Data Security, Integrity and Ethics: Question 10

Worked solution

Part (a): Why continuing without action is unethical

A computing professional has a responsibility to act honestly and with integrity towards the people affected by their work, including the users of the software they build. Continuing to implement a feature that secretly collects and shares users’ precise location data. Data that is not disclosed anywhere in the app’s privacy policy or terms of use, means knowingly deceiving those users about how their personal information is being used, purely so that MedApp can benefit financially. This directly conflicts with a professional’s duty to respect the privacy and trust of the people who rely on the software.

[2 marks]: [1] for identifying that users’ data is being collected/shared without their knowledge or consent, [1] for linking this to a computing professional’s responsibility to act honestly/with integrity and respect user privacy rather than prioritise commercial gain.

Part (b): Actions consistent with acting ethically

Rather than simply carrying out the instruction and saying nothing further, Jamal has several options that are more consistent with professional ethics, including:

• Raising the issue formally with someone more senior than his manager. For example, a data protection officer, a compliance team, or a company director, so that it is reviewed by someone with the authority to address it.
• Referring to MedApp’s own code of conduct or ethics policy (or that of a relevant professional body) as the basis for formally raising the concern.
• Declining to personally write or continue building the undisclosed data-collection feature.
• If internal channels fail to resolve the issue, reporting the practice to an appropriate external regulator (whistleblowing).

[2 marks] for any two distinct, valid actions along these lines.

Part (c): Why this is still an ethical issue

Ethics concerns what is morally right, which is a broader standard than what is strictly legal or technically correct. An instruction can be entirely legal, or at least not obviously break any specific law, while still being ethically wrong. In this scenario, users are being deceived about how their personal location data is collected and used purely for commercial benefit; this is a matter of honesty and respect for users’ privacy, which is an ethical concern regardless of whether it also happens to break a specific law.

[1 mark] for correctly explaining that ethics is a broader standard than legality/technical correctness, and that deceiving users about data collection is wrong on that broader standard.

Final answers

• (a) Continuing would knowingly allow undisclosed collection and sharing of users’ personal data, breaching a professional’s duty of honesty, integrity and respect for user privacy.
• (b) Any two of: escalate to a more senior authority/data protection officer; refer to a code of conduct when raising the concern; refuse to implement the feature; whistleblow externally if needed.
• (c) Ethics is a broader standard than legality. An instruction can be legal but still ethically wrong, as here, where users are being deceived about their data.