CDMP Study Group

SESSION 3- DATA HANDLING ETHICS

MARCH 04, 2020

Lynn Noel, DAMA New England - Member

Email: lynnoel@lynnoel.com
AGENDA
• Facilitator Introduction
• Study Technique: Word Cloud Mnemonic
• Study Technique: Visual Digital Flashcards
• Flashcard Demo of Data Handling Ethics Deck
• 1. Introduction
• 2. Business Drivers
• 3. Essential Concepts
• 3.1 Ethical Principles for Data
• 3.2 Principles Behind Data Privacy Law
• 3.3 Online Data in an Ethical Context
• 3.4 Risks of Unethical Data Handling Practices
• 3.5 Establishing an Ethical Data Culture
• 3.6 Data Ethics and Governance
• Study Technique: Mindmap Model
• Q&A
• Next Session
New England Data Management Community
Facilitator
LYNN E. NOEL
 Principal, Digital Heritage Consulting
 Executive Certificate in Digital Business Strategy, MIT
 Mini-Masters in User Experience Design, Rutgers
 M.S. Geography, University of Wisconsin-Madison
 Most recently VP of Digital Strategy, Data Blueprint
 Director/mentor for IM & analytics, architecture & modeling,
collaboration & content mgmt at Big Five IT, midsize, & startup firms

CONTACT INFO:
EMAIL: lynnoel@lynnoel.com
PHONE: +1-978-985-2707
: /IN/lnoel

New England Data Management Community

Principles, Practices & Processes Protecting People’s Personal Privacy

New England Data Management Community

Brainscape Digital Flashcards - https://www.brainscape.com/p/2UTIR-LH-8SZ2J

Coming soon!

Click to launch

New England Data Management Community

TheBrain 3D Mindmap - https://bra.in/8jodnY

New England Data Management Community

Discussion

How are machine learning and

artificial intelligence impacting
data handling ethics?

New England Data Management Community

Q&A

New England Data Management Community

NEXT SESSION
Date Topic Facilitator
February 19th Chapter 1: Data Management Tony Mazzarella
March 4th Chapter 2: Data Handling Ethics Lynn Noel
March 18th Chapter 3: Data Governance Sandi Perillo-Simmons
April 1st Chapter 4: Data Architecture Laura Sebastian Coleman
April 15th Chapter 5: Data Modeling & Design Lynn Noel
April 29th Chapter 6: Data Storage & Operations Karen Sheridan
May 13th Chapter 7: Data Security Laura Sebastian-Coleman
May 27th Chapter 8: Data Integration & Interoperability Mary Early
June 10th Chapter 9: Document & Content Management Sandi Perillo-Simmons
June 24th Chapter 10: Reference & Master Data Mary Early
July 8th Chapter 11: Data Warehousing & Business Intelligence Tony Mazzarella
July 22nd Chapter 12: Metadata Management Karen Sheridan
August 5th Chapter 13: Data Quality Laura Sebastian-Coleman
August 19th Chapter 14: Big Data & Data Science Nupur Gandhi
September 2nd Chapter 15: Data Management Maturity Assessment Laura Sebastian-Coleman
September 16th Chapter 16: Data Management Organization & Role Expectations Agnes Vega
September 30th Chapter 17: Data Management & Organizational Change Management Tony Mazzarella
October 7th Final Review Tony Mazzarella

New England Data Management Community

What is the DMBoK definition of ethics?

Right Wrong

New England Data Management Community

Name at least four of the seven example ideas on which
ethical principles are focused.

Fairness

Trust Respect

IDEAS Transpa-
rency IDEAS Responsi
bility

Reliabilit
Integrity
y

Quality

New England Data Management Community

What is the DMBoK definition of data handling ethics?

Procure

Store

Manage ETHICS
DATA DATA
Use

Dispose of

New England Data Management Community

What are four reasons that DAMA says that data
handling ethics are important?

Loss of
Long-term
reputation and
success
customers

Unethical
Social
practices may
Responsibility
be illegal

New England Data Management Community

List three core concepts of data handling ethics
from the DMBoK.

Impact on people

Potential for
misuse

Economic value of
data

New England Data Management Community

Which one of these goals is NOT in the DMBoK as a
business driver for data handling ethics?

1)Defin 1)Defin
Monitor Monitor
e e

Auto Auto
Educate Educate
mate mate

Culture Culture

New England Data Management Community

Name at least three of the six inputs needed to define
data handling ethics for an organization.

Organiza-
tional
ethics
Business
Existing Strategy
Policies and
Goals
INPUTS INPUTS
Organiz-
Regula-
ational
tions
Structure
Business
Culture

New England Data Management Community

 What are the six core activities of data handling ethics?
1) Review Data Handling
1 Practices

Data Handling Ethics

Data Handling Ethics

2) Identify Principles, Practices,

2 and Risk Factors

3) Create an Ethical Data Handling

3 Strategy

4 4) Address Practice Gaps

5) Communicate and Educate

5 Staff

6) Monitor and Maintain

6 Alignment

New England Data Management Community

Name at least five of the nine deliverables that the DMBoK
recommends for a data handling ethics program.

