01 Ethics, impact and laws

Ethics, impact and laws

← Index · Solutions

Priority key

Exam recall

Issue → scenario fact → consequence. For laws, identify the trigger; for PDPA, state a distinct action. Ethical concern does not automatically establish a legal breach.

Understand the four perspectives priority/medium

Computing decisions affect different people in different ways. The same monitoring system might protect users from fraud, invade their privacy and reduce a company’s costs. Social, ethical, legal and economic are four perspectives on those effects, not four mutually exclusive boxes.

Start with the mechanism: what changes, who experiences it, and why does that matter? Then choose the perspective the question asks for.

flowchart TD
    A[Computing decision] --> B[What changes for people?]
    A --> C[Is the conduct responsible and fair?]
    A --> D[Which legal requirements apply?]
    A --> E[What changes in jobs, costs or output?]
    B --> F[Social]
    C --> G[Ethical]
    D --> H[Legal]
    E --> I[Economic]

Definitions and examples for an exam answer

A scenario answer needs the issue, a fact from the scenario, and its consequence. “It is unethical” names a judgement but does not explain it. Several issues can coexist: collecting data secretly can raise ethical and legal questions, while increased productivity is an economic effect.

Lens	Meaning	Useful causal explanation
Social	Effects on people, relationships, access and wellbeing	Online services improve access for remote users, but people without devices or digital skills can be excluded.
Ethical	Whether conduct is morally responsible and fair	Secret monitoring prevents informed choice and can damage trust.
Legal	Whether conduct meets legal requirements	Unauthorised access to another student’s account may engage the CMA.
Economic	Effects on costs, output, jobs and competition	Automation reduces repetitive work and operating costs, but displaces some roles and creates reskilling costs.

Avoid unsupported absolute claims such as “technology causes unemployment”. Describe the affected group and mechanism. Benefits and harms can apply to different people.

Develop an impact rather than name it

“Automation improves productivity” is only the starting point. Automated stock counting reduces the time employees spend counting items, allowing more orders to be processed with the same staffing explains the economic mechanism. Workers whose tasks are automated may need retraining to move into other roles explains a possible cost to a particular group.

Useful social examples: online communication maintains contact over distance; accessibility tools help users with disabilities; digital-only services can exclude people without connectivity or skills; excessive use can affect wellbeing. Useful economic examples: lower processing costs, new digital services/jobs, displacement of particular tasks, reskilling costs and competition from online businesses. Select an example that matches the scenario; do not list all of them indiscriminately.

Professional conduct: how expertise should be used priority/medium

Integrity: be honest, respect confidentiality and acknowledge others’ work. Full responsibility: accept responsibility for your work and its consequences; assess risks and communicate limitations. Competence: keep knowledge current and undertake work you can perform properly. Professionalism: follow relevant standards and use expertise responsibly. In an answer, connect the named principle to a specific action: reporting an unresolved security flaw demonstrates responsibility because it lets the client address the risk before deployment.

Ethical issue	Understand it through a concrete example
Privacy and confidentiality	Monitoring records what a person does; sharing that record exposes it to others. Ask both whether collection is justified and who should be allowed access.
Fairness and bias	A recruitment system trained on an unrepresentative history may disadvantage a group even without an explicitly discriminatory rule. Investigate the data and outcomes.
Intellectual property	Reusing someone else’s software or content raises permission/licensing and attribution issues. Giving credit does not automatically grant permission to copy.
Accountability	If an automated decision harms someone, responsibility for checking, explaining and correcting the decision should be assigned. “The computer decided” does not resolve responsibility.

These examples apply the principles above. An ethical concern can exist even when the question gives too little information to establish a legal breach.

Industry 4.0: a cause-and-effect example

Networked factory sensors → detect wear early → schedule maintenance → reduce downtime and lost output. Equipment and staff training cost money, so evaluate the benefit against these costs.

For a balanced answer, identify who gains and who bears the cost.

Four laws: recognise the trigger priority/high

Law	Core exam cue	Do not reduce it to
Computer Misuse Act (CMA)	Unauthorised access, modification or interference involving computers/data	“Any use of a computer to do something bad.” Authorisation matters.
Protection from Online Falsehoods and Manipulation Act (POFMA)	False statements of fact communicated online in Singapore; directions also require the public-interest condition	Disagreement, criticism or opinion automatically being illegal.
Protection from Harassment Act (POHA)	Harassing, threatening or abusive conduct; unlawful stalking and certain harmful disclosures can also be relevant	Every unpleasant comment necessarily establishing an offence.
Personal Data Protection Act (PDPA)	Organisations’ collection, use, disclosure and care of personal data	Consent being the only duty, or always being required without exceptions.

