What it takes for organizations to be ethical about data?

Every company is a data company now. According to one estimate, global data production will increase from fewer than three exabytes a decade ago to an anticipated 463 exabytes per day by 2025.

Most businesses have started addressing the operational aspects of data management, such as figuring out how to create and maintain a data lake or incorporating data scientists and other tech specialists into current teams. Fewer businesses have carefully considered and begun addressing the ethical repercussions and duties that could arise from data management. Companies may suffer severe reputational and financial losses if algorithms are developed using limited data sets or if data is breached, sold without permission, or handled improperly, for example. Even board members themselves could be held accountable.

So, how should businesses start approaching ethical data management? What steps can they take to ensure they properly utilize patient, consumer, HR, facility, and other data across the value chain—from collection to analytics to insights?

Despite having the best intentions, leaders and organizations can fall into several classic data management pitfalls. These pitfalls include believing that data ethics does not apply to your firm, that legal and compliance have data ethics covered, and that data scientists have all the answers, to name just a few. Other pitfalls include focusing solely on immediate ROI and ignoring the origins of the data.

Challenges of data ethics

Data ethics is a topic with a growing corpus of literature. Definitions of the term will change over time, just as the techniques businesses use to gather, examine, and access data do. Data ethics are actions taken in connection with data that aim to maintain the confidence of users, patients, consumers, clients, employees, and partners. However, unintentional breaches of data ethics can occur in businesses. They consist of the following:

Data ethics apply to all organizations

While privacy and ethical concerns are crucial when businesses use data (including applications for artificial intelligence and machine learning), many leaders don't prioritize them. The tools, technology, and strategic goals related to data management are typically simpler for company leaders to concentrate on than the ostensibly invisible ways data management might go wrong. In our experience, this is not because they do it on purpose.

For instance, only 27% of the 1,000 participants in a 2021 McKinsey Global Survey on the state of AI reported that their data professionals regularly verify for skewed or biased data during data ingestion. Only 17 percent of respondents claimed that their businesses have a specific data governance committee with members who work in risk and law. Only 30% of respondents to the same survey indicated their firms identified equity and fairness as pertinent AI threats. Although these numbers are startling, AI-related data hazards are only a small portion of more general data ethics problems.

Don't think in silos

Companies can think they have met their data management responsibilities by employing a few data scientists. The truth is that everyone has a stake in data ethics, not only data scientists or legal and compliance departments. Employees from the front lines to the C suite will need to bring up, address, and consider various data-related ethical issues at various points in time. To ensure that their strategic and commercial objectives align with consumers' expectations and regulatory and legal requirements for data usage, business unit executives will need to assess their data strategies, for example, with the legal and marketing teams.

Although regulatory obligations and ethical commitments are intertwined, executives must recognize that adhering to data ethics goes far beyond the issue of what is legal as they manage usage problems. In fact, business decisions frequently need to be made before the adoption of pertinent laws. The General Data Protection Regulation (GDPR) of the European Union (EU) only came into effect in May 2018, the California Consumer Privacy Act (CCPA) only took effect in January 2020, and the US Congress is only now considering a federal privacy law. Leaders had to establish the rules for their companies' use of data years before these and other statutes and regulations were put in place, just as they do now when making judgments about things that would be regulated in the future.

Laws can demonstrate to executives their options. However, a comprehensive framework for data ethics can advise executives on whether they should, for example, follow a specific marketing strategy and, if so, how to do so. The responsibility of data management for executives was clearly stated by one senior CEO we met with: "The standard here is not regulation. The key is to create a customer expectation, deliver on that expectation, and do it in a way that enhances your brand.

Short-term vs. long-term ROI

Executives and employees may be tempted to make unethical data choices—inappropriately sharing confidential information because it is useful—to pursue short-term profits driven by economic volatility, aggressive innovation in some industries, and other disruptive business trends. Boards are calling for more consumer and company data use regulations, but immediate budgetary constraints remain.

