Scenario Lab — Scenarios 1–3
Scenario 1 — Legal Permission Is Not the End
Difficulty: Foundational
Decisive clue: the team stops at “permitted.”
A retailer has broad contract language allowing analysis of customer behavior. A team proposes combining purchase history, location patterns and web behavior to infer which customers may have a sensitive health condition. Legal counsel says the contract probably permits it. Customers were never clearly told this sensitive inference would be made.
Your analysis
- Why is stopping at legal permission a Chapter 2 mistake?
- Which ethical principles/privacy themes apply?
- What should happen before deployment?
Model answer
Treat legal permission as necessary but insufficient. Review purpose, transparency, autonomy/meaningful choice, possible harm and accountability, with Governance and legal oversight before proceeding.
Why: Respect for Persons raises agency; Beneficence raises possible harm; privacy themes raise purpose/transparency/accountability. Chapter 2 says legal compliance does not exhaust ethical responsibility.
Weaker response: “Proceed because Legal approved it.” Legal interpretation matters, but ethical judgment is broader and distributed.
Change one fact: clear notice, meaningful choice, a necessary low-harm purpose and Governance review would reduce — not automatically eliminate — the concerns.
Operational mapping: Leading KA Data Governance; support from Data Security and Metadata Management where purpose/use must be documented. Roles include Governance council, Data Owner/Steward, Legal and the business/data team.
Source: Ch. 2 §3.1–3.2, §3.6, pp. 54–58, 67.
Scenario 2 — The Hiring Model Is Accurate Overall
Difficulty: Foundational
Decisive clue: disproportionate adverse effect across groups.
A hiring model predicts performance with high overall accuracy. Qualified applicants from one historically disadvantaged group are rejected at a much higher rate than comparable applicants from other groups. The model owner says aggregate accuracy proves the system is acceptable.
Your analysis
- Which ethical principle is most direct?
- Why is aggregate accuracy insufficient?
- What should happen before continued use?
Model answer
Justice is most direct because the stem is about unequal and potentially inequitable treatment across groups.
Surface the disparity, examine selection/sampling/analysis bias, assess harm and route the issue through Governance/legal review before continued consequential use.
Weaker response: “It is accurate, so the only issue is Data Quality.” Accuracy does not answer the fairness question.
Change one fact: if outcomes were comparable across groups but the model used unnecessarily invasive data, Beneficence or Respect for Persons could become more direct.
Operational mapping: Leading KA Data Governance; supporting Data Quality and DW/BI/Data Science use context. Roles: model owner, data scientists/analysts, Governance, legal/compliance and affected business owner.
Source: Ch. 2 §3.1 and §3.4.4, pp. 54–55, 60–61.
Scenario 3 — Keep Everything Forever
Difficulty: Standard
Decisive clue: undefined future use + indefinite identifiable retention.
A subscription company stores identifiable customer data indefinitely because storage is cheap and “we might discover a profitable use later.” The original notice described account servicing and billing, not unlimited future analytics. No retention need or review date exists.
Your analysis
- Which privacy-management themes are threatened?
- Why is “we already have it” a weak ethical argument?
- What should a better management response include?
Model answer
Challenge the practice using purpose limitation, storage/retention limitation, minimization, transparency and accountability. Define legitimate purpose, necessary retention, safeguards, notice/consent where relevant and accountable review.
Possession does not create unlimited ethical permission to retain or repurpose identifiable data.
Weaker response: “Keep it because future value is possible.” Economic value is an ethics concern but does not trump purpose, people or lifecycle responsibility.
Change one fact: an established retention obligation, documented purpose and appropriate safeguards can justify a different retention decision.
Operational mapping: Leading KA Data Governance; supporting Document & Content Management for retention/disposition and Data Security for protection. Roles: Data Owner, Steward, privacy/legal/records stakeholders and Governance.
Source: Ch. 2 §3.2, pp. 55–58; Introduction, p. 51.