GROUP ASSIGNMENT

TOPIC 2: LEGAL ASPECTS OF INFORMATION SECURITY

A Critical and Comprehensive Summary

Course: CIVE

Submission Date: 5th May 2026

GROUP MEMBERS

Each member must write their own name and sign in the box assigned to them.

Role Full Name (Handwritten) Signature

Group Leader

Member 2

Member 3

Member 4

Member 5

Member 6

Member 7

Member 8
 LEGAL ASPECTS OF INFORMATION SECURITY: A CRITICAL AND
COMPREHENSIVE SUMMARY

1. Introduction: Information Security as a Legal Imperative

Information security is no longer a purely technical discipline confined to firewalls, encryption,
and system administration. It has evolved into a complex legal imperative that intersects
governance, human rights, and international law. At its core, information security is guided by
the CIA Triad Confidentiality, Integrity, and Availability which provides the framework for
assessing how data must be protected from unauthorized access, alteration, and disruption. The
law enforces these principles by establishing rights, obligations, and penalties for their breach.

A critical challenge in this legal landscape is the transient and fragile nature of digital evidence.
Unlike physical evidence, digital data can be easily altered, deleted, or corrupted, complicating
both criminal investigation and civil litigation. Furthermore, the global nature of the internet
creates serious jurisdictional ambiguities: a cyberattack may originate in one country, route
through servers in a second, and cause harm in a third raising profound questions about which
state's laws apply and which courts have competence. These structural challenges make a
coherent and comprehensive legal framework not merely desirable but essential.

2. Technology, Surveillance, and Individual Privacy

The rapid advancement of information and communication technology (ICT) has created what
scholars and policymakers describe as a 'surveillance society' a social environment in which the
movements, communications, and behaviours of individuals are systematically monitored by
both state and private actors. Surveillance technologies including CCTV networks, internet
traffic monitoring, GPS tracking, and social media analytics are now capable of constructing
detailed profiles of individuals without their knowledge or consent. The law must therefore strike
a delicate and continuously renegotiated balance between enabling legitimate surveillance for
security purposes and protecting individuals from arbitrary or disproportionate intrusion.

Privacy is legally understood as the protection of situations in which an obligation of confidence

arises between a data collector and a data subject. This right is enshrined in foundational
international instruments: Article 17 of the International Covenant on Civil and Political Rights
(ICCPR), Article 8 of the European Convention on Human Rights (ECHR), and Article 12 of the
Universal Declaration of Human Rights (UDHR). For any surveillance measure to be legally
valid under these frameworks, it must satisfy a three-part test: it must be prescribed by law
(legality); it must serve a legitimate aim such as national security or crime prevention; and it
must be necessary and proportionate to that aim.

A critical evaluation of modern surveillance practice reveals significant tensions with these
principles. Mass bulk data collection programmes exposed by whistleblowers and litigated in
cases such as Privacy International v Secretary of State have struggled to meet the
proportionality requirement. The law has responded through several mechanisms: data
minimisation principles require that only the data strictly necessary for a stated purpose be
collected; privacy-aware AI development frameworks seek to eliminate discriminatory or biased
automated decision-making; and accountability norms affirm that data subjects retain the right to
control how their information is used unless a compelling public interest overrides it. Critically,
however, enforcement of these rights remains uneven, particularly in jurisdictions where judicial
oversight of intelligence agencies is limited or opaque.

3. Data Protection and Trans-border Data Flows

Data protection law constitutes one of the most developed and rapidly evolving areas of
information security law. Its central concern is regulating the processing, storage, and
transmission of personal data defined as any information relating to an identified or identifiable
natural person. The foundational principles of data protection include: lawfulness and fairness of
processing; purpose limitation (data may only be used for the specific purpose for which it was
collected); data minimisation; accuracy; storage limitation; and the twin requirements of integrity
and confidentiality.

The General Data Protection Regulation (GDPR), which came into force in the European Union
in 2018, represents the most comprehensive and globally influential data protection framework
to date. The GDPR significantly strengthened individual rights including the right to access one's
data, the right to erasure ('right to be forgotten'), the right to data portability, and the right to
object to automated decision-making while imposing substantial obligations on data controllers
and processors, including mandatory breach notification within 72 hours of discovery. Non-
compliance can attract fines of up to four percent of global annual turnover, giving the regulation
substantial deterrent force.

