Data Governance, Stewardship, and Security Ethics
Scope
This domain tests the structures that make ethical commitments operational: who owns data, who may use it, how it is protected and destroyed, and what you owe people when protection fails.
Structures
- Ownership versus stewardship versus custody: the organisation may hold rights, but stewardship is a duty of care exercised on behalf of data subjects, and custody is operational control.
- Accountability mapping: a RACI or equivalent per data domain, a data council or ethics committee, a named senior owner, and defined escalation routes.
- Policy stack: classification, acceptable use, retention schedule, access policy, third-party risk, incident response, and a data ethics policy that goes beyond legal minimums.
- Metadata and lineage: you cannot govern data you cannot trace. Provenance, transformation history and quality dimensions (completeness, accuracy, timeliness, consistency) are governance artifacts in their own right.
Security ethics
- CIA triad: confidentiality, integrity, availability, with genuine trade-offs; maximal confidentiality can destroy availability and vice versa.
- Controls: least privilege, role- and attribute-based access, segregation of duties, encryption in transit and at rest, key management, logging and monitoring, and verified secure deletion.
- Duty to warn and responsible disclosure: where a vulnerability or model flaw creates foreseeable harm, the ethical obligation can exceed the contractual one. Coordinated disclosure balances user safety against exploit risk.
- Breach obligations: GDPR requires notification to the supervisory authority within 72 hours of awareness where there is risk to rights and freedoms, and to individuals where risk is high. Sectoral rules differ, such as HIPAA's 60-day standard.
- Stewardship beyond the organisation: data trusts, data cooperatives and Indigenous data sovereignty frameworks such as the CARE principles and OCAP recognise collective interests that individual consent cannot capture.
Worked example
A researcher finds that a hospital portal lets any authenticated user change a URL parameter to view other patients' records. Posting it publicly endangers patients; waiting indefinitely leaves them exposed. The defensible path is prompt internal disclosure with a written record and a stated deadline, escalation to the security lead, and external notification to a regulator or national CERT if the deadline passes and exposure continues. Notifying affected patients is the hospital's duty, not a bargaining chip.
Traps
Treating a compliance certificate as proof of ethical stewardship; forgetting backups and replicas in deletion promises; confusing least privilege with zero access; assuming access control substitutes for de-identification.