Edexcel GCSE Computer Science (1CP2) Exam Questions

• D Privacy (1)
• The only correct answer is D. The correct answer is privacy.
• A is not correct because consent is giving permission for personal data to be collected or used
• B is not correct because misuse is using personal data in a way that is not allowed or not intended
• C is not correct because ownership is about who legally controls or holds the personal data

• A Consent (1)
• The only correct answer is A. The correct answer is consent.
• B is not correct because misuse is using personal data for an improper purpose
• C is not correct because ownership is who owns or controls the data
• D is not correct because privacy is keeping personal data private and free from unauthorised viewing

• B Misuse (1)
• The only correct answer is B. The correct answer is misuse.
• A is not correct because consent is the permission a customer gives for their data to be used, not an employee using it for another purpose
• C is not correct because ownership is who legally controls the data, not how the data is used
• D is not correct because privacy is keeping personal data secret from unauthorised people, not using it for another purpose

Award one mark for any of the following up to a maximum of two marks:

• Keeping personal information secret/private (1)
• Controlling who can see/access/use your personal data (1)
• Being free from observation/tracking/surveillance (1)
• The right to keep information about yourself to yourself (1)

Do not accept 'the data is kept secure/safe' on its own (this is data protection, not privacy).

Award one mark for any of the following up to a maximum of two marks:

• Who has legal rights/control over the data (1)
• The person or organisation that the data belongs to (1)
• The right to decide how the data is used/shared/sold (1)
• The right to control access to the data (1)

Do not accept 'owning the device/hardware where the data is stored' (this is ownership of equipment, not data).

Award one mark for any of the following up to a maximum of two marks:

• Permission/agreement given by an individual (1)
• For their personal data to be collected/used/processed (1)
• Given freely, without pressure (1)
• The individual is told/understands what their data will be used for (1)

Allow agree, agreement, approve, approval, 'a user says yes', opting in for permission/agreement.

Award the second mark only where the answer also states that permission/agreement is given; 'personal data is collected' on its own is not a definition of consent.

Do not accept 'consent is a legal requirement' (this says why consent is needed, not what it means).

Do not accept 'the user accepts the terms and conditions' on its own (it does not say what is being agreed to, e.g. the use of personal data).

Do not accept 'a company tells the user what data it will collect' on its own (no permission is given).

Do not accept 'consent can be withdrawn at any time' on its own (this is a right of the individual, not a definition of consent).

Award up to two marks for a linked description such as:

• Cookies store a record of the pages/sites a user visits (1) so their browsing habits can be tracked over time (1)
• Cookies can track a user across multiple websites (1) so data about their activity can be shared/sold to third parties (1)
• Cookies collect personal data (1) so it can be used/sold for purposes the user did not consent to (1)
• Cookies are stored on the user's device (1) so anyone else with access to the device can see which sites they have visited (1)

Allow 'cookies store/record data about a user's visits' as the first point, even if tracking is not named.

Do not accept responses about deleting/blocking cookies, or about cookies making a website work (e.g. remembering a shopping basket), unless they are linked to a privacy issue.

Do not accept generic answers such as 'cookies can be hacked' or 'cookies contain personal data' without a development.

Do not award credit for 'cookies are viruses' or 'cookies steal data'.

Award up to two marks for a linked description such as:

• The user has the right to agree to their personal data being collected (1) so they know what it will be used for (1)
• Consent allows the user to refuse/opt out (1) so their privacy is respected (1)
• Data protection legislation requires a lawful reason for processing personal data (1) so collecting the location data without consent would be misuse (1)
• The user can withdraw their consent at any time (1) so the app must stop collecting/using the data (1)

Accept agreement and refusal of consent as alternatives for the same point; do not award both.

Do not accept responses that only describe how consent is obtained (e.g. a tick box or a pop-up) without saying why it should be obtained.

Do not accept 'so the app can work' or 'to make the app better' unless it is linked to the user's agreement/privacy.

Do not accept 'so the data is secure' or 'to keep the user safe'; these are about security, not why consent should be obtained.

Award up to two marks for a linked description such as:

• Training data (sets) is unrepresentative/incomplete (1) so the system learns patterns that are unfair/inaccurate for some groups (1)
• Training data (sets) contains human bias/prejudice (1) which the system learns and repeats (1)
• Features/weightings are chosen that favour one group (1) so the decisions made are unfair to other groups (1)
• Training data (sets) is out of date (1) so the system's decisions do not reflect current situations (1)

Do not accept answers that only state that the data/system is biased (e.g. 'the data is biased', 'the AI is biased') without saying how the data is unrepresentative, incomplete or contains human bias.

Do not accept the size of the data set alone as a cause (e.g. 'it learns from a large data set') unless it is linked to the data not representing all groups.

Do not accept outcomes of bias (e.g. unfair decisions) as the cause unless they are linked to what caused the bias.

Do not accept responses about data privacy, cyber security or errors in general that are not linked to bias.

Award up to two marks for a linked explanation such as:

• Consent is required by data protection legislation (1) so the gym could be fined/prosecuted if it collects data without consent (1)
• The member has a choice about whether their data is collected (1) because they can refuse/say no (1)
• The member can be told what their data will be used for (1) so they know what they are agreeing to (1)
• The member has the right to withdraw consent (1) so the gym must stop using the data if the member changes their mind (1)
• The gym builds trust with members (1) because members know their data is being handled properly (1)

For both marks, the expansion must follow/associate with the statement.

Allow 'the member has a right to privacy' as a statement (1) if it is expanded with a reason such as the member controls who can see their data (1).

Do not accept 'the gym needs it' or 'it is the law/a legal requirement' without expansion as to what the law requires or what happens if it is broken.

Do not accept 'so the gym can use the data' without saying how consent protects the member or meets the law.

Do not accept answers about keeping data accurate or secure; these are data protection requirements but they are not about consent.