Social Implications: Law, Ethics, Security and Wellbeing
Social implications tests the legal, ethical, security, health and environmental consequences of ICT use, with Hong Kong law and real scenarios. Questions often ask you to apply a principle to a school, business or social-media case.
Privacy and data protection
The Personal Data (Privacy) Ordinance (PDPO) governs personal data in Hong Kong through six data protection principles: (1) lawful and fair collection for a purpose directly related to the data user's functions, with data adequate but not excessive; (2) accuracy and retention no longer than necessary; (3) use limited to the stated purpose or a consented purpose; (4) security against unauthorised or accidental access, loss or use; (5) openness about policies and practices; (6) access and correction rights for data subjects. Privacy is about controlling personal information; security is about protecting it.
Intellectual property and computer crime
The Copyright Ordinance protects the expression of ideas, not the ideas themselves. Software licensing includes proprietary, open-source, freeware and shareware; open source is still copyrighted and governed by a licence. Computer-related offences include unauthorised access, malware, phishing, denial-of-service attacks and identity theft. The PDPO was amended in 2021 to criminalise doxxing, and other offences can apply to cyberbullying.
Health, safety and environment
Ergonomics reduces risks such as repetitive strain injury, back pain and computer vision syndrome: adjustable chairs, monitors at eye level, wrist support, breaks and adequate lighting. E-waste contains toxic materials; recycling and extended producer responsibility reduce harm, while data centres consume significant energy.
Worked example
A school collects names, ID numbers and medical notes for a camping trip through a cloud form. Under DPP1, medical notes are sensitive but can be justified for safety if adequate and not excessive. DPP3 limits use to trip safety, not marketing. DPP4 requires access control and encryption. DPP2 requires deletion after the trip. DPP5 requires a privacy policy, and DPP6 lets students check and correct their data.
Traps
Do not treat privacy and security as the same. Copyright protects expression, not facts or ideas; open source does not mean copyright-free. 'Publicly visible' does not mean free to reuse. The PDPO has six principles, not five, and data subjects have access and correction rights.