Privacy issues
CIE A-Level Computer ScienceΒ· Unit 6: Security, privacy and data integrityΒ· 12 min read
1. Core Concepts: Privacy vs Data Securityβ β ββββ± 4 min
Privacy and security are often confused, but they are distinct concepts critical to modern data handling. While security focuses on preventing unauthorised access, modification or destruction of data, privacy focuses on the rights of the individual over their own personal information.
Privacy
The legal and ethical right of an individual to control the collection, storage, processing, sharing and deletion of their personal identifiable information (PII).
Example:
A user requesting a social media company delete all their personal data is exercising their right to privacy.
It is possible to have a secure system that violates privacy, and a private system that is insecure. For example: a government database that stores all citizen DNA information with end-to-end encryption (secure) but collected without explicit consent (violates privacy).
Classify each scenario as (a) a security issue, (b) a privacy issue, (c) both, (d) neither:
- A hacker gains access to an unencrypted company customer database
- A gym sells member email addresses to advertisers without consent
- A company public website does not use HTTPS encryption
- 1
Recall the core definitions: security = protection from unauthorised access; privacy = individual control over personal data. Evaluate each scenario one by one.
- 2
Scenario 1: A hacker accessing customer data is unauthorised access (security issue) and exposes personal data without consent (privacy issue). This is (c) both.
- 3
Scenario 2: The gym already has lawful access to member data, so there is no breach of security. Selling data without consent violates the member's right to control their data, so this is (b) a privacy issue.
- 4
Scenario 3: No HTTPS means data can be intercepted by third parties, which is a security vulnerability. No privacy breach has occurred yet, so this is (a) a security issue.
- 5
Final answers: 1 = c, 2 = b, 3 = a
Exam tip:
CIE examiners regularly test the ability to distinguish privacy and security. Always define both terms in your answer to get full marks.
2. Common Threats to Privacyβ β ββββ± 5 min
Most privacy threats arise from unauthorised sharing, misuse or over-collection of personal data by organisations or malicious actors. Common threats include:
Mass surveillance: Monitoring of online activity by governments or organisations without individual consent
Data brokers: Companies that collect personal data from multiple sources to sell to third parties for advertising or other purposes
Third-party tracking: Cookies and device fingerprinting that track users across websites to build detailed personal profiles
Phishing: Scams that trick users into revealing personal information, which is then misused
Data leakage: Accidental or intentional release of personal data by the organisation that holds it
Device fingerprinting
A tracking technique that collects information about a user's device (browser version, screen resolution, IP address) to create a unique identifier that can track users even if they delete cookies.
A retail website collects user location data from their device to improve delivery estimates, but shares this data with advertising partners without informing the user. Identify the type of privacy violation and explain the impact on the user.
- 1
First, note that the user did not consent for their data to be shared beyond the original purpose of improving delivery estimates.
- 2
This is unauthorised secondary use of personal data, a clear violation of the user's right to privacy.
- 3
Impact: Advertising partners can combine location data with data from other sites to build a detailed profile of the user's habits and movements. This profile can be used for manipulative advertising, identity theft, or sold to other third parties, increasing the user's risk of harm.
3. Legal and Ethical Privacy Frameworksβ β β βββ± 6 min
Most major economies have introduced privacy legislation that places legal obligations on organisations that collect and process personal data. The EU General Data Protection Regulation (GDPR) is the most widely referenced framework in CIE exams, and grants individuals 5 core rights:
Right to be informed: Organisations must clearly state what data they collect and how it will be used
Right of access: Individuals can request a copy of all personal data an organisation holds on them
Right to erasure: Individuals can request permanent deletion of all their personal data
Right to data portability: Individuals can request their data be transferred to another organisation
Right to object: Individuals can opt out of data use for marketing or other non-essential processing
A user wants to close their social media account and have all their personal data permanently deleted. What right can they exercise under GDPR? What are the platform's obligations?
- 1
The right that covers permanent deletion of personal data under GDPR is the right to erasure, also known as the right to be forgotten.
- 2
The platform is legally obligated to delete all copies of the user's personal data, including backup copies, within 1 month of receiving the request.
