OCR Legislation: Historical and Current Context

The Data Protection Act 1998 named in OCR’s specification used eight principles governing personal-data handling. The table paraphrases that historical model. Apply it to the scenario: an organisation collecting irrelevant details, retaining records without need or exposing them through weak controls raises different principle questions. Naming the Act alone does not explain the issue.

A data subject is the person the personal data concern; the controller determines the relevant processing purposes and means. Personal information is not confined to passwords or bank records. An identifiable location history can also reveal information about a living person. Rights and obligations need context, rather than a claim that every use of personal data is prohibited.

The 1998 regime is historical and was replaced by the 2018 framework. As checked in October 2026, current practice includes the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The 2025 Act amends rather than wholly replaces these laws. Do not present the old eight-principle list as a complete statement of current obligations.

OCR’s clarification guide says it accepts interpretations based on the specification’s start or the examination date. Read the Act or context named by the question, apply the relevant principle accurately and distinguish any current-law comparison explicitly. For an actual organisation’s specific decisions, current official guidance and the applicable facts are needed rather than an exam simplification.

The Computer Misuse Act 1990 concerns unauthorised access and related offences, including access with intent to facilitate further offences and unauthorised acts impairing computer operation. Technical ability is different from authorisation. Using a working password does not by itself establish that a person is entitled to access the particular material. Relevant intentions and the scope of permission matter.

The Copyright, Designs and Patents Act 1988 protects relevant creative expression, including software and images. Copying, distributing or adapting protected material needs an applicable permission or exception. Public availability and adding a credit are not automatically sufficient. A licence can grant rights subject to conditions; owning a copy of a program does not mean owning every right to redistribute its code.

RIPA 2000 established a framework for investigatory activities including interception, covert surveillance and aspects of investigating encrypted material. The educational point is regulated powers with authorisation and safeguards, rather than an unrestricted ability for any person or organisation to monitor anyone. Necessity and proportionality are relevant to evaluating intrusion into private life.

Later legislation, including the Investigatory Powers Act 2016, changed parts of the framework; not every RIPA provision disappeared. Explain the syllabus’s named Act without claiming that its original text is the whole current regime. In extended responses, connect a legitimate investigation purpose to its intrusion, controls and possible effects on other people. Lawful permission and ethical desirability remain related but distinct questions.

Attempt the task before opening its worked response. Record each change of state, explain the rule used, and check the result against the original requirements. Code examples labelled Python 3 use that language’s conventions; pseudocode states its own assumptions.