POFMA correction directions generally require a correction notice; they do not automatically require deleting the original statement. POFMA Office: conditions and directions.

For school scenarios, identify the likely relevant law and explain the match. Do not invent penalties or conclude a legal offence is proved from facts the question does not provide. The official CMA text and Singapore Courts’ POHA guide support these law-selection cues.

Doxxing: publishing identifying information can raise a POHA issue when the relevant harassment or violence-related conditions apply. Publication alone does not automatically establish an offence.

PDPA: understand what is being protected priority/high

Personal data identifies an individual by itself or together with information the organisation has or is likely to access. An ID paired with a name is a clear example. Business contact information has a specific treatment; this does not make all data about a businessperson exempt.

For example, a booking record containing a customer’s name and contact number can identify the customer. A random customer code can also be personal data if the organisation can link it to an identified person. “It is confidential” is not the definition: Identifiability is the reason.

All 11 obligations in your school handout

The names and order below follow H2_Computing_Ethics_Combined.pdf, pp.10–11. Learn each as a requirement plus an action; the action is what a scenario question often asks you to state.

Obligation	Exam-ready meaning	Scenario cue → suitable action
1. Accountability	Take responsibility for meeting data-protection duties through appropriate policies and practices, including a DPO.	Nobody oversees customer data → appoint a Data Protection Officer and establish handling procedures.
2. Notification	Inform individuals of the purposes for collecting, using or disclosing their personal data.	A form gives no reason for requesting a number → explain that it is used to contact customers about bookings.
3. Consent	Obtain consent for collection, use or disclosure for the stated purposes, subject to applicable exceptions.	Details are to be used for a new advertising purpose → obtain the required consent before that use.
4. Purpose Limitation	Collect, use or disclose data only for appropriate, reasonable purposes within the applicable limits.	A food order asks for unrelated medical history → limit collection to information reasonably needed for the service.
5. Accuracy	Make reasonable efforts to keep data accurate and complete where it will be used to make decisions affecting people or disclosed to another organisation.	An outdated address is used for an important decision → check and update the relevant record.
6. Protection	Make reasonable security arrangements to prevent unauthorised access, use, disclosure and other specified risks to personal data.	All employees can download customer records → restrict access to authorised staff who need it.
7. Retention Limitation	Stop retaining identifiable data when it is no longer needed for a business or legal purpose.	Old records are kept indefinitely “just in case” → delete them or remove their association with individuals when the need ends.
8. Transfer Limitation	Meet requirements for comparable protection when transferring personal data overseas.	An overseas provider will store records → ensure the required comparable protection is in place.
9. Access & Correction	Provide applicable access to personal data and allow correction of errors or omissions, subject to the Act.	A customer asks to inspect or fix their record → process the access/correction request.
10. Data Breach Notification	Assess breaches and notify the PDPC and affected individuals where the respective notification criteria are met.	Customer data is exposed → assess the breach and make the required notifications.
11. Data Portability*	Transmit applicable data to another organisation at the individual’s request in accordance with the portability requirements.	A request to move applicable data between providers → recognise portability, with the commencement qualification below.

The school handout states that Data Portability has not commenced and takes effect when the relevant regulations are issued. The PDPC obligations summary also marks it as taking effect when regulations are issued. Include it when learning the handout’s eleven headings; do not describe all eleven as already operative obligations.

Distinctions that prevent confusion

Often confused	The distinction
Notification vs Consent	Tell them why vs obtain the required agreement. Doing one does not automatically do the other.
Consent vs Purpose Limitation	Agreement is not a blanket justification for collecting anything for any purpose. The purpose must also meet the relevant limits.
Accuracy vs Access & Correction	The organisation’s duty to maintain suitable accuracy vs the individual’s applicable right to inspect/correct data.
Protection vs Breach Notification	Prevent/limit unauthorised exposure vs assess and report a breach after it happens. Both can matter in one incident.
Retention vs Transfer	How long identifiable data is kept vs protection when it goes overseas.

You do not need to recite eleven obligations in every answer. Know all eleven; select the ones supported by the facts and the question.

