Edexcel GCSE Computer Science (1CP2) Exam Questions

• C Ownership (1)
• The only correct answer is C. The correct answer is ownership.
• A is not correct because consent is permission given to collect or use personal data
• B is not correct because misuse is using personal data for a purpose it was not collected for, or in an improper way
• D is not correct because privacy is keeping personal data private and free from unauthorised access

• B Misuse (1)
• The only correct answer is B. The correct answer is misuse.
• A is not correct because consent is the permission a customer gives for their data to be used, not an employee using it for another purpose
• C is not correct because ownership is who legally controls the data, not how the data is used
• D is not correct because privacy is keeping personal data secret from unauthorised people, not using it for another purpose

Award up to two marks for a linked description such as:

• Cookies store a record of the pages/sites a user visits (1) so their browsing habits can be tracked over time (1)
• Cookies can track a user across multiple websites (1) so data about their activity can be shared/sold to third parties (1)
• Cookies collect personal data (1) so it can be used/sold for purposes the user did not consent to (1)
• Cookies are stored on the user's device (1) so anyone else with access to the device can see which sites they have visited (1)

Allow 'cookies store/record data about a user's visits' as the first point, even if tracking is not named.

Do not accept responses about deleting/blocking cookies, or about cookies making a website work (e.g. remembering a shopping basket), unless they are linked to a privacy issue.

Do not accept generic answers such as 'cookies can be hacked' or 'cookies contain personal data' without a development.

Do not award credit for 'cookies are viruses' or 'cookies steal data'.

Award up to two marks for a linked description such as:

• The user has the right to agree to their personal data being collected (1) so they know what it will be used for (1)
• Consent allows the user to refuse/opt out (1) so their privacy is respected (1)
• Data protection legislation requires a lawful reason for processing personal data (1) so collecting the location data without consent would be misuse (1)
• The user can withdraw their consent at any time (1) so the app must stop collecting/using the data (1)

Accept agreement and refusal of consent as alternatives for the same point; do not award both.

Do not accept responses that only describe how consent is obtained (e.g. a tick box or a pop-up) without saying why it should be obtained.

Do not accept 'so the app can work' or 'to make the app better' unless it is linked to the user's agreement/privacy.

Do not accept 'so the data is secure' or 'to keep the user safe'; these are about security, not why consent should be obtained.

Award up to two marks for a linked description such as:

• The employee could change/alter a student's grade/details (1) without permission so that the record is no longer accurate (1)
• The employee could share/copy/sell the records to people outside the school (1) without the students' consent (1)
• The employee could look at/view records they do not need to see for their job (1) out of curiosity (1)
• The employee could delete/remove records (1) so the school no longer has accurate information (1)

Do not accept responses about hacking or stealing a password, as the employee already has access.

Do not accept responses that describe the data being lost or not kept secure without an act of misuse by the employee.

Ignore answers that repeat the question (e.g. the employee misuses the data).

Award up to two marks for a linked description such as:

• It may be unclear who is responsible (1) if the AI gives a wrong recommendation that harms a patient (1)
• The doctor may be blamed (1) even though they followed the AI's recommendation (1)
• The developer/programmer may be held responsible (1) because they designed the AI's algorithm (1)
• The hospital may be held responsible (1) because it chose to use the AI system (1)

Do not accept responses about bias or safety unless they are linked to who is responsible.

Do not award a mark for naming a group/person without saying why responsibility is unclear or who may be accountable.

Award up to two marks for a linked description such as:

• A robot's sensors may fail to detect a worker (1) so the robot collides with them and causes injury (1)
• A robot may move unexpectedly/at speed (1) and injure a worker standing nearby (1)
• A robot may trap/crush a worker against a shelf (1) causing serious injury (1)
• A robot may drop a heavy load (1) which falls on a worker and injures them (1)

Allow one mark for a safety issue identified on its own with no development, e.g. a robot could hit a worker (1).

Do not accept descriptions of a robot malfunctioning/breaking down unless the response says how a worker could be harmed.

Do not accept generic statements that robots are dangerous without saying how a worker could be harmed.

Do not accept responses about job loss or other ethical issues; the question asks about safety.

Award up to two marks for a linked description such as:

• It may not be clear who is legally liable (1) because the robot acted autonomously without a human controlling it (1)
• The manufacturer may be legally liable (1) because the robot's design/software caused the injury (1)
• The owner/operator may be legally liable (1) because they deployed the robot on the pavement (1)
• The programmer may be legally liable (1) because the robot followed their code (1)

Do not accept responses about safety or job loss without reference to who is legally responsible.

Do not accept answers that name a law without describing who may be legally liable.

Award up to two marks for a linked explanation such as:

• Visitors lose control over who knows their browsing habits/activities (1) because details of the pages they view are collected and stored (1)
• The visitor is tracked without their consent/knowledge (1) because the pages they visit are recorded without them being asked (1)
• The visitor can be identified/linked to their browsing history (1) because data about their visits is stored and may be shared with third parties (1)
• Personal information about the visitor's interests is worked out without them sharing it (1) because the pages they view are used to build a profile for targeted advertising (1)

For both marks, the expansion must follow/associate with the statement.

Allow other valid privacy points, e.g. the visitor is tracked without their consent (1), where the linked reason says how the browsing data is recorded or used (1).

Allow 'a profile of the visitor's interests/behaviour is built' (1) as the privacy point; a second mark needs a linked reason, e.g. that this information is worked out without the visitor choosing to share it.

Do not accept 'it is private' or 'they lose privacy' without saying what information is revealed or how it is used.

Do not accept 'information is collected' or 'data is stored' on its own without saying why this is a privacy issue.

Do not award answers that only describe data being hacked, stolen or kept secure; these are security issues, not privacy issues.

Award up to two marks for a linked explanation such as:

• The customer may receive more spam/unwanted marketing (1) because their email address/contact details have been sold/shared (1)
• The customer may lose money (1) because their card/bank details have been used fraudulently (1)
• The customer may have their identity stolen (1) so accounts/credit can be opened in their name (1)
• The customer may be targeted with scam/phishing messages (1) because criminals have obtained their contact details (1)

For both marks, the expansion must follow/associate with the statement.

Allow other valid effects on the customer where a linked reason is given, e.g. feeling embarrassed/distressed (1) because their private information has been made public (1)

Do not accept 'they lose privacy' without saying what happens to the customer as a result.

Do not accept an expansion that only says the shop holds the data, e.g. 'because the shop has their email address'; the reason must say how the data was misused.

Do not accept answers about the online shop being fined or losing customers; the question asks about the effect on the customer.