frequently used in cases involving cyberbullying, threatening messages and online harassment.
Regulation of Investigatory Powers Act 2000 (RIPA)
The Regulation of Investigatory Powers Act 2000 governs how government agencies and law enforcement may lawfully intercept and monitor communications. It sets out strict rules about when surveillance, covert investigation and the interception of private messages are permitted, requiring appropriate authorisation. While it enables legitimate national security activity, it also acts as a safeguard against state overreach — agencies must follow defined processes rather than conducting unlimited surveillance.
Copyright, Designs and Patents Act 1988
The Copyright, Designs and Patents Act 1988 protects intellectual property, including software, music, images and written content. Copying, distributing or reproducing protected material without permission may infringe copyright, though limited legal exceptions can apply. In an IT context, downloading pirated software, sharing copyrighted music files or reproducing images from the internet without a licence may infringe copyright. Creators are automatically protected as soon as they produce original work — they do not need to register a copyright.
Health and Safety Legislation
Health and safety law applies to the physical use of computer equipment in the workplace. The Health and Safety (Display Screen Equipment) Regulations 1992 require employers to assess and reduce risks from the prolonged use of screens and keyboards. This includes providing adjustable chairs, adequate lighting, regular breaks and eye tests. Failure to follow these regulations can lead to conditions such as repetitive strain injury (RSI), eye strain and musculoskeletal problems. Employers have a legal duty to make workstations safe.