Responsible practice: ethics, legal frameworks and codes of conduct

Ethical issues

Ethics is about what is right, not just what is legal. Common issues:

• Privacy and surveillance: tracking, data collection, facial recognition.
• Bias and fairness: AI trained on biased data making unfair decisions about loans, jobs or policing.
• Accountability and transparency: who is responsible when an automated system causes harm; can its decisions be explained?
• Employment: automation replacing jobs.
• Digital divide: unequal access to technology and skills.
• Environment: energy use of data centres, AI training and cryptocurrency; e-waste.
• Safety: autonomous vehicles, medical software, security of connected devices.
• Intellectual property: copying software, content and training data.

Legal frameworks

Laws differ between countries, so check those that apply where you live and where your data and users are. UK examples:

• Computer Misuse Act 1990: offences of unauthorised access to computer material (s1); unauthorised access with intent to commit further offences (s2); unauthorised acts intended to impair a computer's operation, such as spreading malware or DoS (s3); acts causing or risking serious damage (s3ZA); making, supplying or obtaining tools for these offences (s3A).
• Data Protection Act 2018 and UK GDPR: personal data must follow seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); accountability.
• Copyright law protects software, music, images and text from unauthorised copying.

Why laws are needed: to protect individuals and organisations, deter crime, give victims a remedy and set clear standards.

Codes of conduct

Professional bodies publish codes of conduct that members must follow. The BCS (The Chartered Institute for IT) code has four sections:

• Public interest: consider health, privacy, security and wellbeing; avoid discrimination; help everyone benefit from IT.
• Professional competence and integrity: only take on work you are competent to do; do not overstate your skills; keep learning; respect the law; reject bribery.
• Duty to relevant authority: act with due care for your employer or client; avoid conflicts of interest; protect confidential information; do not misrepresent products.
• Duty to the profession: uphold its reputation; help raise standards; support colleagues' development.

Why codes are needed: they guide decisions where the law is silent, build public trust and set expectations; but they are voluntary outside membership and enforcement is limited.

Worked example

A developer is asked to add hidden tracking that collects users' locations for advertising, without telling them. Discuss the issues.

1. Ethical: users' privacy and autonomy are violated; it is deceptive.
2. Legal (UK GDPR): processing must be lawful, fair and transparent with a clear purpose; secret collection breaks these principles and could lead to large fines.
3. Code of conduct: the public interest section requires regard for privacy; the developer should raise concerns and refuse to misrepresent the product.

Answer: It is unethical, likely unlawful and against professional codes; the developer should push for consent and transparency.

Check yourself

1. Under the UK Computer Misuse Act 1990, which act is an offence under section 1?
   • Using a computer for more than eight hours a day
   • Writing software without a licence
   • Sharing a public website link
   • Accessing a computer system without authorisation, knowing it is unauthorised
   Show answer

   Accessing a computer system without authorisation, knowing it is unauthorised. Section 1 covers unauthorised access to computer material.

2. Spreading malware to disrupt a company's systems is covered by which part of the Computer Misuse Act 1990?
   • Section 1 only: unauthorised access
   • Section 3: unauthorised acts intended to impair a computer's operation
   • Section 3A: obtaining tools
   • It is not covered by the Act
   Show answer

   Section 3: unauthorised acts intended to impair a computer's operation. Section 3 covers impairing operation, including malware and DoS.

3. Which is one of the UK GDPR data protection principles?
   • Data maximisation: collect as much as possible
   • Data must be stored forever
   • Data must be public
   • Data minimisation: collect only the personal data needed
   Show answer

   Data minimisation: collect only the personal data needed. The seven principles include data minimisation and storage limitation.

4. An AI hiring tool rejects more applicants from one group because of patterns in past data. Which ethical issue is this?
   • Algorithmic bias
   • Software piracy
   • Hacking
   • Data compression
   Show answer

   Algorithmic bias. Bias in training data leads to unfair decisions.

5. Under the BCS Code of Conduct, which action shows professional competence and integrity?
   • Hiding a product's known faults from a client
   • Accepting a gift to recommend a supplier
   • Refusing work you are not qualified to do
   • Claiming skills you do not have
   Show answer

   Refusing work you are not qualified to do. Only take on work within your competence and do not overstate skills.

6. Why are professional codes of conduct needed as well as laws?
   • They guide behaviour in situations the law does not cover and build public trust
   • They replace the law
   • They only apply to criminals
   • They make software run faster
   Show answer

   They guide behaviour in situations the law does not cover and build public trust. Codes cover ethical professional behaviour beyond legal minimums.

7. Which is an environmental issue linked to computing?
   • The use of passwords
   • The speed of broadband
   • The large energy use of data centres and AI training
   • The number of programming languages
   Show answer

   The large energy use of data centres and AI training. Energy, water for cooling and e-waste are key concerns.

Practise with instant feedback Print this lesson

Sources

• Pearson Edexcel International Advanced Subsidiary and Advanced Level in Computer Science specification (2026), Issue 1
• Pearson Edexcel IAL Computer Science sample assessment materials (Unit 3 paper, resource booklet and mark scheme)
• BCS, The Chartered Institute for IT: Code of Conduct
• ICO: A guide to the data protection principles
• Crown Prosecution Service: Computer Misuse Act legal guidance

Last updated 8 November 2026. Spotted a mistake? Tell us.