Community resourceWorksheet
1CP2-P-10.4 Privacy ownership misuse and data protection
Part 4 of 5 · 1CP2-P-10 · AI, personal data and ethical/legal issues
Privacy concerns a person's control and reasonable expectations around information and life. Data use can raise ethical questions about ownership or control and legal duties about processing. UK data-protection teaching at GCSE should focus on stable principles, not statute sections or volatile procedural detail.
Students will:
- distinguish privacy, ownership, misuse and legal duties
- apply stable data-protection principles across a lifecycle
- separate ethical concerns from legal requirements
- audit and improve a fictional data practice
Inside: 6 explanation cells, 1 fill-in-the-blanks cell, 2 multiple-choice questions and 3 written answers. 14 marks, about 45 minutes.
Series: 1CP2-P-10 · AI, personal data and ethical/legal issues, part 4 of 5.
Shared by Coding PathwayVerified teacher
- 12 cells
- About 45 minutes
- CC BY-SA 4.0
- Shared 17 Aug 2026
Preview
The whole resource, exactly as a class sees it. Answers and marking are held back.
Privacy ownership misuse and data protection
Privacy concerns a person's control and reasonable expectations around information and life. Data use can raise ethical questions about ownership or control and legal duties about processing. UK data-protection teaching at GCSE should focus on stable principles, not statute sections or volatile procedural detail.
1. Build an accurate model
Usable principles include lawful, fair and transparent processing; specified purpose; data minimisation; accuracy; storage limitation; security; and accountability. Representative rights include being informed, access, correction and erasure in appropriate circumstances. Erasure is not unconditional when another valid duty requires retention.
- accuracy
- minimisation
- security
Which behaviour best follows purpose limitation?
- AUse attendance data secretly for unrelated advertising
- BUse attendance data only for the clearly stated attendance purpose unless a valid new basis and transparency apply
- CKeep all data forever
- DShare it with everyone
2. Worked application
A sports club collects emergency contacts for safety. It should collect relevant contact details, keep them accurate and secure, restrict access, explain use, and delete them when no longer needed unless a valid reason remains. Selling them for advertising would be a different and unexpected purpose.
Explain how keeping inaccurate allergy information could harm a member and identify the relevant principle.
Link record error to action and consequence.
Students type their answer here.
A school keeps former pupils' routine contact data indefinitely. Recommend a correction and explain why.
Apply storage limitation and any necessary exceptions carefully.
Students type their answer here.
3. Apply to the stated people and system
Name the input or data, the processing or decision, the affected stakeholder and the resulting effect. Avoid claims that could fit any technology.
Distinguish one ethical concern from one legal/data-protection duty when an app shares location data.
Give a specific example of each.
Students type their answer here.
Which statement is accurate?
- AConsent is the only possible lawful basis
- BData protection means never collecting data
- CRemoving a name always guarantees anonymity
- DPeople may have rights to information, access and correction
Examination method
For Explain, link cause and consequence. For Discuss, consider more than one aspect, apply each point to the scenario and reach a conclusion supported by the evidence.
Route forward
The final checkpoint combines AI mechanisms, stakeholder impacts and personal-data principles in examination-style reasoning.