CDEP study plan

Define the core vocabulary of data ethics (values, norms, moral vs. legal obligation) in your own words and record each term with a one-sentence definition.

Distinguish consequentialist, deontological, and virtue-ethics reasoning by applying each to the same short data-use scenario.

Map the four exam domains to your current knowledge, rating each subarea as strong, shaky, or unknown.

Identify three real public controversies in data ethics and state which ethical framework best explains the objection raised.

Explain how informed consent, autonomy, and respect for persons interact when data subjects cannot realistically opt out.

Compare stakeholder-analysis and harm-benefit approaches by writing out both for a single data-sharing decision.

Articulate the difference between ethical duty, regulatory compliance, and reputational risk, with one example of each diverging.

Draft counterarguments to the claim that anonymized data carries no ethical weight.

Classify data by source and sensitivity (first-party, third-party, inferred, sensitive-category) and justify each classification.

Evaluate consent-capture designs for validity: granularity, withdrawal, purpose limitation, and readability.

Detect purpose creep by comparing a stated collection purpose against three plausible downstream uses.

Assess a data-broker or partner-acquisition scenario for provenance gaps and secondary-use risk.

Apply data-minimization and retention-limit principles to a described dataset and propose a concrete retention schedule.

Distinguish the roles of controller, processor, and data subject, and assign responsibilities in a three-party scenario.

Explain the ethical limits of using secondary data for model training even when the data is lawfully available.

Identify where fairness in use intersects with collection choices, such as sampling and proxy variables.

Summarize the core obligations of major privacy regimes (GDPR-style, CCPA/CPRA-style, HIPAA-style) and note where they diverge on consent and individual rights.

Map the standard individual rights (access, correction, deletion, portability, objection) to the operational process that would fulfill each.

Explain privacy-by-design and data-protection-by-design principles and apply them to a new feature proposal.

Distinguish anonymization, pseudonymization, and de-identification, including why re-identification risk persists.

Identify common security controls (encryption, access control, logging, key management) and state the ethical failure each prevents.

Analyze a breach scenario for notification duties, root cause, and accountability.

Describe cross-border transfer mechanisms and the ethical tensions they create for data subjects.

Explain the security implications of model training pipelines, including data leakage and inference attacks.

Compare at least four bias-mitigation strategies (pre-processing, in-processing, post-processing) and state their trade-offs.

Explain the main fairness metrics and why they can conflict, using a concrete allocation example.

Draft a model-governance structure naming accountable roles, review gates, and documentation artifacts.

Assess an emerging-technology scenario (generative models, synthetic data, automated decision-making) for novel ethical risk.

Re-rate each domain subarea and close the three lowest-scoring gaps with targeted review.

Synthesize the full lifecycle (collect, use, protect, govern) into a single end-to-end case walkthrough.

Practice timed scenario questions and correct every error by tracing it to a specific principle.

Condense all notes into a one-page recall sheet organized by domain.