Trans-border data flows (TDF) present a particularly acute legal challenge. Data routinely moves
across jurisdictions with differing levels of legal protection, creating risks of regulatory arbitrage
where entities deliberately route data through jurisdictions with weaker protections to avoid
compliance obligations. The law addresses this through several mechanisms: adequacy decisions
(where the European Commission recognises a third country as offering comparable protection);
Standard Contractual Clauses (SCCs) imposed between parties; and Binding Corporate Rules
(BCRs) adopted by multinational corporations as internal governance frameworks. The landmark
European Court of Justice decisions in Schrems I (2015) and Schrems II (2020) invalidated
successive EU-US data transfer frameworks on the grounds of inadequate protection from US
intelligence surveillance, demonstrating that trans-border data flow regulation is dynamic and
responsive to changes in state surveillance practice. Some states most notably Russia and China
have responded to these tensions by enacting data localisation laws requiring that certain
categories of data be stored exclusively on domestic servers.

4. Computer and Cyber Crimes

The criminalisation of computer-related conduct represents the enforcement edge of information
security law. Cybercrime encompasses a broad and expanding range of offences, all of which
share the common characteristic of exploiting ICT infrastructure either as the target, the tool, or
the arena of criminal activity. The principal categories of cybercrime recognised in both
domestic legislation and international instruments include: hacking and unauthorised access to
computer systems; malware and ransomware deployment malicious code that damages,
destroys, or encrypts data and demands payment for restoration; phishing and social engineering,
which manipulate users into disclosing sensitive credentials; identity theft, involving the
fraudulent use of another person's personal information; and Denial-of-Service (DoS) attacks,
which overwhelm networks with traffic to disrupt legitimate access.

Legal responses to cybercrime operate at both national and international levels. Domestically,
most jurisdictions have enacted dedicated computer crime statutes including the Computer Fraud
and Abuse Act (CFAA) in the United States, the Computer Misuse Act 1990 in the United
Kingdom, the Cybercrimes Act 2015 in Tanzania, and Kenya's Computer Misuse and
Cybercrimes Act 2018. These laws criminalise unauthorised access, interception of data, and the
creation or distribution of malicious software, and provide for both criminal prosecution and civil
liability. Electronic Transaction Statutes such as the US Electronic Signatures in Global and
National Commerce Act (E-SIGN) and the Uniform Electronic Transactions Act (UETA) impose
additional requirements on the secure storage and authentication of electronic transactions.

At the international level, the Budapest Convention on Cybercrime (2001) negotiated through the
Council of Europe but open to non-member states remains the primary multilateral instrument. It
harmonises substantive cybercrime law, establishes procedural rules for digital evidence
gathering, and provides a framework for mutual legal assistance (MLAT) between signatory
states. However, jurisdictional complexity remains the greatest structural challenge: because
cybercrime transcends national borders, determining which state has jurisdiction to prosecute,
and ensuring that digital evidence gathered abroad is admissible in domestic proceedings,
requires intensive international cooperation that is often slow and politically fraught. Corporate
liability management through incident response planning, cyber insurance, and contractual
limitation of liability has emerged as a parallel private law response to the risk of major data
breaches.

5. Critical Assessment and Conclusion

A comprehensive survey of the legal framework for information security reveals both significant
achievements and persistent limitations. On the positive side, international human rights law
provides a principled foundation for privacy protection; the GDPR has set a global standard for
data protection that has influenced legislation far beyond the EU; and international instruments
like the Budapest Convention have established a starting point for cross-border cybercrime
cooperation. These developments represent a genuine legal infrastructure for the governance of
information security.

However, critical gaps remain. Enforcement is deeply uneven across jurisdictions, particularly in
developing nations where legislative frameworks lag behind technological realities and
enforcement capacity is limited. The tension between state surveillance imperatives and
individual privacy rights has not been satisfactorily resolved, and the adequacy of oversight
mechanisms for intelligence agencies remains contested. The pace of technological change from
artificial intelligence to quantum computing consistently outstrips the ability of law to adapt.
Trans-border data flow regimes remain fragile and subject to disruption by geopolitical
developments. Finally, liability frameworks for major breaches are often inadequate to provide
meaningful redress to affected individuals.

In conclusion, legal aspects of information security demand an integrated approach combining

robust domestic legislation, meaningful international cooperation, strong independent oversight,
and a genuine commitment to upholding individual rights in the digital environment. Technical
solutions alone are insufficient; the law must keep pace with the technology it seeks to govern.
References
1. International Covenant on Civil and Political Rights (ICCPR), Article 17, United Nations,
1966.

2. European Convention on Human Rights (ECHR), Article 8, Council of Europe, 1950.

3. General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, European Parliament
and Council.

4. Budapest Convention on Cybercrime, Council of Europe, ETS No. 185, 2001.

5. UN Special Rapporteur on the Right to Privacy, Report A/HRC/29/32, United Nations Human
Rights Council, 2015.

6. Court of Justice of the European Union, Schrems II, Case C-311/18, 2020.