communicating your purpose
Do people understand your purpose – especially people whom the data is about or who are impacted by its use?
How have you been communicating your purpose? Has this communication been clear?
How are you ensuring more vulnerable individuals or groups understand?
Strategy
Set strategic goals to achieve this vision, addressing the far-reaching nature of the current challenges and ensuring data ethics are enforceable, embedded in the organisational culture, continuously applied and improved.
Big Data and AI Executive Survey 2021
Compliance should not be seen as a checklist-ticking task
Mere compliance with each of the GPDR and other data protection laws’ provisions is not sufficient for future-proof and technology-responsive privacy policies. Instead, data protection services should be tailored to identify present and future shortcomings in the technological design and application so that data controllers and processors take all the necessary steps to mitigate potential risks for breaching the GDPR. On top of this, ethics accentuates the role of public trust, engagement, transparency and accountability so that data processing meets both the legal requirements and privacy expectations of the public.
Data protection law and ethics
Conduct a risk-benefit analysis
Ensuring proportionality in data processing is a fundamental tenet in data protection law. Not only data processing should be based on an appropriate lawful ground under the GDPR, but it should also be proportionate. This means that the anticipated advantages should outweigh the potential risks for data subjects. Moreover, proportionality requires that any data processing activity is carried out in the least intrusive manner for subjects. These assessments require a consideration and evaluation of societal and ethical parameters.
Data protection law and ethics
Conduct risk-management assessments
A risk-based approach is endemic to the GDPR, because every data processing activity inherently carries risks for the rights and freedoms of data subjects. Technology may raise concerns about the efficiency and applicability of data protection law. This means that compliance with the GDPR requirements and standards is a continuous obligation and that there is no such thing as static and pre-fixed compliance. With regard to the use of Artificial Intelligence, ethical assessments are necessary to ensure the safe application of AI-based technologies, whose consequences are not always predictable.
Data protection law and ethics
Understand the benefits, challenges and limitations of technology
Whereas technology radically transforms society and the available services and products, regulators are often a step behind technologies. Therefore, given the regulatory challenges that new technologies raise, organisations should have the necessary resources to bring insights from industry, academia and the public sector and combine the knowledge and resources across sectors to design both the best data protection and research practices. Indeed, it is necessary that organisations analyse and anticipate gaps in privacy policies and specify the policy and regulatory action to be taken to proactively comply with the GDPR. In this regard, organisations should review the current state of the art and anticipate necessary compliance requirements on an ongoing basis, taking into account the legal, societal and ethical parameters of technology. This will enable organisations to design ethics-grounded data protection operations and align their privacy policies with the GDPR.
Data protection law and ethics
Actively demonstrate ethics
Given the profound connection between a company’s ethical culture and employee engagement, managers and supervisors should work actively to demonstrate a commitment to ethics, foster open communication, promote ethical role modeling, and encourage accountability.
2009 National Business Ethics Survey
The work environment
Higher levels of misconduct and greater perceived pressure to commit a violation equate with lower levels of employee engagement. Therefore, in order to maintain high levels of employee engagement, leaders need not only to set an example but to carefully monitor and manage compliance with corporate ethics standards. All levels of management should be careful not to create work environments where employees perceive that hitting deadlines and meeting revenue goals are the priority regardless of how those goals are achieved.
2009 National Business Ethics Survey
Continuous evaluation
Continuous evaluation - ask yourself and the team: At the beginning of the project: ‘are we doing the right thing?’ During the project: ‘have we designed it well?’ After the project: ‘is it still doing the right thing we designed it for?’ How have you evaluated the project? Evaluation techniques you might use include holding retrospective roundtables at the end of the project; inviting an external expert or a ‘critical friend’ from a different team to observe and evaluate the project; request external consultations or audits Gov.uk Data ethics framework
Ethical IT strategy
Consider how the implementation of the AI and big data systems ethics guidelines, and other IT-related ethics guidelines, affects the various dimensions of IT management strategy, including overall objectives, quality management, portfolio management, risk management, data management, enterprise architecture management, stakeholder relationship management. Ensure proper adjustment of these processes. There will be different levels of risk involved, depending upon the application, so the levels of risk need to be clearly articulated to allow different responses from the organisation’s ethical protocols.
Guidelines for the Ethical Use of AI and Big Data Systems