Worked example — original

A tuition company secretly records students’ browsing to target adverts. It retains identified histories after all business and legal needs have ended. Explain an ethical issue and state two relevant data-protection actions.

Analyse the question. It asks for one explanation and two actions. “Secretly” points to lack of awareness; the end of all retention needs directly supports Retention Limitation. Do not spend the answer describing unrelated laws.

Develop the answer. Students do not know how their browsing is monitored and used, undermining informed choice and privacy. The company should inform students of the purposes for collecting and using the histories (Notification) and delete or anonymise the identified histories once there is no continuing business or legal need (Retention Limitation).

Why this works. The ethical point gives a fact and its consequence. Each PDPA point gives a distinct action linked to the facts. “Follow PDPA and protect privacy” would be too vague. Consent may also be relevant, but the question only requests two actions.

Exam focus and answering technique priority/high

Evidence from supplied HCI papers	What to practise
2022 modified Q5(f); 2024 Q5(g)	Identify personal data and explain identifiability.
2024 Q5(h); 2025 Q5(f)	State concrete actions under PDPA in a database scenario.
2024 Q3(c); 2025 Q3(a)	Apply ethics to a specific use or misuse of technology.

This shows recurring question types, not permission to omit the rest of the school scope.

State: give the requested fact/action directly. Explain: connect the fact to how or why it matters. Discuss/evaluate: consider relevant competing effects and justify a conclusion in that scenario. The number of marks helps judge the likely breadth; it is not a universal one-sentence-per-mark rule.

Common mistakes

Naming an obligation without stating an action; treating “personal” as “secret”; giving two versions of the same point; declaring every ethical concern illegal; and listing all laws without connecting any to the scenario.

Practice

01A — original. A programmer gives a friend their employer’s customer list without authorisation. Explain one professional-conduct issue and one relevant PDPA issue. Do not merely name them.

Integrity - He fails to be honest with the customer as he did not inform the customers.
Marker feedback: ⚠️ Partially correct. Integrity is relevant, but the direct issue is that the programmer breaches confidentiality and trust by disclosing customer information entrusted to them. Failing to inform customers is mainly a Notification issue.
Correct solution: The programmer fails to act with integrity because disclosing confidential customer information entrusted to them breaches confidentiality and damages the employer’s and customers’ trust.

PDPA: Consent. He fails to obtain the customers’ consent before he spreads the the personal data to his friend with unauthorised access.
Marker feedback: ⚠️ Consent can be relevant, but Protection is more directly supported: access to and disclosure of the customer list should be restricted to authorised recipients. The scenario states unauthorised disclosure; it does not say that the friend gained unauthorised access to a computer.
Correct solution: This raises the PDPA Protection obligation. The organisation should use reasonable security and access controls so that customer data is disclosed only to authorised recipients.

01B — adapted from HCI 2025 Q3 and HCI 2024 Q3 (ethics scenarios). A school installs monitoring software without explaining what it records. Give one potential benefit, one ethical concern and one practical change addressing that concern.

Benefit: Safety of students are guaranteed as it improved security by deterring whoever wants to commit crime the presence of surveillance objects.
Marker feedback: ⚠️ A relevant benefit is identified, but safety is not guaranteed. A stronger answer is: monitoring may deter or detect security incidents, allowing staff to respond and improve student safety. The scenario mentions monitoring software, not necessarily physical surveillance devices.
Correct solution: Monitoring software may detect or deter security incidents, allowing school staff to respond more quickly and improve student safety.

Ethical concern: Privacy of students may be violated.
Marker feedback: ⚠️ Correct concern, but it needs development: recording students without explaining what is collected prevents informed choice, intrudes on their privacy and may damage trust.
Correct solution: Secret monitoring intrudes on students’ privacy because they do not know what activities are being recorded or how the information will be used, which may also damage their trust in the school.

One Practical change: They can follow the PDPA consent and notification obligations, inform the students about the purpose for collection usage or disclosure of their personal data, seek consent from them before proceeding installation of the monitoring devices.
Marker feedback: ✅ Informing students of the purpose is a suitable change and directly addresses the lack of transparency. Consent may not always be required, so write “obtain the required consent where applicable.” The school should also explain what is recorded and who can access it, and limit monitoring to what is necessary.

Hints

01A: distinguish confidentiality from permission to disclose. 01B: identify whose interests each point affects.

