Exam practice

The rationale of a law is the reason it exists: the harm it is meant to prevent or the right it is meant to protect.

1. The problem: what harm does it prevent, or what right does it protect?
2. Who gains, who pays: whom does it protect, and who carries its cost in money, time or freedom?
3. Clear: can an ordinary person tell what is allowed and what isn’t?
4. Enforced: can it really be enforced, and is it?
5. Proportionate: does it go only as far as the problem needs, with costs that fit the harm?

Its two jobs: it makes electronic records and digital signatures count in law (and sets up the Controller of Certification and certifying authorities), and it names and punishes crimes involving computers.
Offenses (any four):

• Unauthorized access (s. 45): logging in to someone’s account without permission.
• Damaging data (s. 46): deleting a company’s records to cause it a loss; ransomware.
• Publishing banned material (s. 47): posting material that spreads hatred against a community.
• Computer fraud (s. 52): taking money from someone’s account with stolen logins, or with a found ATM card.
• Stealing or destroying source code (s. 44) that the law says must be kept.
• Breaking confidentiality (s. 48): an official revealing records seen in their work under the Act.
• Helping or trying to commit one (s. 53).

Any three, for example:

• Your messages and emails are private (ss. 13–14): nobody may read, forward or publish them without permission. Example: a brother may not read his sister’s email, even if she left it open.
• Your calls may not be recorded without consent or a legal order (s. 19). Example: secretly recording a friend’s call and posting it is an offense.
• Your picture is protected (s. 16): no one may take your photo to damage your reputation, join it with another picture to insult you, or sell it without consent. Example: a mocking edited photo of a classmate shared in a group chat.
• Cameras are limited (s. 20): CCTV in public places with a notice, never in toilets, bathrooms or changing rooms.
• Under 18, a guardian decides (s. 33): a coaching center needs a parent’s consent to advertise with a student’s photo and marks.
• You can claim compensation (s. 31) and complain to the District Court within three months (s. 30).

No. Nepal’s Act gives real rights, but in practice it protects less:

• No independent office: the EU has data protection authorities that check companies and act on complaints; in Nepal a person must go to court themselves, within three months. Many harms are never noticed or brought to court.
• Small fines: the GDPR can fine up to €20 million or 4% of worldwide yearly income; Nepal’s Act, Rs 30,000. A big company won’t change its ways for a small fine.
• No duty to report a leak: under the GDPR, a leak must be reported to the regulator within 72 hours, and to the people when they are at high risk. In Nepal, people may never learn their data was taken.
• (Also: the GDPR gives rights to see and delete one’s data, which Nepal’s Act doesn’t give in general.)

Each matters because rights protect people only if someone checks that they are respected, and if breaking them costs more than obeying.

For: People whose data leaks can protect themselves only if they know: change passwords, warn their bank, watch for scam calls that use their details. Today, nothing in Nepal’s law makes a company tell them, as the customers of Foodmandu found in 2020. A duty to report also makes companies take security seriously, because a leak becomes public. The EU’s GDPR has required this since 2018, and companies there have managed.
Against (or for caution): Three days may be too short for a small company to find out what was taken, and a hasty, wrong notice can cause panic. Nepal has no office yet to receive the reports and check them, so the rule could go unenforced. It could also be argued that a smaller first step, such as reporting to Nepal Police’s Cyber Bureau, is more realistic. A fair answer might accept the rule, with a little longer for small companies and an office to enforce it.

Copyright protects the expression, the particular code someone wrote, not the idea or method behind it (Copyright Act, s. 4). Merge sort is an idea: anyone may write their own merge sort. But copying another person’s merge sort program, line for line, copies their expression, and even changing the variable names leaves it a copy.
The law protects expression so that people are rewarded for the work of writing, while ideas, which everyone builds on, stay free. If ideas could be owned, nobody else could use binary search or a loop, and computing could hardly grow.

No, not as it is. Copyright starts by itself, with no notice needed, and without a license every right stays with the writer: Sanjay may read the code, but not copy it into an app he shares.
He can: ask the writer for permission (and credit them in the code, beside the function, and on the app’s credits screen); find the same thing in a library with a license that allows his use; or write his own function from the idea, which copyright doesn’t protect.

For example:

# rainfall_chart.py: draws a chart of monthly rainfall in Pokhara# Copyright 2026 Anisha Gurung, Grade 9# License: MIT (see LICENSE)## Credits:# - Rainfall data: from <the website's name and address>, downloaded on#   <date>; its license: <the license given there>.# - draw_bars() is adapted from "Bar charts" by Prakash Shah (Grade 9),#   used with his permission. Changed: the bars are labeled with months.

It names the file’s author, year and license; names each borrowed part, its author, where it came from, its license or permission, and what was changed. (A full answer may also mention AI help, if any was used.)

Every algorithm that ranks or chooses has to be told what to count and how much. That choice, what it optimizes, is not arithmetic; it is a judgment about what matters, made by people, and it decides who wins for everyone the algorithm is used on. Those are its values.
Example: ranking applicants for a scholarship. Ranking by marks alone values achievement, but rewards students who had books and tuition at home; ranking by need values fairness to the poor, but may pass over a student who worked hardest. A school must choose, and parents of the students who lose out may disagree. (Other good examples: the civil service’s reserved posts, which value bringing in groups long left out, debated by those who think only exam rank should count; a ride app’s rush-hour prices, which value balancing supply and demand, disliked by people who can’t pay.)

1. It learns from biased past decisions. A model learns whatever pattern is in its training data. Example: a hiring model trained on a company’s past hiring, when the company mostly hired men, learns to prefer men.
2. Proxies. Even if a sensitive feature, such as caste or gender, is left out, other features can stand in for it. Example: a loan model that uses a person’s district or address may treat a group unfairly, because where people live is linked to their caste or wealth.

(Also accepted: data that is not representative, such as a face or voice model trained mostly on one group, which then works worse for others.)

For example, the European Union has one law for all AI, the AI Act, which sorts systems by risk: a few uses are banned (such as scoring citizens for their behavior), high-risk uses (jobs, education, loans) must be tested, use good data, keep records and have a person in charge, and AI that talks to people or makes realistic pictures must say so. The United States has no national AI law: AI falls under existing laws against discrimination and fraud, orders from the President, and state laws like Colorado’s.
The EU protects people better, because its rules are the same everywhere, are fixed in law, and are strict where AI decides about people’s lives. (A good answer might also say the cost: the US approach makes it easier for new companies to build AI, and the EU’s rules are slow and costly to follow. Any view, backed by a reason, can be right.)

Aim: platforms with a contact person and a complaints officer in Nepal, so that victims of scams, harassment and fake accounts have someone to turn to. This is a real problem (question 1), and the rule was clear about what platforms had to do (question 3).
Method: when platforms didn’t register, the government’s strongest tool was to block them (question 4), and the cost fell on millions of users who had done nothing wrong: families talking to relatives abroad, students, small businesses (question 2). Many judged that blocking 26 platforms for everyone at once went further than the problem needed, although the platforms had had almost two years to register (question 5). And the rule was made as a directive, not as an Act debated in Parliament.
Conclusion (one fair view): a reasonable aim, enforced in a way whose cost fell mostly on people who had done nothing wrong. A better rule might have been an Act of Parliament, with fines on the companies rather than blocks on the users, and a long, clear timetable. Any conclusion backed by reasons and facts can earn full marks.