Ethics of Information
This domain covers privacy, data protection, ownership of information, security, and the conduct questions raised by big data and algorithms. Expect scenarios about data sales, monitoring, intellectual property, and insider information, and expect the exam to want the specific principle or statute named.
Privacy and data protection
- Fair Information Practice Principles: notice, choice or consent, access, security, and enforcement.
- GDPR (EU, 2018): requires a lawful basis, purpose limitation, data minimization, rights of access and erasure, breach notification, and it reaches firms outside the EU that process EU residents' data, with substantial fines.
- US sector rules: HIPAA for health, GLBA for financial data, COPPA for children, FERPA for education; the FTC enforces unfair or deceptive practices.
Ownership and accuracy
- Patents protect novel, useful, nonobvious inventions for about 20 years; copyright protects expression for a long term; trademarks protect distinctive source identifiers; trade secrets depend on maintained secrecy rather than registration.
- Accuracy duties attach to records, financial reporting, and professional advice.
- Access issues include the digital divide and accessibility for users with disabilities.
Security and conduct
Computer Fraud and Abuse Act (1986) for unauthorized access; insider trading under the misappropriation theory; clickwrap enforceability; algorithmic bias; dark patterns; deepfakes; employee monitoring.
Worked example
A retailer wants to sell purchase histories to a data broker. First question: was there notice and opt-in at collection, or is this a new purpose? Purpose limitation is the crux. Second: does the dataset permit health or financial inferences through aggregation? Third: is the buyer's use compatible with the original expectation? Under GDPR, consent must be specific and freely given, so buried terms likely fail. Under FIPPS, the missing choice is the ethical defect. Selling data is not automatically wrong - the defect is the mismatch between the use and the expectation the firm itself created.
Traps that cost marks
"If it's public, it's not private" - aggregation re-identifies people; conflating privacy with security; confusing copyright with patent; assuming a privacy policy legitimizes any use; and forgetting that employees retain some privacy expectations.