- ✓GDPR gives individuals rights over their personal data including the right to access, rectify, erase, and port their data.
- ✓The principle of data minimisation requires organisations to collect only the data they actually need for a specified, legitimate purpose.
- ✓Consent must be freely given, specific, informed, and unambiguous; pre-ticked boxes and bundled consents do not meet the GDPR standard.
- ✓Data breaches must be reported to the Information Commissioner's Office within 72 hours if they pose a risk to individuals' rights and freedoms.
- ✓Algorithmic decision-making raises ethical concerns about transparency and fairness, particularly when decisions affect access to services or employment.
Listen to the full episode inside the course. Enrol to access all 80 episodes, plus assignments, tutor support and Student Finance funding.
Start learning →Alex: Today we're examining data ethics and governance. Sam, why has data ethics become so prominent?
Sam: Because data collection has become pervasive and the potential for harm is significant. Organisations now collect vast amounts of personal information about people: their locations, their health, their preferences, their relationships, their financial situations. When this data is used responsibly it can provide genuine benefits. When it's misused, whether deliberately or through negligence, the harm to individuals can be serious and difficult to remedy.
Alex: GDPR is the primary regulatory framework in the UK. What are its core principles?
Sam: GDPR is built around a set of principles that govern how personal data must be handled. Lawfulness, fairness, and transparency: you must have a legal basis for processing data and be open about how you use it. Purpose limitation: data collected for one purpose can't simply be used for another. Data minimisation: collect only the data you need. Accuracy: keep data up to date. Storage limitation: don't keep data longer than necessary. Integrity and confidentiality: protect data with appropriate security measures.
Alex: What are the main rights that GDPR gives individuals?
Sam: The right of access allows individuals to request a copy of the data an organisation holds about them. The right to rectification allows them to correct inaccurate data. The right to erasure, sometimes called the right to be forgotten, allows them to request deletion of their data in certain circumstances. The right to data portability allows them to receive their data in a machine-readable format. And the right to object allows them to object to certain types of processing, including profiling and direct marketing.
Alex: What about algorithmic decision-making? That raises particular concerns.
Sam: It does. Automated decision-making systems, particularly those using machine learning, can perpetuate or amplify the biases present in their training data. If a hiring algorithm is trained on historical hiring data from a company where a particular demographic was consistently selected, it will learn to favour that demographic regardless of whether the characteristic is relevant to job performance. GDPR provides some protection by giving individuals the right not to be subject to solely automated decisions that have significant effects on them.
Alex: What practical steps should organisations and computing professionals take?
Sam: Data protection impact assessments should be conducted before deploying new systems or processes that involve personal data, particularly where there's significant potential for harm. Privacy by design means building data protection principles into systems from the outset rather than adding them as an afterthought. Regular audits of data holdings help identify data that should be deleted. And training staff on their data protection obligations is essential, since many breaches result from human error.
Alex: What are the consequences of getting this wrong?
Sam: Financial: ICO fines can be up to four percent of global annual turnover. Reputational: data breaches generate significant negative publicity that damages customer trust. Operational: a breach may require significant resources to investigate, remediate, and notify affected individuals. And legal: individuals can claim compensation for damage caused by data breaches. The combined effect can be existential for smaller organisations.
Alex: Thanks Sam. Next we look at data science tools and technologies.