1)Current Ethical Data

1) 1) 1) Practices and
Gaps
Handling
Strategy
Communication
Plan

Ethical Awareness of
1) 1) 1) Ethics Training
Program
Corporate
Statements
Ethical Data
Issues

Aligned Ethical Data

1) 1) 1) Incentives, KPIs,
and Targets
Updated Policies Handling
Reporting

New England Data Management Community

Name at least three of the six key stakeholders needed to
supply the inputs to an ethical data handling program

Executives

Data
Regulators
Stewards

INPUTS INPUTS
Executive
Data
Data
Providers
Stewards

IT
Executives

New England Data Management Community

Name at least four of the seven key stakeholders needed to
conduct the activities of an ethical data handling program

Data
Govern-
ance
Data Bodies
Manag-
CDO/CIO
ement
Services

ACTIVITIES ACTIVITIES
Change
Executives
Managers

Coordi-
Subject
nating
Matter
Data
Experts
Stewards

New England Data Management Community

Name the three key stakeholders recommended
as consumers of an ethical data handling program

Employees

Regulators Executives

New England Data Management Community

List four core techniques and tools used as technical
drivers for a data handling ethics program

Annual
Communi-
Ethics
cation Plan
Statement
Checklists
Affirmation

Microblogsi Wikis,
nternal knowledge
communi- bases,
cations intranet
tools sites

New England Data Management Community

List three key metrics of a successful ethical data
handling program

Exec
involvement

Compliance
incidents

# employees
trained

New England Data Management Community

What are two assumptions that lead organizations to fail at data ethics,
and two trends that make it important to succeed?

Organizations are
using data in new
ways and
TREND 1 & 2 legislation cannot
keep up with
evolving
environment

Technicians
profess not to
understand the
ASSUMPTION data and assume
1&2 following the
letter of the law =
no risk

New England Data Management Community

What are five key business drivers (opportunities
and threats) that motivate a data ethics program?
Increase
trustworthiness
3 Improve relationships
Stakeholders expect
ethical behavior

Reduce
2 organizational risk
Secure data from
criminals

New England Data Management Community

What is entailed in creating an ethical culture for
data handling?

Ethical
Governance Controls
Outcomes

New England Data Management Community

How does data ownership influence data handling
ethics?

Ethics of
Sharing
Ease of Others’
Data Data
Sharing
Improved
Technology

New England Data Management Community

Name five emerging roles and responsibilities for
data handling ethics

Chief
Chief Risk
Privacy
Officer
Officer

Chief
Chief Data
Analytics
Officer
All Officer
Employees

New England Data Management Community

What are the six essential concepts that the
DMBoK gives for data handling ethics?

3.3 Online 3.5

3.1 Ethical
Data in an Establishing
Principles for
Ethical an Ethical
Data
Context Data Culture
3.4 Risks of
3.2 Principles Unethical 3.6 Data
Behind Data Data Ethics and
Privacy Law Handling Governance
Practices

New England Data Management Community

Name and define three tenets of bioethics that provide
a starting point for principles of data ethics

Respect for
Dignity Autonomy
Persons

Do No Maximize
Beneficence
Harm Benefits

Justice Fair Equitable

New England Data Management Community

List the European Data Protection Supervisor's four pillars required for
an information ecosystem that ensures ethical treatment of data

EDPS EDPS

Future-oriented

Accountable

Empowered
individuals
controllers
regulation

conscious
Privacy-
New England Data Management Community
What are the seven principles of the General Data
Protection Regulation of the EU (GDPR)?
Lawfulness, fairness, and transparency

Purpose limitation

Data minimization

Accuracy

Storage limitation

Integrity and confidentiality (security)

Accountability

New England Data Management Community

Name at least five of the ten statutory obligations of the Canadian
privacy law PIPEDA (Personal Information Protection and Electronic
Documents Act)

Accountability

Identifying Limiting
Consent
purposes collection

Limiting Use,
Disclosure, Accuracy Safeguards
and Retention

Individual Challenging
Openness
access compliance

New England Data Management Community

What are the five Fair Information Processing Principles
recommended by the US Federal Trade Commission (FTC)?

Notice/
Awareness

Enforcement/ Choice/
Redress Consent

Integrity/ Access/
Security Participation

New England Data Management Community

Name at least four of eight additional FTC focus
areas for fair information practices
Choice
Privacy
Data
By
Mgmt
Design

Educa- Do Not
FOCUS tion
FOCUS Track

Con-
Access
Platfor sent
m Data
Transpa
rency

New England Data Management Community

Identify a global trend affecting information
privacy and risk

New England Data Management Community

List four principles that inform ethical behaviors
online as context for online data

Right to Be
Ownership
Forgotten

Freedom
Identity
of Speech

New England Data Management Community

 challenges

New England Data Management Community Timing

Misleading Visualizations

Unclear Definitions or
Invalid Comparisons

Bias

Transforming and
Identify six unethical data handling practices or

Integrating Data

Obfuscation / Redaction
of Data
How does timing create risk of unethical data handling?

