The ethical use of data goes deeper than simple regulatory compliance. Enterprises are waking up to a new reality in which consumers -- and even their own employees -- want them to put a brake on how much data they vacuum up and what they do with it.
According to a recent KPMG survey, 97% of consumers said they believed data Privacy was important, and 87% thought it should be a human right, but 54% of respondents didn't trust companies to use their data ethically.
"Data Privacy and protection are clear priorities for consumers," said Vijay Jajoo, principal in cyber security services at KPMG.
For companies to act ethically, they must pay close attention to how they manage and protect consumer data, he said.
"Does the fact we can now do certain things mean that we should?" Jajoo said. "This problem goes to the core of the data ethics debate."
But for many companies, ethical data collection and management are not a high priority.
"Too many companies have made it a habit to scoop up every piece of data they can get their digital hands on," said Kathy Baxter, principal architect of ethical AI practice at Salesforce.
They're motivated by potential use cases in business analytics, predictions or just to sell to others, she said. "The result is companies having a lot more data than they need or should have."
As cyberattacks increase, consumers are starting to pay more attention to privacy issues. Governments around the world are now looking at passing legislation to protect users' data, partly in response to new AI technologies demanding more data that still pose significant risks of bias and misuse. All this means it's more important than ever for companies to take a holistic view of their data collection practices. Many companies are in reactive mode, tightening up their security after a breach happens and updating their processes and policies after new legislation is passed. This approach is not only more costly than building in proper processes from the start, it also creates significant public relations problems for companies.
Privacy violations cost money -- directly, with the regulations in Europe and California, and indirectly, if they contribute to data breaches. Some companies approach compliance from the perspective of fulfilling the minimum requirements of particular laws that apply to them. Others take a more holistic view, looking at ethical data mining principles and the intent behind privacy laws to apply them across the board. For example, Europe's GDPR and the California Consumer Privacy Act only apply to customers in those jurisdictions, but some companies extend these protections to all users, regardless of where they are based. "As the power of contemporary enterprises grow, they bear a larger responsibility for going beyond compliance to engage with ethics," said Laura Norén, visiting scholar at NYU's Center for Data Science and VP of privacy and trust at Obsidian Security. That means collecting only the data that is required, avoiding harm to people and the environment and obtaining explicit consent for that data collection, she said. Focusing on principles can help companies stay ahead of regulations, reduce future costs and limit privacy-related public relations incidents. "From a pure regulatory perspective, companies should be looking at data ethics," said Anand Rao, partner and global AI leader at PwC. And that may be happening. According to a recent PwC survey, 85% of business leaders said they comply with the strictest privacy and security regulations around the world. Regulations tend to focus on specific details of privacy rather than on the big picture, however. That's the central problem with ethical data collection, said Dipayan Ghosh, co-director of the Digital Platforms & Democracy Project at Harvard Kennedy School. "There's no regulatory structure that requires it." That means that there's no commercial incentive for companies to care about the bigger ethical data issues, he said.