Considering data with its sources

When executives assess the integrity and utility of isolated data sets and neglect to take the full data pipeline into account, ethical violations may emerge. Where did the information originate? Can this vendor guarantee that the data's subjects voluntarily agree to have their information used by outside parties? Are there any major nonpublic details in the market data? One alternative data source was prosecuted with securities fraud for misrepresenting how its data were produced to trading firms, demonstrating the importance of such due diligence. In that instance, businesses gave the data vendor private information about the functionality of their apps, but the vendor failed to aggregate and anonymize the information as promised. The vendor eventually had to agree with the US Securities and Exchange Commission.

How to be ethical about data?

These data management difficulties are typical, but they are not the only ones. New privacy and ethical issues will certainly arise when businesses produce more data, adopt new tools and technologies to collect and analyze data, and discover new methods to use insights from data. Organizations must test different approaches to creating programs for fault-tolerant data management.

Company-specific rules for data usage

To develop a data usage framework that reflects a shared vision and mission for the company's use of data, leaders from the business units, functional areas, and legal and compliance departments must collaborate. To begin with, the CEO and other C-suite officials must be involved in developing data standards that inform staff members of the company's risk tolerance and which data-related endeavors are acceptable and which are not.

Such regulations can facilitate and possibly expedite individual and group decision-making. They should be customized to your particular industry, including your business's goods and services. All employees, partners, and other important stakeholders should have access to them. They should also be founded on a fundamental value, such as "We never utilize data in a way that cannot be tied to a better result for our customers." To account for changes in the business and technological world, corporate executives should plan to evaluate and amend the rules regularly.

Data values

It's crucial to effectively explain your organization's common data usage policies inside and outside the company once you've developed them. This may entail displaying firm data values on employees' screen savers, as one of our interview subjects' company did. Or, it might be as easy as speaking to their staff in a language they understand and customizing discussions about data ethics to different business units and functions. For instance, the message to the IT team and data scientists might be about developing moral data algorithms or reliable and secure data storage techniques. The emphasis of the communication to the marketing and sales teams may be on openness and opt-in/opt-out procedures.

Diverse data team

A robust data ethics program won't appear overnight. Both large and small organizations require individuals who concentrate on ethical issues; it cannot be a side activity. The task ought to be delegated to a certain group or role, or both. Recently, some larger technology and pharmaceutical businesses have named chief trust or ethical officers. Others have established interdisciplinary teams to define and enforce data ethics, commonly called data ethics boards. A representation from each of the following groups should be on such boards: business units, marketing and sales, compliance and legal, audit, IT, and the C-suite.

An organization will be more likely to spot problems early on (in algorithm-training data, for example) when people with various backgrounds and experiences sit around the table. These boards should also have a diversity of genders, races, ethnicities, classes, etc.

Consider the impact

Businesses should test for bias along the entire value chain and continuously evaluate the effects of the algorithms and data they utilize. This necessitates considering the issues businesses may bring about when developing AI solutions, even unintentionally. Some data applications demand much closer examination and attention. One of these areas is security. It's crucial to consider the data sources used, their intended purposes, and potential future applications.

Integrating data principles in operations

Setting data usage guidelines and defining ethical data use are one thing; implementing those guidelines across the entire organization is another. A shared understanding (and common language) about how data usage regulations should relate to the company's data and corporate strategies as well as to actual use cases for data ethics, such as decisions on design processes or M&A, should be developed by data ethics boards, business unit leaders, and C-suite champions. Data operations teams, secure-development operations teams, and machine-learning operations teams are a few examples of situations where operationalizing data ethics will be clear. Data ethics can be considered at every stage of the creation of AI applications thanks to trust-building frameworks for machine-learning operations.

Regardless of which area of the organization the leaders choose to focus on, they should choose KPIs that can be used to track and evaluate how well that area is achieving its goals for data ethics. The leadership team should also support, contribute to, and coordinate formal training programs on data ethics to ensure that everyone's everyday work incorporates the ethical use of data.