Ethics, privacy, and the law
Computing gives people great power over information and decisions. With that power come questions about privacy, fairness, ownership, and responsibility.
Privacy
Privacy is people's ability to control information about themselves. Apps, websites, and devices collect vast amounts of personal data, such as location, contacts, browsing, and purchases, often combined by data brokers into detailed profiles. Privacy concerns include surveillance, identity theft, and manipulation through targeted content.
Data protection laws
The EU's General Data Protection Regulation (GDPR), in force since 2018, requires a lawful basis for processing personal data, gives people rights to access and delete their data, and allows large fines. California's Consumer Privacy Act and laws in many other places follow similar ideas. Good practice includes data minimisation: collect only what is needed.
Intellectual property
Software and digital content are protected by copyright, and some inventions by patents. Licences set how software may be used: proprietary licences restrict copying and modification, while open-source licences, such as the MIT licence and the GNU General Public License, allow sharing under stated conditions. Copying software or media without permission can break the law.
Computer misuse laws
Many countries criminalise unauthorised access to computers, such as the UK's Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act. Even 'just looking' inside a system without permission can be illegal. Ethical hackers, or penetration testers, work only with explicit written authorisation, and bug bounty programmes reward responsible reporting of vulnerabilities.
Algorithmic bias and fairness
Algorithms that learn from historical data can repeat or amplify past unfairness. Studies have found facial recognition systems performing worse on darker-skinned faces, and hiring tools favouring candidates who resembled past hires. Fairness requires representative data, testing outcomes across groups, transparency about how decisions are made, and human oversight for high-stakes decisions.
Artificial intelligence and responsibility
AI raises new questions: who is responsible when an automated system causes harm, how to label AI-generated content, and how to prevent misuse such as deepfakes. The EU's AI Act, adopted in 2024, regulates AI by risk level, with the strictest rules for high-risk uses such as hiring and critical infrastructure, and bans a few practices outright.
Professional ethics and sustainability
Professional codes, such as the ACM Code of Ethics, ask computing professionals to contribute to society, avoid harm, be honest, respect privacy, and keep their skills current. Environmental responsibility matters too: data centres consume large amounts of electricity and water, and discarded electronics create e-waste, so efficient design and recycling are ethical as well as practical choices.
Worked example
A fitness app shares users' running routes publicly by default. Ethically and under laws like GDPR, this raises problems: location data can reveal home addresses and daily routines, putting people at risk. Better design would make sharing opt-in, explain clearly what is shared, hide start and end points near home, and let users delete their data easily: privacy by design.
Key takeaways
Privacy means control over personal information, which is widely collected and combined. GDPR (2018) and similar laws give people rights and require data minimisation. Copyright, patents, and licences, proprietary or open source, govern software. Unauthorised access is illegal under laws such as the Computer Misuse Act and CFAA; ethical hackers need permission. Algorithms can be biased and need testing and oversight. The EU AI Act (2024) regulates AI by risk. Professional codes and sustainability guide responsible computing.
Flashcard
Control over information about oneself
Check your understanding
A student finds a way into the school's grade system and only looks around without changing anything. Under laws like the Computer Misuse Act, this is: