CDEP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Data ethics definition

The systematic study of what is right and wrong in how data is collected, processed, shared, and used, going beyond legal compliance to consider harms, rights, and fairness.

Beneficence and non-maleficence

Beneficence is the duty to produce benefit; non-maleficence is the duty to avoid harm. In data projects, both must be assessed for every affected stakeholder group.

Respect for autonomy

The ethical principle that people should control decisions about their own data, expressed through informed consent, opt-outs, and the ability to withdraw participation without penalty.

Justice in data ethics

The principle that benefits and burdens of data use should be distributed fairly, so no group bears disproportionate risk or is excluded from benefits without justification.

Lawful versus ethical

Legality is the minimum standard set by statute; ethics asks whether an action is right even when permitted. A lawful practice, such as manipulative profiling, can still be unethical.

Ethical impact assessment

A structured pre-deployment review that identifies stakeholders, maps harms and benefits, checks consent and rights, and documents why a data use is justified.

Contextual integrity

The theory that information flows are appropriate only when they match the norms of the context in which data was shared; moving data to a new context requires new justification.

Informed consent elements

Valid consent requires capacity, clear disclosure of purposes and risks, voluntariness free of coercion, and comprehension by the person giving it.

Purpose limitation

Personal data should be collected for specified, explicit purposes and not reused for incompatible purposes without a new lawful basis or fresh consent.

Data minimization

Only collect and retain fields that are necessary for the stated purpose; extra data increases breach exposure, misuse risk, and compliance burden without adding value.

Dark patterns in consent

Interface designs such as pre-checked boxes, confusing toggles, or nagging that steer users toward sharing data, undermining voluntariness and invalidating consent.

Proxy variables

Seemingly neutral features like postal code or browsing history that correlate with protected traits and can therefore transmit discrimination into models.

Secondary data use

Using data for a purpose other than the one it was originally collected for; requires de-identification, fresh consent, or ethics review when re-consent is impractical.

Right to withdraw

The ability to revoke consent as easily as it was given; because trained models may retain influence, this limitation must be disclosed at collection time.

Synthetic data risks

Artificially generated records can still leak information about training individuals through membership inference and can reproduce the biases of their source data.

Personal data

Any information relating to an identified or identifiable natural person, where identifiability depends on the means reasonably likely to be used to single out or link a person.

Pseudonymization

Replacing identifiers with codes while keeping a separate key; the data remains personal because re-identification is still possible with the key.

Anonymization

Irreversibly removing identifiability so that no person can be singled out, linked, or inferred under reasonable effort; such data falls outside personal-data rules.

GDPR data subject rights

Access, rectification, erasure, restriction, portability, objection, and protections against solely automated decisions with significant effects.

Breach notification timeline

Under GDPR, notify the supervisory authority within 72 hours of becoming aware of a breach that poses risk, and inform affected individuals when risk is high.

CIA triad

Confidentiality, integrity, and availability: the three security goals. Controls such as encryption, hashing, and redundancy each map to one or more of them.

Defense in depth

A layered security strategy combining least privilege, multi-factor authentication, encryption, segmentation, logging, and patching so no single failure exposes the system.

Cross-border transfer safeguards

Mechanisms such as adequacy decisions, standard contractual clauses, or binding corporate rules that legitimize moving personal data to another jurisdiction.

Privacy by design

Embedding privacy protections into system architecture and default settings, such as opt-in sharing and minimal retention, rather than adding them after deployment.

Data governance roles

Data owners are accountable for a domain, stewards manage quality and definitions, and custodians implement technical controls; separation prevents conflicts of interest.

Model risk management

A lifecycle program that inventories models, assigns risk tiers, validates independently, monitors drift, and requires human sign-off for high-impact decisions.

Historical bias

Bias that enters data because the world itself reflects past inequity; a model trained on such records learns and can amplify those patterns.

Sampling bias

Distortion caused when the collected data is not representative of the population the model will serve, often from convenience sampling or missing groups.

Label bias

Error or prejudice introduced when humans or proxies assign target labels, such as arrest records standing in for criminality or biased ratings standing in for performance.

Demographic parity

A fairness criterion requiring equal positive-decision rates across groups; it ignores base rates and can conflict with equalized odds and calibration.

Equalized odds

A fairness criterion requiring equal true-positive and false-positive rates across groups, so errors are distributed evenly rather than outcomes.

Algorithmic accountability

The governance requirement that a named human or role can be held responsible for a system's outcomes, supported by audit trails and documented decisions.