GCSE (9-1) Computer Science
Mark Scheme
J277/01: Unit 1.6 Data Protection Act
Question Answer Marks Guidance
1 Any three from:
  • Lawfulness, fairness, and transparency.
  • Purpose limitation.
  • Data minimisation.
  • Accuracy.
  • Storage limitation.
  • Integrity and confidentiality (Security).
 3
Examiner Note: Candidates must use accurate terminology. "Security" or "Integrity and Confidentiality" is required.
2 Any two from:
  • The right to be informed.
  • The right of access (to see the data held).
  • The right to rectification (to correct wrong data).
  • The right to erasure (the 'right to be forgotten').
  • The right to restrict processing.
  • The right to data portability.
 2
"The right to delete data" is acceptable for erasure.
3a Any one from:
  • Religion / Ethnicity / Political Opinions / Biometric data / Genetics / Sexual orientation.
 1
Reject: "Password" or "Bank details". DPA definitions focus on discrimination risks.
3b
  • A data breach at a hospital could cause significant harm or distress (discrimination/health implications) (1).
  • Therefore, stronger encryption/access controls are legally required compared to low-risk email lists (1).
 2
Must link nature of data to breach impact.
4 Explanation (Max 2):
  • Data must not be kept for longer than is necessary (1).
  • Once the member leaves the youth club, their data is no longer needed (1).
Practical Step (Max 1):
  • Regularly review the database to delete old records / set up an automatic deletion policy (1).
 3
Reject: "Storage Capacity" answers. This is about time.
5a Integrity and confidentiality (Security). 1
Accept "Security".
5b Any two pairs from:
  • Fines: The Information Commissioner's Office (ICO) can issue large fines (1) impacting the school budget (1).
  • Reputation: Parents may lose trust in the school (1) and complain or move students (1).
  • Compensation: Parents could sue for distress (1) leading to legal costs (1).
 4
6
  • The data was collected for the purpose of weather updates (1).
  • Selling it for advertising is a different purpose that was not consented to (1).
 2
7* Indicative Content:
Legal Issues (DPA 2018):
  • Transparency: Users must be told about facial recognition.
  • Minimisation: Is scanning faces excessive?
  • Security: Biometric data (faces) is sensitive; risk if hacked.
Ethical/Privacy Issues:
  • Invasion of Privacy: Tracking/tagging without explicit intent.
  • Consent: Issue of people appearing in background photos.
  • Trust: "Surveillance" feel.

Marking Levels:
Level 3 (6–8 marks): Detailed discussion of Legal and Ethical. Technical terms used correctly. Sustained reasoning.
Level 2 (3–5 marks): Discusses both areas but generic detail. Reasoning present but lacks depth.
Level 1 (1–2 marks): Basic points. Unstructured response. 		8
Assesses quality of written communication.
OCR 2026