Privacy & Compliance · Study deck
Applying Privacy Principles and Ethics
A team has not applied a privacy principle just because the word appears in a slide or policy.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- treat a privacy principle as a design question, not a policy slogan
- turn purpose, minimization, transparency, participation, accountability, and fairness into concrete feature choices
- review a design for misuse risk and keep evidence of the review
- trace a principle back to the Fair Information Practice Principles and OECD guidelines
Major section
The Core Idea: Shared Rules
Privacy principles are durable statements of how personal data should be handled, independent of any single company or country.
- The principles are not the law itself; they are the shared understanding that the law encodes, which is why they translate across products and borders.
- Principles are only useful when they change a design decision.
Major section
The Core Idea: Shared Rules (continued)
The principles ask whether data handling is responsible; ethics asks whether it is right, even when it would be permitted.
- For IoT, where devices sense people continuously in homes, bodies, and public spaces, that extra question matters: a use can be technically allowed and still feel like a betrayal of the person being sensed.
- Collect for a clear purpose, collect as little as possible, be honest about it, give people a say, stay accountable, and treat people fairly.
- They exist above any one country's traffic code: drive predictably, signal your intent, yield where you should, and do not endanger others.
Major section
The Core Idea: Shared Rules (continued)
The local code writes them down differently, but the shared expectations keep everyone safe.
- Privacy principles are the rules of the road for personal data, and ethics is the courtesy that goes beyond the minimum the code demands.
- The principles become useful when they are applied in a sequence rather than recited as labels.
- Finish with accountability and fairness, which require the team to show that the earlier choices work and do not create unjustified harm.
Major section
Practitioner: Principles to Choices
Principles become useful when each one is run as a question against a specific feature, and the answer is written down.
- The aim is a deliberate decision about data, recorded so it can be reviewed, rather than a default that no one chose.
- Collected in case it is useful one day.
- Everything the sensor can read, kept forever.
Major section
Practitioner: Principles to Choices (continued)
A continuous location history collected to improve a route feature could also reveal a home address, a workplace, a place of worship, or a health clinic.
- Plain disclosure that matches actual behavior.
- A settings page that displays but does nothing.
- Records of purpose, decisions, and controls.
- A use that is reasonable for the people affected.
Major section
Practitioner: Principles to Choices (continued)
Decision: aggregate and de-identify, disclose it plainly, and record the purpose so accountability is real, not assumed.
- A use that quietly disadvantages some users.
- Purpose: better routes.
- If you can run the principles as questions and add a misuse review, you can stop here.
Major section
Under the Hood: Roots and Tensions
The deeper layer explains where the principles came from, why ethics extends past compliance, and why principles sometimes pull against each other.
- Knowing the tensions is what separates thoughtful design from box-ticking.
- Compliance asks whether a use is permitted; ethics asks whether it is right.
- Autonomous decisions need an explicit envelope.
Major section
Under the Hood: Roots and Tensions (continued)
The threshold τ does not make the decision ethical by itself.
- A use can be lawful and still be manipulative, exclusionary, or simply not something a reasonable person would expect from the product they bought.
- Ethics has to follow the product from problem framing to retirement.
- Full disclosure can reveal exploitable detail.
Major section
Under the Hood: Roots and Tensions (continued)
Less data can mean less context to be correct.
- In IoT this is sharp, because the people affected often did not choose the device, such as a guest in a monitored home or a passer-by near a sensor.
- Facebook's 2006 launch of its News Feed is a well-known illustration of the gap between technical privacy and felt privacy.
- Either rights you cannot fulfill or data hoarded to fulfill them.
Major section
Under the Hood: Roots and Tensions (continued)
Nothing changed about who could see a given piece of information: friends had always been able to see each other's posts, relationship changes, and group activity by visiting a profile page.
- A design can be lawful and leave every access control unchanged, and still betray a reasonable expectation simply by changing how easily the same information is surfaced.
- Participatory design is a decision process, not a usability session: Invite people while the problem and alternatives are still negotiable.
- Include those who will be indirectly sensed—visitors, neighbours, workers, children, support staff—not only the purchaser.