01C — original paper, HCI 2024 Q5(g)–(h), 4 marks total. Open the complete question, PDF p.3 and answer parts (g) and (h), using the transport-company context provided there. These ask you to identify and justify personal data, then state two PDPA actions. Keep your answer proportionate to the two marks for each part. The solution explains an independently written answer, not an official allocation of marks.

One personal data: CustomerContactNo. As one can recognise the individual with this data, or from that data with information the organisation has access to
Marker feedback: ✅ Correct. This identifies a valid item of personal data and explains identifiability. More precise wording: “CustomerContactNo can identify the customer directly or when linked with the customer’s name in the company’s booking records.”

Consent obligation: seek consent from individuals before collection usage disclosure of their personal data
Marker feedback: ✅ Correct action. Use the standard wording: obtain the required consent before collecting, using or disclosing the customers’ personal data.

Retention limitation: Stop retaining the data when it is no longer needed for the organisation
Marker feedback: ✅ Correct and distinct from Consent. Improve it by stating that the company should delete or anonymise the data when it is no longer required for a business or legal purpose. Overall, 01C is likely 4/4.

01D — original recognition check. Name the most directly relevant obligation for each fact: (i) no person or policy oversees data handling; (ii) a customer requests their stored information; (iii) records move to an overseas provider; (iv) a breach may require reporting; (v) data is retained after all business/legal need ends. For (iv), explain why Protection alone is an incomplete response.

(i) Protection
Marker feedback: ❌ Incorrect. The most directly relevant obligation is Accountability, because no person or policy oversees data handling.
Correct solution: (i) Accountability.

(ii) Access & Correction
Marker feedback: ✅ Correct.

(iii) Transfer Limitation
Marker feedback: ✅ Correct.

(iv) Data Breach Notification. Protection does not manage to notify the user on the leakage of their information
Marker feedback: ⚠️ The obligation is correct and the distinction is partly explained. Protection concerns safeguards that prevent or limit breaches. After a breach, the organisation must assess it and notify the PDPC and affected individuals when the relevant notification criteria are met.
Correct solution: (iv) Data Breach Notification. Protection concerns reasonable safeguards intended to prevent unauthorised exposure, whereas Data Breach Notification requires the organisation to assess a breach and notify the PDPC and affected individuals when the relevant criteria are met.

(v) Retention Limitation
Marker feedback: ✅ Correct.

01E — original, law-selection drill. For each case name the law that may apply and explain the triggering fact: (i) knowingly using a copied password without permission to enter another student’s account and change work; (ii) publishing a fabricated factual claim online in Singapore that the public water supply is contaminated; (iii) publishing a classmate’s address to frighten them and encourage threats; (iv) a retailer collecting identifiable customer details without explaining why. For (ii), distinguish a factual claim from opinion and state the condition for a POFMA direction.

(i) CMU
Marker feedback: ⚠️ Write CMA (Computer Misuse Act), not CMU. You also need the trigger: a copied password is knowingly used without permission to access another student’s account and modify their work.
Correct solution: (i) CMA: the person knowingly uses a copied password without permission to access another student’s account and modify the student’s work.

(ii) POFMA factual claim has proofs and evidence while opinion is objective. POFMA is the dissemination of online falsehood and manipulation
Marker feedback: ❌ POFMA is the correct law, but the explanation is incorrect and incomplete. A factual statement is capable of being proven true or false; an opinion is a subjective judgement. The fabricated contamination claim is a false statement of fact communicated online in Singapore. A POFMA direction also requires the public-interest condition to be met.
Correct solution: (ii) POFMA may apply because the fabricated claim that the water supply is contaminated is a false statement of fact communicated online in Singapore. A factual statement can be proven true or false, whereas an opinion is a subjective judgement. A POFMA direction also requires the public-interest condition to be satisfied.

(iii) POHA
Marker feedback: ⚠️ Correct law, but explain the trigger: publishing the classmate’s address with the intent to frighten them and encourage threats makes harassment or doxxing under POHA relevant.
Correct solution: (iii) POHA: publishing the classmate’s identifying information to frighten them and encourage threats makes harassment or doxxing relevant.

(iv) PDPA
Marker feedback: ⚠️ Correct law, but explain the trigger and action: the retailer is collecting identifiable customer data without stating its purpose, so the Notification obligation requires it to inform customers why the data is collected, used or disclosed.
Correct solution: (iv) PDPA—Notification: the retailer collects identifiable customer details without explaining why, so it should inform customers of the purposes for collecting, using or disclosing their data.