New England Data Management Community

How do misleading visualizations create risk of
unethical data handling?

30% 50%

30%

New England Data Management Community

What are two ways that unclear definitions or invalid
comparisons create risk of unethical data handling?

New England Data Management Community

List at least three of five types of bias that create
risk of unethical data handling
Data
Collection for
pre-defined
result

Context Biased use

and of data
Culture collected

BIAS BIAS

Biased Hunch
sampling and
methodology
search

New England Data Management Community

List four data integration practices that create risk
of unethical data handling
Limited knowledge
Data of poor
of data’s origin and
quality
lineage

Integration Integration

No documentation
Unreliable of data
Metadata remediation
history

New England Data Management Community

List three instances of data obfuscation / redaction
practices that create risk of unethical data handling

Data Data
Masking Aggregation

Data Marking

New England Data Management Community

How do large data sets and data lakes raise practical
data ethics concerns in data science and analytics?

Individuals
identified
after
anonym-
ization

Sensitive
data not
analyzed
for
protection

New England Data Management Community

Define a process that moves an organization
toward establishing an ethical data culture

Review Identify Create an Adopt a

Current Principles, Ethical Data Socially
State Data Practices, Handling Responsible
Handling and Risk Strategy and Ethical Risk
Practices Factors Roadmap Model

New England Data Management Community

What is the first step toward establishing an
ethical data culture and what are its outcomes?

• Data • Data
Understand handling Document Collection
the Current practices Ethical
State Principles • Use
• Employee
awareness • Oversight

New England Data Management Community

Give an example of ethical data handling
principle, risk, and practice supported by controls.
• Right to privacy about
PRINCIPLE • PRINCIPLE personal health info (PHI) =
accessible only to caregivers

• Public access to PHI could

RISK • RISK jeopardize privacy

• Only nurses/doctors may

PRACTICE • PRACTICE access PHI for providing care

• Annual user review of PHI

CONTROL • CONTROL systems

New England Data Management Community

Give at least four of seven components of an
ethical data handling strategy.
Values statements

Ethical Data Handling Principles

Compliance Framework

Risk Assessments

Training and Communications

Roadmap

Auditing and Monitoring

New England Data Management Community

List and define four risk areas of an ethical data
sampling project that uses personal data
Identification

Behavior
capture
BI/Analytics
/Data
Science

Results

New England Data Management Community

What ethical risks of the identification of a population for
data science analysis may require ethical and legal review?

Identification
• Demo-

Identification
graphic
required
• Selection
method

New England Data Management Community

What ethical risks of behavior capture for data science
analysis may require ethical and legal review?

• Content
required
Behavior • Capture

capture •7 Behavior
Method
• Activities
• Sentiment
capture • Location
• Date/Time
• Combination
datasets

New England Data Management Community

What ethical risks of BI/Data Science/Analytics
may require ethical and legal review?

• Profiling
prospects
BI/ • Actual
Analytics/ and
BI/Analytics • 1 Data forecast
/Data Science activities
•2
Science

New England Data Management Community

What ethical risks of distributing the results of data
science analysis may require ethical and legal review?

• Privileges granted
or denied
• Further
engagement or
not
• Relationship
Results removal
• Benefit or
Results •6 sanction
• Trust or lack of
trust
• Biased treatment

New England Data Management Community

Give at least two of four examples of how to use a risk
model to execute a data handling project ethically

Risk Model Risk Model

1 Anonymize data

2 Remove private information

3 Tighten security

4 Review applicable privacy law

New England Data Management Community

What are the roles and responsibilities for
oversight of ethical data handing?
• Set Standards and
Data Data Policies
Governance Governance • Oversight of Data
Handling

Legal Legal • Keep up to date on

legal changes
Counsel Counsel • Employee awareness

• Fair Handling
Employees Employees • Reporting Protection
• Non-Interference

New England Data Management Community

Give at least three of five ethical obligations for members of
DAMA as included in the DAMA Code of Ethics.
Observe DAMA bylaws

Practice DAMA ethics and

values

Education and lifelong learning

in data management

No harassment or bullying

Promote DAMA’s image

New England Data Management Community

Give at least three of six additional ethical obligations for officers and
advisors of DAMA as included in the DAMA Code of Ethics.

Actively support DAMA programs

Not profit personally from my

performance as an officer

Raise conflicts of interest to the DAMA

Ethics Officer

Conduct all DAMA business under its

values and ethics

All DAMA communications are official

and on the record

Protect member PII and do not

distribute or sell it

New England Data Management Community