Major section
Under the Hood: Roots and Tensions (continued)
action(x)=⎩⎨⎧aauto,asafe,ahuman,evidence(x)≥τ ∧ risk(aauto)≤Rallowed,evidence(x)<τ,evidence is sufficient but authority is reserved..
- The team must justify whose errors set it, test disparate effects, preserve a safe state, and make consequential decisions reviewable and contestable.
- Some decisions—such as denying essential access or taking an irreversible safety action—may remain outside machine authority regardless of confidence.
- Product design then reduces demand through fewer material types, modular repair, replaceable wear components, firmware support, standard fasteners, separable batteries, and documented recycling.
Major section
Under the Hood: Roots and Tensions (continued)
A cheaper part can depend on unsafe extraction, conflict-affected sourcing, excessive hours, inadequate worker protection, or a short unsupported life that multiplies waste.
- Procurement should trace high-risk minerals and manufacturing stages, investigate rather than assume supplier claims, define corrective action, and retain a route to disengage responsibly when severe harm cannot be prevented or mitigated.
- where the numerator includes environmental and human impacts that the decision record can meaningfully quantify or classify, and Lsupported is supported service life.
- The equation is not a licence to turn dignity or safety into a convenient monetary offset.
Major section
Under the Hood: Roots and Tensions (continued)
Ethics becomes real when that record changes a requirement, supplier, enclosure, algorithm, or release decision.
- Accountability is the principle that turns the others from intentions into something checkable.
- It asks an organization to be able to demonstrate that it meets its obligations, with records of the purpose for each collection, the decisions made, and the controls in place.
- Principle as slogan: Naming the principles while the product still over-collects and over-retains.
Major section
Under the Hood: Roots and Tensions (continued)
Purpose creep: Reusing data for a new purpose without re-deciding whether that purpose is acceptable.
- Fairness ignored: Checking what is permitted while skipping whether the use harms or excludes anyone.
- At this depth, privacy principles are a shared, durable standard that designs should meet and ethics should exceed.
- Because the principles are shared, a design that honors them tends to satisfy many regimes at once, which is why principle-led design travels better than law-by-law patching.
Deck summary
Key takeaways
Privacy principles are durable statements of how personal data should be handled, independent of any single company or country.
- The principles ask whether data handling is responsible; ethics asks whether it is right, even when it would be permitted.
- The local code writes them down differently, but the shared expectations keep everyone safe.
- Principles become useful when each one is run as a question against a specific feature, and the answer is written down.
- A continuous location history collected to improve a route feature could also reveal a home address, a workplace, a place of worship, or a health clinic.
Retrieval practice
Recall check 1 of 4
Privacy Priya says: answer from memory, then check your reasoning.
Q1A privacy screen explains data use, but people cannot inspect or correct their records. What feature closes the gap?
Show answer
Answer: D Participation requires usable controls, not only a description.
Retrieval practice
Recall check 2 of 4
Privacy Priya says: answer from memory, then check your reasoning.
Q2What is the best description of privacy principles?
Show answer
Answer: B Principles are source-independent statements of how personal data should be handled.
Retrieval practice
Recall check 3 of 4
Privacy Priya says: answer from memory, then check your reasoning.
Q3A team wants to keep a precise, long-term location history to maybe build features later. Which response best applies the principles?
Show answer
Answer: A Purpose limitation, minimization, and a misuse review reduce the risk of harmful secondary uses.
Retrieval practice
Recall check 4 of 4
Privacy Priya says: answer from memory, then check your reasoning.
Q4Data collected for a safety alert is later reused to build a marketing profile, with no new decision about whether that is acceptable. Which principle is most directly breached?
Show answer
Answer: B Reusing data for an unrelated purpose without a fresh decision is classic purpose creep, which purpose limitation exists to prevent.
Print reference
Answers
Answer key.
- D · Participation requires usable controls, not only a description.
- B · Principles are source-independent statements of how personal data should be handled.
- A · Purpose limitation, minimization, and a misuse review reduce the risk of harmful secondary uses.
- B · Reusing data for an unrelated purpose without a fresh decision is classic purpose creep, which purpose limitation exists to prevent.