Plain-language explanation.
Data ethics asks how data should be collected, used, and governed — and who has rights over data about themselves. Privacy law (like GDPR in Europe) gives people rights to know what data is collected about them and to have it deleted. But data ethics goes beyond legal compliance: it asks what organisations should do even when the law permits more.
Core concepts and standard treatment.
Data privacy principles: data minimisation (collect only what is needed), purpose limitation (use data only for stated purposes), storage limitation (retain only as long as necessary), accuracy (maintain correct data), integrity and confidentiality (secure data against unauthorised access or loss), and accountability (document and demonstrate compliance). Privacy by design (Cavoukian): embedding privacy into system architecture from the outset rather than retrofitting. Pseudonymisation vs. anonymisation: pseudonymous data is still personal data under GDPR; true anonymisation is very difficult (re-identification attacks on supposedly anonymised datasets — Netflix prize dataset re-identification by Narayanan and Shmatikoff).
Deeper theory, debates and edge cases.
Surveillance capitalism critique (Zuboff): the extraction and monetisation of behavioural data as a new form of capital accumulation — creating asymmetric knowledge and power between platforms and individuals. Consent and informational self-determination: meaningful consent vs. consent under structural pressure (cookie consent walls, terms of service as consent fiction). Data justice (Dencik, Hintz, Redden): data systems reproducing and amplifying existing social inequalities — who benefits from data collection and whose data rights are protected. Algorithmic accountability: GDPR Article 22 (right not to be subject to solely automated decisions with significant effects), algorithmic impact assessments, and the challenge of auditing black-box models.
How it is applied in practice.
Data governance in organisations: data governance frameworks (DAMA-DMBOK: data architecture, modelling, storage, security, integration, quality, metadata, master data management, warehousing, documents and content management, reference and master data); Chief Data Officers (CDOs) and data governance committees; data stewardship roles. GDPR compliance in practice: legitimate interest assessment (LIA), data protection impact assessments (DPIA), records of processing activities (ROPA), Data Protection Officers (DPOs), and breach notification (72 hours). Cross-border data transfers: Standard Contractual Clauses (SCCs), adequacy decisions (EU-US Data Privacy Framework), and the restriction of transfers to non-adequate countries. AI systems and data rights: synthetic data as a privacy-preserving training data strategy; federated learning (model trained on distributed devices without raw data leaving devices); and differential privacy (mathematical guarantee of privacy in published statistics).