5 Applying Privacy Principles and Ethics

5.2.1 The Core Principles

The principles become useful when they are applied in a sequence rather than recited as labels. Inspect Figure 5.1 from purpose and minimization through accountability and fairness.

Read Figure 5.1 by first asking why the data is needed and how little will serve that purpose. Then check quality, use boundaries, transparency, participation, and safeguards. Finish with accountability and fairness, which require the team to show that the earlier choices work and do not create unjustified harm. The beginner examples now apply that same route to familiar connected products.

5.2.5 Beginner Examples

Work from the simplest case toward the broader design consequence. First, a scale that records weight to show a trend has a clear purpose; recording the household’s voices alongside it would breach purpose limitation. Next, an app that lets a person export and delete their history is honoring participation, not just describing it. Finally, reciting the principles in a slide while the product still over-collects is not honoring them; nothing changed.

5.2.6 Overview Knowledge Check

If you can explain why principles sit above any single law and why ethics adds a further question, you have the core idea. Continue to Practitioner to turn principles into feature decisions.

5.3.1 The Principles as Working Questions

5.3.2 Misuse and Secondary-Use Review

The strongest practitioner habit is to ask not only what you intend to do with the data, but what the data could be used for. A continuous location history collected to improve a route feature could also reveal a home address, a workplace, a place of worship, or a health clinic. The misuse review asks whether each such secondary use would be acceptable to the person, and designs to prevent the unacceptable ones, often by minimizing or abstracting the data so the harmful use is simply not possible.

This is not a hypothetical risk. Internet-connected CPAP breathing machines, prescribed for the sleep interruptions of sleep apnoea, have been reported to track how often and how effectively they are used and to share that information with the providing company and, where the machine was supplied as part of a health plan, with the person’s insurer. Users in the reported case only learned of the sharing when they received the kind of encouragement email usually associated with activity trackers, and said the way the data was collected and shared had not been clearly communicated to them. The underlying collection, usage logging for a breathing-support device, was easy to justify; the secondary use, routine sharing with an insurer, was the part that needed its own decision and its own disclosure.

5.3.3 Worked Reasoning: Three Features

5.3.7 Practitioner Knowledge Check

If you can run the principles as questions and add a misuse review, you can stop here. Continue to Under the Hood for where the principles come from, how they tension, and where they fail.

5.4.1 Where the Principles Come From

The modern privacy principles trace back to the Fair Information Practice Principles, refined internationally in the OECD privacy guidelines, and they reappear, with local wording, in contemporary data protection law. In European data protection law, for example, the same ideas appear as principles such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Because the principles are shared, a design that honors them tends to satisfy many regimes at once, which is why principle-led design travels better than law-by-law patching.

A parallel effort aimed specifically at autonomous and intelligent systems is IEEE’s Ethically Aligned Design initiative, which distills five general principles for the design, development, and deployment of systems that sense, decide, or act with reduced human oversight: human rights, well-being, accountability, transparency, and awareness of misuse. For IoT products that increasingly turn sensed data into an automated decision, these principles echo the demands above from a different angle: keep the system’s operation traceable, weigh well-being alongside commercial metrics, and make sure someone is accountable when a decision causes harm.

5.4.2 Ethics Beyond Compliance

Compliance asks whether a use is permitted; ethics asks whether it is right. The two usually agree, but not always. A use can be lawful and still be manipulative, exclusionary, or simply not something a reasonable person would expect from the product they bought. The fairness principle is the bridge: it tells designers to weigh the effect on the people sensed, not only the letter of the rule. In IoT this is sharp, because the people affected often did not choose the device, such as a guest in a monitored home or a passer-by near a sensor.