- 3
The only exceptions are when the data must be retained for legal compliance, public interest, or to defend legal claims.
Exam tip:
When asked about legal obligations, always name at least two specific individual rights to gain full marks in essay questions.
4. Privacy Protection Measuresβ β β βββ± 4 min
Both organisations and individuals can take active measures to protect personal privacy. Organisations have formal responsibilities, while individuals can take steps to reduce their own exposure to privacy threats.
Organisational measures: Privacy by design, data minimisation, anonymisation of user data, regular security audits, clear public privacy policies
Individual measures: Use ad blockers and anti-tracking extensions, disable third-party cookies, use a VPN to hide IP address, avoid over-sharing on social media, use end-to-end encryption for messaging
Explain how the principle of data minimisation protects privacy, and give one practical example.
- 1
Define data minimisation: The principle that organisations should only collect the minimum amount of personal data required to complete their intended purpose.
- 2
Data minimisation reduces privacy risk in two ways: if a data breach occurs, less personal data is exposed, and organisations cannot misuse data that they never collected in the first place.
- 3
Example: A coffee shop running a loyalty app only needs a user's email address to send rewards. Data minimisation means the shop does not collect the user's home address or phone number, which are not required for the program. If the app's database is breached, only email addresses are exposed, reducing the privacy risk to users.
5. Common Pitfalls
Wrong move:
Confusing privacy with data security in exam answers
Why:
CIE examiners specifically test the ability to distinguish between these two distinct concepts, so mixing them up loses marks
Correct move:
Always define both terms explicitly when asked to compare or discuss either concept
Wrong move:
Assuming all data tracking is always illegal
Why:
Tracking is legal if the user has given explicit consent for the stated purpose
Correct move:
Evaluate whether consent was given and whether the use matches the stated purpose when answering legality questions
Wrong move:
Thinking GDPR only applies to organisations based in the EU
Why:
GDPR is extra-territorial, so this common assumption is incorrect
Correct move:
Remember GDPR applies to any organisation that processes data of EU residents, regardless of where the organisation is based
Wrong move:
Claiming that encryption alone guarantees privacy
Why:
Encryption improves security, but it does not prevent lawful holders of data from misusing it without consent
Correct move:
Clarify that encryption supports privacy by preventing unauthorised access, but does not eliminate privacy risk from misuse by the organisation that holds the data
Wrong move:
Stating that privacy is only a concern for individuals
Why:
Organisations also have private information (trade secrets, client data) that requires protection
Correct move:
Acknowledge that privacy applies to both individuals and organisations in broader discussion questions
6. Quick Reference Cheatsheet
Concept | Definition | Key Exam Point |
|---|---|---|
Privacy | Right to control personal data collection/use | Distinct from security |
Data Security | Protection from unauthorised access/modification | Secure systems can still violate privacy |
GDPR Core Rights | Informed, access, erasure, portability, object | Applies to all organisations handling EU data |
Data Minimisation | Only collect data required for the purpose | Core privacy by design principle |
Common Threats | Unauthorised sharing, tracking, surveillance, phishing | Can be intentional or accidental |
7. Frequently Asked
What is the difference between privacy and data security?
Security refers to protecting data from unauthorised access, modification or damage, while privacy refers to the right of an individual to control what data is collected and how it is used. A system can be secure but still violate privacy (e.g. a secure government database holding personal data without consent).
When this came up on past exams
AI-estimated based on syllabus patterns β cross-check with official past papers for accuracy. Use only as revision-focus signals.
- 2022 Β· 2
Discuss common privacy threats
- 2023 Β· 2
Compare privacy vs security
- 2024 Β· 2
Evaluate privacy protection methods
Going deeper
What's Next
Understanding privacy issues is a core assessed part of Unit 6 for CIE 9618, and regularly appears in Paper 2 essay questions that ask you to evaluate real-world case studies of data handling. This module builds on your existing knowledge of network security threats, and prepares you to answer questions on ethical and legal obligations of organisations that handle personal data. Privacy concepts also connect closely to topics on data integrity and the ethical impact of computer systems, which are frequently tested in combination with privacy issues in exams.