01F — original, balanced impact. A factory introduces networked sensors that schedule maintenance automatically. Explain one economic benefit and one cost, then recommend one action supporting affected workers. Use a causal chain rather than three labels.
Economic benefit - Improve efficiency and productivity in maintaining factory items
Marker feedback: ⚠️ Relevant idea, but it is too general and lacks the requested causal chain. For example: sensors detect wear early → maintenance is scheduled before breakdowns → downtime and lost production are reduced.
Correct solution: The sensors detect equipment wear early, allowing maintenance to be scheduled before a breakdown; this reduces downtime and lost production, improving productivity.

One action - provide upskilling or reskilling lessons for affected workers
Marker feedback: ✅ Suitable recommendation. Make it specific by training workers to interpret sensor alerts and maintain the new system. ❌ The required economic cost is missing; installing the sensors and training employees create additional costs.
Correct solution: Purchasing and installing the sensors and training employees create additional costs. The factory should train affected workers to interpret sensor alerts and maintain the new system so that they can move into the changed roles.

Revision checklist

• 01.1 Distinguish social, ethical, legal and economic issues in the same scenario.
• 01.2 Identify affected stakeholders and explain both benefits and harms with a causal link.
• 01.3 Apply professional conduct to privacy, authorisation, honesty, competence, fairness and responsible resource use.
• 01.4 Name CMA, POFMA, POHA and PDPA correctly and select which may apply to a scenario.
• 01.5 Explain the relevant action or condition that connects the scenario to the selected law.
• 01.6 Distinguish an ethical concern from a legal conclusion; recognise that more than one law may be relevant.
• 01.7 Identify personal data in context, including data that identifies someone when combined with other information.
• 01.8 Apply the relevant PDPA obligations to collection, use, disclosure, protection, retention and a breach scenario.
• 01.9 Write a balanced scenario answer: action → affected stakeholder → principle/law → consequence → justified response.

Visual revision mindmap

Open this mindmap and its text version · All 21 mindmaps

Your mindmap framework

Centre: Ethics, impact and laws. Build the six branches below. For each subbranch, add a short definition, a labelled sample and one exam trap from memory; then check the chapter.

flowchart LR
    C["01 • Revision map"]
    C --> B0["Four impact perspectives"]
    C --> B1["Stakeholders and evaluation"]
    C --> B2["Professional conduct"]
    C --> B3["Law selection"]
    C --> B4["Personal data and duties"]
    C --> B5["Exam application"]

• Four impact perspectives

  • Social: communication, digital divide, accessibility, wellbeing.
  • Ethical: privacy, fairness, intellectual property, accountability.
  • Legal: relevant law and triggering facts.
  • Economic: productivity, jobs, reskilling, costs, Industry 4.0.

• Stakeholders and evaluation

  • Identify who benefits and who bears the cost.
  • Draw action → mechanism → consequence.
  • Compare short-term and longer-term effects.
  • Recommend an action linked to the identified harm.

• Professional conduct

  • Integrity: honesty, impartiality, confidentiality, attribution.
  • Full responsibility: consequences, risks, limitations.
  • Competence: skills, knowledge, continued learning.
  • Professionalism: standards and responsible expertise.

• Law selection

  • CMA: authorisation, access, modification, interference.
  • POFMA: online false statement of fact; public-interest condition for directions.
  • POHA: harassment, threats, stalking, doxxing; relevant conditions.
  • PDPA: organisations handling identifiable personal data.

• Personal data and duties

  • Identifiability: alone or with other accessible information.
  • Accountability, Notification, Consent, Purpose Limitation.
  • Accuracy, Protection, Retention Limitation, Transfer Limitation.
  • Access & Correction, Breach Notification; Portability with commencement qualification.

• Exam application

  • Separate notification from consent and protection from breach notification.
  • Give one concrete action per selected obligation.
  • Draw a monitoring or customer-database scenario with affected people.
  • Avoid: every ethical concern is illegal; all eleven headings already operative.

Close the notes and test the map: explain one branch aloud, sketch its sample, then answer a linked practice question. Mark any missing link to revisit.

Source trail

9569 §§5.1.1–5.1.3; §5.3.1. School Ethics combined PDF; your Ethics folder.

HCI 2022 Q4(c)(ii), Q5(f–g); 2023 Q2(c); 2024 Q3(c), Q5(g–h); 2025 Q3(a), Q5(f).

Source guide records provenance and original-paper locations.