Regulatory and Legal Landscape for Data Ethics
Candidates must recognize the major legal frameworks and their core principles without treating any single statute as universal. Know the GDPR pillars - lawful basis, purpose limitation, data minimization, storage limitation, accuracy, integrity/confidentiality, accountability, data-subject rights (access, rectification, erasure, portability, objection), and the special treatment of sensitive data. Know the CCPA/CPRA model (consumer rights to know, delete, correct, opt out of sale/sharing, and non-discrimination) and its distinction from GDPR's consent-centric approach. Recognize sector rules (HIPAA for health, FERPA for education, GLBA for finance, COPPA for children) and emerging AI-specific regulation (risk-based obligations, transparency, and impact assessments).
Traps: (1) applying one jurisdiction's rules globally - obligations depend on where data subjects are and where processing occurs; (2) confusing opt-in (GDPR-style consent) with opt-out (CCPA-style sale opt-out); (3) assuming a lawful basis under one law satisfies another; (4) overlooking cross-border transfer restrictions and data-subject rights deadlines; (5) treating regulation as static - AI rules are evolving, so answers should reflect principles, not just statute names.
Rule of thumb: identify the jurisdiction, data type, and data-subject population first; these three facts usually determine which regime applies and which rights and bases are available.
Worked example: A US company processes EU residents' health data. GDPR applies (data-subject location), health data is special-category (requiring an elevated basis), and HIPAA may also apply if the entity is a covered health provider - so both regimes shape the answer.