Legislation
Four key UK laws govern what you can and cannot do with computers, data, creative works and public information. This lesson covers all four, the specific offences and rights within each, and how to apply them to exam scenarios instantly.
In October 2015, a 15-year-old in Northern Ireland used a basic SQL injection attack to access TalkTalk's customer database. Within hours, the personal and financial details of 157,000 customers had been exposed. TalkTalk's share price fell by a third. The company was fined £400,000 by the Information Commissioner's Office.
Legislation questions often give you a scenario and ask you to name the relevant law, identify the specific offence or section, and explain why it applies. You need to be precise: "computer misuse" is not an answer - "Section 1 of the Computer Misuse Act 1990: unauthorised access" is.
Computer Misuse Act 1990
Passed in 1990 in response to high-profile hacking cases, the Computer Misuse Act created three main criminal offences for accessing or modifying computer systems without authorisation.
A fourth offence was added in 2006: Section 3A makes it illegal to make, supply or obtain tools for use in committing any of the above offences (for example, distributing hacking software or selling stolen login credentials).
In October 2015, TalkTalk - a major UK broadband provider - was attacked using a basic SQL injection technique that exploited unpatched vulnerabilities on their website. The attack exposed the personal data of approximately 157,000 customers, including names, addresses, dates of birth, and in some cases bank account details.
Six people were arrested and prosecuted. The youngest, a 15-year-old from Northern Ireland, pleaded guilty to offences under the Computer Misuse Act and received a 12-month youth rehabilitation order. A 20-year-old received a 12-month suspended sentence. These sentences were widely criticised as lenient given the scale of the breach.
Crucially, TalkTalk itself was also found to have breached the Data Protection Act. The Information Commissioner's Office fined TalkTalk £400,000 - at the time the maximum possible fine - for failing to implement adequate security measures, meaning they failed to protect customer data against foreseeable attacks.
In October 2023, the British Library - one of the world's largest libraries, holding over 170 million items - suffered a major ransomware attack by the Rhysida criminal group. The attackers encrypted the library's systems and demanded a ransom, then leaked approximately 600 gigabytes of stolen data online when the British Library refused to pay. The leaked data included personal details of staff and library users.
The attack knocked out the British Library's website, online catalogue, public Wi-Fi and internal systems for months. Researchers, academics and members of the public lost access to one of the world's most important research resources. The library estimated recovery costs of up to £7 million - roughly 40% of its reserves. Full restoration of services took well into 2024.
The Rhysida attackers had committed multiple offences under the Computer Misuse Act 1990: Section 1 (unauthorised access), Section 2 (access with intent to commit further offences), and Section 3A (supplying a tool for unauthorised access - the ransomware itself). The British Library also faced scrutiny over whether it had taken adequate technical security measures to protect the personal data it held, raising potential issues under the Data Protection Act 2018.
PixelCraft is a fictional independent game developer that spends two years creating and publishing a game. Within a week of release, a cracked version appears on file-sharing websites, allowing users to play the game without purchasing it. PixelCraft estimates that 200,000 copies have been downloaded illegally.
Additionally, a content creator uses footage from PixelCraft's game in a YouTube video, including the original soundtrack, without permission. The video gets 3 million views and generates advertising revenue for the creator.
Three more key laws
| Law | Main purpose | Key provisions |
|---|---|---|
| Data Protection Act 2018 | Controls how organisations collect, store and use personal data. Implements GDPR in UK law. | 6 GDPR principles (see Lesson 1), 8 individual rights (access, erasure, portability, object), requirement to register as a data controller. Maximum fine: 4% of global turnover or £17.5 million. |
| Copyright, Designs and Patents Act 1988 | Protects original creative works from being copied or used without permission. | Protects software, music, images, text, film, and databases. Copyright is automatic - no registration needed. Lasts for 70 years after the creator's death. Fair dealing exceptions exist for education, research and news reporting. |
| Freedom of Information Act 2000 | Gives the public the right to access information held by public authorities. | Any person can request information from public bodies (government, NHS, schools, police). Must respond within 20 working days. Exemptions exist for national security, personal data, commercial sensitivity and ongoing investigations. |
Software licensing types
The Copyright Designs and Patents Act makes it illegal to copy or distribute software without appropriate authorisation. Software is distributed under licences that define what users may and may not do.
| Type | Cost | Source code | Modify? | Redistribute? |
|---|---|---|---|---|
| Proprietary (e.g. Windows, MS Office) | Paid | Closed | No | No |
| Open source (e.g. Linux, Firefox, LibreOffice) | Free | Open | Yes | Yes (under licence conditions) |
| Freeware (e.g. Skype, VLC) | Free | Closed | No | Often limited |
| Shareware (e.g. WinRAR trial) | Free trial, then paid | Closed | No | Often permitted for distribution of trial |
The Computer Misuse Act 1990 was written before widespread internet use, smartphones, or cloud computing existed. A student argues that "just looking at files" on a system they are not authorised to use should not be a criminal offence - only actions that cause damage should be criminalised. Do you agree?
Law matcher - which act applies?
Lesson 2 Worksheets
Three differentiated worksheets covering legislation recall, application and exam technique.