Privacy & Compliance · Study deck
Applying Privacy Principles and Ethics
A team has not applied a privacy principle just because the word appears in a slide or policy.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- treat a privacy principle as a design question, not a policy slogan
- turn purpose, minimization, transparency, participation, accountability, and fairness into concrete feature choices
- review a design for misuse risk and keep evidence of the review
- trace a principle back to the Fair Information Practice Principles and OECD guidelines
Major section
The Core Idea: Shared Rules
Privacy principles are durable statements of how personal data should be handled, independent of any single company or country.
- The principles are not the law itself; they are the shared understanding that the law encodes, which is why they translate across products and borders.
- Principles are only useful when they change a design decision.
Major section
The Core Idea: Shared Rules (continued)
They exist above any one country's traffic code: drive predictably, signal your intent, yield where you should, and do not endanger others.
- The principles ask whether data handling is responsible; ethics asks whether it is right, even when it would be permitted.
- The local code writes them down differently, but the shared expectations keep everyone safe.
- The principles become useful when they are applied in a sequence rather than recited as labels.
Major section
Practitioner: Principles to Choices
Principles become useful when each one is run as a question against a specific feature, and the answer is written down.
- The aim is a deliberate decision about data, recorded so it can be reviewed, rather than a default that no one chose.
- Collected in case it is useful one day.
- Everything the sensor can read, kept forever.
Major section
Practitioner: Principles to Choices (continued)
A continuous location history collected to improve a route feature could also reveal a home address, a workplace, a place of worship, or a health clinic.
- Plain disclosure that matches actual behavior.
- A settings page that displays but does nothing.
- Records of purpose, decisions, and controls.
- A use that is reasonable for the people affected.
Major section
Practitioner: Principles to Choices (continued)
A use that quietly disadvantages some users.
- The underlying collection, usage logging for a breathing-support device, was easy to justify; the secondary use, routine sharing with an insurer, was the part that needed its own decision and its own disclosure.
- Purpose: better routes.
- Decision: coarsen and shorten retention so the harmful secondary use cannot happen.
Major section
Under the Hood: Roots and Tensions
The deeper layer explains where the principles came from, why ethics extends past compliance, and why principles sometimes pull against each other.
- Knowing the tensions is what separates thoughtful design from box-ticking.
- Compliance asks whether a use is permitted; ethics asks whether it is right.
- Autonomous decisions need an explicit envelope.
Major section
Under the Hood: Roots and Tensions (continued)
The threshold $\tau$ does not make the decision ethical by itself.
- A use can be lawful and still be manipulative, exclusionary, or simply not something a reasonable person would expect from the product they bought.
- Ethics has to follow the product from problem framing to retirement.
- Full disclosure can reveal exploitable detail.
Major section
Under the Hood: Roots and Tensions (continued)
Less data can mean less context to be correct.
- In IoT this is sharp, because the people affected often did not choose the device, such as a guest in a monitored home or a passer-by near a sensor.
- Facebook's 2006 launch of its News Feed is a well-known illustration of the gap between technical privacy and felt privacy.
- Either rights you cannot fulfill or data hoarded to fulfill them.
Major section
Under the Hood: Roots and Tensions (continued)
Nothing changed about who could see a given piece of information: friends had always been able to see each other's posts, relationship changes, and group activity by visiting a profile page.
- A design can be lawful and leave every access control unchanged, and still betray a reasonable expectation simply by changing how easily the same information is surfaced.
- Participatory design is a decision process, not a usability session.: Invite people while the problem and alternatives are still negotiable.
- Include those who will be indirectly sensed—visitors, neighbours, workers, children, support staff—not only the purchaser.
Major section
Under the Hood: Roots and Tensions (continued)
$$ action(x)= \begin{cases} a_{auto}, & evidence(x)\ge\tau\ \land\ risk(a_{auto})\le R_{allowed},\\ a_{safe}, & evidence(x)<\tau,\\ a_{human}, & evidence\ is\ sufficient\ but\ authority\ is\ reserved. \end{cases} $$.
- The team must justify whose errors set it, test disparate effects, preserve a safe state, and make consequential decisions reviewable and contestable.
- Some decisions—such as denying essential access or taking an irreversible safety action—may remain outside machine authority regardless of confidence.
- Product design then reduces demand through fewer material types, modular repair, replaceable wear components, firmware support, standard fasteners, separable batteries, and documented recycling.
Major section
Under the Hood: Roots and Tensions (continued)
A cheaper part can depend on unsafe extraction, conflict-affected sourcing, excessive hours, inadequate worker protection, or a short unsupported life that multiplies waste.
- Procurement should trace high-risk minerals and manufacturing stages, investigate rather than assume supplier claims, define corrective action, and retain a route to disengage responsibly when severe harm cannot be prevented or mitigated.
- where the numerator includes environmental and human impacts that the decision record can meaningfully quantify or classify, and $L_{supported}$ is supported service life.
- The equation is not a licence to turn dignity or safety into a convenient monetary offset.
Major section
Under the Hood: Roots and Tensions (continued)
Ethics becomes real when that record changes a requirement, supplier, enclosure, algorithm, or release decision.
- Accountability is the principle that turns the others from intentions into something checkable.
- It asks an organization to be able to demonstrate that it meets its obligations, with records of the purpose for each collection, the decisions made, and the controls in place.
- At this depth, privacy principles are a shared, durable standard that designs should meet and ethics should exceed.
Deck summary
Key takeaways
Privacy principles are durable statements of how personal data should be handled, independent of any single company or country.
- They exist above any one country's traffic code: drive predictably, signal your intent, yield where you should, and do not endanger others.
- Principles become useful when each one is run as a question against a specific feature, and the answer is written down.
- A continuous location history collected to improve a route feature could also reveal a home address, a workplace, a place of worship, or a health clinic.
- A use that quietly disadvantages some users.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1What is the best description of privacy principles?
Show answer
Answer: A Principles are source-independent statements of how personal data should be handled.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A team wants to keep a precise, long-term location history to maybe build features later. Which response best applies the principles?
Show answer
Answer: D Purpose limitation, minimization, and a misuse review together prevent the harm before it is possible.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3Data collected for a safety alert is later reused to build a marketing profile, with no new decision about whether that is acceptable. Which principle is most directly breached, and what is the fix?
Show answer
Answer: A Reusing data for an unrelated purpose without a fresh decision is classic purpose creep, which purpose limitation exists to prevent.
Print reference
Answers
Answer key.
- A · Principles are source-independent statements of how personal data should be handled.
- D · Purpose limitation, minimization, and a misuse review together prevent the harm before it is possible.
- A · Reusing data for an unrelated purpose without a fresh decision is classic purpose creep, which purpose limitation exists to prevent.