Assessing Data Practice Compliance and Ethics

The Evolving Landscape of Data Ethics

Being "current" means recognizing that data ethics is an ongoing process of diligence, not a one-time checklist. Three main forces drive this constant evolution:

1. Technological Advancements: New methods of data collection and analysis, from biometric scanners to artificial intelligence, create novel ethical challenges that did not exist previously.
2. New Legislation: Governments worldwide are actively legislating data privacy and use. What was once a matter of best practice can quickly become a legal requirement with significant penalties for non-compliance.
3. Shifting Societal Norms: Public awareness of data issues is growing. As a result, expectations for how organizations handle personal information are becoming more stringent, influencing trust and reputation.

Failing to keep your practices current can lead to legal liability, loss of funding, and, most importantly, a breach of trust with the people whose data you are using.

Part 1: Biometrics and Evolving Privacy Law

Let's begin with a tangible example in the world of bra design. Modern fitting techniques often involve 3D body scanning, which captures precise measurements. This type of data is not just a set of numbers; it's biometric data.

As defined by regulations like the EU's General Data Protection Regulation (GDPR), biometric data is considered "sensitive personal data" and requires a higher level of protection.

Because this data is so sensitive, laws have been created specifically to regulate its use. A prime example is Illinois' Biometric Information Privacy Act (BIPA). To understand why staying "current" is critical, let's examine this law.

Applying BIPA to Bra Design

Imagine you are a designer who launched a custom-fit bra service in 2015 using a 3D body scanner at a pop-up in Chicago.

• In 2015: Your practice might have been to get verbal consent from customers before scanning them. At the time, this may have seemed sufficient.
• Today: To be compliant with BIPA, you would need to have a customer sign a written release before the scan. You would also need a publicly available written policy detailing how long you will keep the scan data and when you will destroy it.
• The "Current" aspect: The reading notes that BIPA was reformed in August 2024 to change how damages are calculated. This demonstrates that even after a law is passed, its interpretation and application can change. A business that set up a BIPA compliance plan in 2023 would need to review and possibly update its risk assessment based on the 2024 changes.

This case shows that staying "current" is not an abstract goal. It is a concrete, legally mandated activity of monitoring and adapting to a changing regulatory environment.

Part 2: AI, Transparency, and the EU AI Act

Another major driver of change is the proliferation of Artificial Intelligence. Let's consider an AI-powered "virtual try-on" tool on a lingerie brand's website, where a customer can upload a photo to see how a product might fit. This practice intersects with another landmark piece of legislation: the EU AI Act.

Applying the AI Act to a Virtual Try-On Tool

As the article explains, a fashion brand using a third-party AI tool is considered a "deployer" and has specific responsibilities.

• Transparency Obligation: The Act's definition of a "deepfake" is broad. If your virtual try-on tool generates a realistic image of a customer wearing a bra, that image is likely considered AI-generated content. To be compliant, you must clearly disclose this to the user. A simple label like "AI-generated image" might be required.
• Biometric Categorization: If the AI tool analyzes the customer's body shape to recommend styles (e.g., categorizing them as having a certain breast shape or body type), this could be considered "biometric categorisation." This triggers additional transparency requirements and reinforces the need for strong GDPR compliance.
• Vendor Management: A "current" data practice involves not just your own actions, but also those of your technology partners. The article highlights that brands must update their vendor compliance processes, ensuring their AI providers are transparent about how their models were trained.

The EU AI Act, like BIPA, shows that technology creates new ethical terrain, and legislation quickly follows. An ethical data practitioner must be proactive, viewing these regulations not just as a compliance burden but, as the article suggests, an "opportunity to adopt ethical and transparent AI practices" that build consumer trust.

Part 3: Evolving Norms in Social Research

The need to stay current is not limited to technology and commerce. In your work as a social researcher, particularly in sensitive areas like polyamorous relationships, evolving ethical norms are just as powerful as laws.

• Language and Terminology: The language used to describe relationship structures and identities is constantly evolving. Using terms that were standard in academic literature 20 years ago might now be considered outdated, othering, or even offensive by the communities being studied. A "current" ethical practice involves consulting with community members to use respectful and accurate terminology.
• Data Sharing and Anonymization: The academic push for Openness (part of our CTO POC framework) is a modern ethical trend. However, for qualitative data like interviews about polyamory, simply releasing anonymized transcripts is a high-risk practice. The "current" ethical debate centers on finding a balance. This might mean using more sophisticated methods, such as creating synthetic datasets that preserve statistical properties without revealing personal stories, or using restricted-access data enclaves rather than fully open data.
• Community Involvement: The model of the researcher as a detached observer is increasingly being replaced by models of collaborative or participatory research. A "current" ethical approach to studying polyamorous dynamics would involve building relationships with the community, seeking their input on the research questions, and giving them opportunities to review and comment on the findings. This reflects the shift towards the Shared Ownership model we discussed in the previous lesson.

In social research, staying "current" is about being engaged with the evolving moral and methodological conversations within your field and within the communities you hope to understand.

Conclusion

This lesson completes our exploration of the CTO POC ethical framework. We have seen that the final principle, Current, is not a separate step but an overarching commitment to continuous vigilance.

Key Takeaways:

• Ethical data practices are dynamic and must be regularly reviewed to remain compliant and responsible.
• Staying "current" means actively monitoring and adapting to evolving laws (e.g., BIPA, EU AI Act), technologies (e.g., biometrics, AI), and societal norms.
• In a commercial context like bra design, new laws around biometric data and AI create specific compliance obligations related to consent and transparency.
• In an academic context like polyamory research, staying "current" involves using appropriate language, adapting data sharing practices, and engaging respectfully with participant communities.
• The CTO POC framework—Consent, Transparency, Openness, Privacy, Ownership, and Current—provides a comprehensive checklist for designing ethically sound data projects.

Preview of the Next Lesson:

Having established how to formulate a research question (SMART) and how to approach data collection ethically (CTO POC), we are now ready to evaluate the data itself. The next module, Information Validity with ROCCC, will equip you with a framework to assess the quality and trustworthiness of a data source. We will begin with the first criterion: R for Reliability.