Facebook’s 2006 launch of its News Feed is a well-known illustration of the gap between technical privacy and felt privacy. Nothing changed about who could see a given piece of information: friends had always been able to see each other’s posts, relationship changes, and group activity by visiting a profile page. What changed was that News Feed aggregated all of it and surfaced it on the first page after login, and thousands of users protested even though no new access had been granted. As the researcher danah boyd observed of the episode, the tendency in technology is to treat “private” as a single bit that is either on or off, but for the people affected, making existing data easier to notice was itself a privacy harm, independent of whether it was technically accessible before. A design can be lawful and leave every access control unchanged, and still betray a reasonable expectation simply by changing how easily the same information is surfaced.

5.4.3 Ethical Design and Build Lifecycle

Ethics has to follow the product from problem framing to retirement. A review performed only after the enclosure, model, data path, and suppliers are fixed can document harm but has little leverage to remove it.

Participatory design is a decision process, not a usability session. Invite people while the problem and alternatives are still negotiable. Include those who will be indirectly sensed—visitors, neighbours, workers, children, support staff—not only the purchaser. Make participation accessible and compensate it. Record minority objections and product changes; a diverse room that cannot change the design is consultation theatre.

Autonomous decisions need an explicit envelope. For each decision, write the sensed inputs, confidence or validity conditions, maximum consequence, reversibility, and escalation path. A simple policy form is

The threshold $\tau$ does not make the decision ethical by itself. The team must justify whose errors set it, test disparate effects, preserve a safe state, and make consequential decisions reviewable and contestable. Some decisions—such as denying essential access or taking an irreversible safety action—may remain outside machine authority regardless of confidence.

Build ethics widens “cost” beyond the purchase order. A cheaper part can depend on unsafe extraction, conflict-affected sourcing, excessive hours, inadequate worker protection, or a short unsupported life that multiplies waste. Procurement should trace high-risk minerals and manufacturing stages, investigate rather than assume supplier claims, define corrective action, and retain a route to disengage responsibly when severe harm cannot be prevented or mitigated. Product design then reduces demand through fewer material types, modular repair, replaceable wear components, firmware support, standard fasteners, separable batteries, and documented recycling.

Compare alternatives over delivered service rather than unit price alone:

where the numerator includes environmental and human impacts that the decision record can meaningfully quantify or classify, and $L_{supported}$ is supported service life. The equation is not a licence to turn dignity or safety into a convenient monetary offset. Keep non-negotiable labour, human-rights, accessibility, and safety constraints as hard gates; use lifecycle cost only among options that pass them.

The output is one ethical lifecycle record: affected people and unresolved dissent, autonomous authority, data and material provenance, worker and supplier evidence, production/operation impacts, supported lifetime, repair plan, recyclability, retirement responsibility, and the owner/date for re-review. Ethics becomes real when that record changes a requirement, supplier, enclosure, algorithm, or release decision.

5.4.4 Principles in Tension

5.4.5 Accountability Means Evidence

Accountability is the principle that turns the others from intentions into something checkable. It asks an organization to be able to demonstrate that it meets its obligations, with records of the purpose for each collection, the decisions made, and the controls in place. Without that evidence, the other principles rest on trust alone, and trust cannot be audited or relied upon after the people who made the decisions have moved on.

5.4.6 Common Pitfalls

Review these failure modes in order. First, Principle as slogan. Naming the principles while the product still over-collects and over-retains. Next, Consent theater. Treating a buried agreement as if it honored transparency and participation. Then, Purpose creep. Reusing data for a new purpose without re-deciding whether that purpose is acceptable. Then, Fairness ignored. Checking what is permitted while skipping whether the use harms or excludes anyone. Finally, No evidence. Claiming accountability with nothing recorded to demonstrate it.

5.4.7 Under-the-Hood Knowledge Check

At this depth, privacy principles are a shared, durable standard that designs should meet and ethics should exceed. Bind data to a purpose, minimize it, be honest, give people a real say, stay accountable with evidence, and weigh fairness for everyone affected, including those who never chose the device. A trustworthy review asks not whether the principles are named, but where each one changed the design and what record proves it.