Edexcel GCSE Computer Science (1CP2) Exam Questions

• C Ownership (1)
• The only correct answer is C. The correct answer is ownership.
• A is not correct because consent is permission given to collect or use personal data
• B is not correct because misuse is using personal data for a purpose it was not collected for, or in an improper way
• D is not correct because privacy is keeping personal data private and free from unauthorised access

• A Consent (1)
• The only correct answer is A. The correct answer is consent.
• B is not correct because misuse is using personal data for an improper purpose
• C is not correct because ownership is who owns or controls the data
• D is not correct because privacy is keeping personal data private and free from unauthorised viewing

• B Misuse (1)
• The only correct answer is B. The correct answer is misuse.
• A is not correct because consent is the permission a customer gives for their data to be used, not an employee using it for another purpose
• C is not correct because ownership is who legally controls the data, not how the data is used
• D is not correct because privacy is keeping personal data secret from unauthorised people, not using it for another purpose

Award one mark for any of the following up to a maximum of two marks:

• Who has legal rights/control over the data (1)
• The person or organisation that the data belongs to (1)
• The right to decide how the data is used/shared/sold (1)
• The right to control access to the data (1)

Do not accept 'owning the device/hardware where the data is stored' (this is ownership of equipment, not data).

Award one mark for any of the following up to a maximum of two marks:

• Permission/agreement given by an individual (1)
• For their personal data to be collected/used/processed (1)
• Given freely, without pressure (1)
• The individual is told/understands what their data will be used for (1)

Allow agree, agreement, approve, approval, 'a user says yes', opting in for permission/agreement.

Award the second mark only where the answer also states that permission/agreement is given; 'personal data is collected' on its own is not a definition of consent.

Do not accept 'consent is a legal requirement' (this says why consent is needed, not what it means).

Do not accept 'the user accepts the terms and conditions' on its own (it does not say what is being agreed to, e.g. the use of personal data).

Do not accept 'a company tells the user what data it will collect' on its own (no permission is given).

Do not accept 'consent can be withdrawn at any time' on its own (this is a right of the individual, not a definition of consent).

Award one mark for any of the following up to a maximum of two marks:

• Used without consent/permission (1)
• Shared/sold with/to third parties without consent (1)
• Used for a purpose different from the one it was collected for (1)
• Accessed/copied by someone who is not authorised (1)
• Used to commit identity theft/fraud (1)
• Altered/changed without authorisation so that the data is inaccurate (1)

Accept used for advertising/marketing only as an example of used without consent, not as a separate way.

Do not award two marks for the same idea, e.g. shared with third parties and sold to other companies are one way.

Do not accept "the data is lost" or "the data is stolen" on its own; losing or stealing data is a security breach, not misuse.

Award up to two marks for a linked description such as:

• The user has the right to agree to their personal data being collected (1) so they know what it will be used for (1)
• Consent allows the user to refuse/opt out (1) so their privacy is respected (1)
• Data protection legislation requires a lawful reason for processing personal data (1) so collecting the location data without consent would be misuse (1)
• The user can withdraw their consent at any time (1) so the app must stop collecting/using the data (1)

Accept agreement and refusal of consent as alternatives for the same point; do not award both.

Do not accept responses that only describe how consent is obtained (e.g. a tick box or a pop-up) without saying why it should be obtained.

Do not accept 'so the app can work' or 'to make the app better' unless it is linked to the user's agreement/privacy.

Do not accept 'so the data is secure' or 'to keep the user safe'; these are about security, not why consent should be obtained.

Award up to two marks for a linked description such as:

• Training data (sets) is unrepresentative/incomplete (1) so the system learns patterns that are unfair/inaccurate for some groups (1)
• Training data (sets) contains human bias/prejudice (1) which the system learns and repeats (1)
• Features/weightings are chosen that favour one group (1) so the decisions made are unfair to other groups (1)
• Training data (sets) is out of date (1) so the system's decisions do not reflect current situations (1)

Do not accept answers that only state that the data/system is biased (e.g. 'the data is biased', 'the AI is biased') without saying how the data is unrepresentative, incomplete or contains human bias.

Do not accept the size of the data set alone as a cause (e.g. 'it learns from a large data set') unless it is linked to the data not representing all groups.

Do not accept outcomes of bias (e.g. unfair decisions) as the cause unless they are linked to what caused the bias.

Do not accept responses about data privacy, cyber security or errors in general that are not linked to bias.

Award up to two marks for a linked description such as:

• It may not be clear who is legally liable (1) because the robot acted autonomously without a human controlling it (1)
• The manufacturer may be legally liable (1) because the robot's design/software caused the injury (1)
• The owner/operator may be legally liable (1) because they deployed the robot on the pavement (1)
• The programmer may be legally liable (1) because the robot followed their code (1)

Do not accept responses about safety or job loss without reference to who is legally responsible.

Do not accept answers that name a law without describing who may be legally liable.

Award up to two marks for a linked explanation such as:

• Visitors lose control over who knows their browsing habits/activities (1) because details of the pages they view are collected and stored (1)
• The visitor is tracked without their consent/knowledge (1) because the pages they visit are recorded without them being asked (1)
• The visitor can be identified/linked to their browsing history (1) because data about their visits is stored and may be shared with third parties (1)
• Personal information about the visitor's interests is worked out without them sharing it (1) because the pages they view are used to build a profile for targeted advertising (1)

For both marks, the expansion must follow/associate with the statement.

Allow other valid privacy points, e.g. the visitor is tracked without their consent (1), where the linked reason says how the browsing data is recorded or used (1).

Allow 'a profile of the visitor's interests/behaviour is built' (1) as the privacy point; a second mark needs a linked reason, e.g. that this information is worked out without the visitor choosing to share it.

Do not accept 'it is private' or 'they lose privacy' without saying what information is revealed or how it is used.

Do not accept 'information is collected' or 'data is stored' on its own without saying why this is a privacy issue.

Do not award answers that only describe data being hacked, stolen or kept secure; these are security issues, not privacy issues.