As technology continually evolves and innovations emerge to the forefront, the foundation stays the same – data.

AI, cybersecurity, connectivity, and IoT all revolve around data in some form or another, and it seems that everyday, the public becomes increasingly aware of how much of their data is being harvested, used, and targeted by different groups.

The ethical considerations around this data have also transformed as data breaches become more and more public, fines from data regulation watchdogs reach record numbers, and the advent of artificial intelligence has brought copyright and arguments and data rights to the forefront.

So how can technology leaders try to stay ahead in this grand data debate, and understand their own responsibilities that come with ever-ammassing data capabilities?

Best Practice: Being a Good Data Custodian

Audience engaged, the panel at DIGIT’s flagship event immediately got straight to the point, with chair Rob Huggins asking: “What strategies and best practices can organisations employ to protect sensitive data and avoid data breaches while continuing to extract value from the process?”

Jude McCorry, CEO of the Cyber and Fraud Centre – Scotland, matched the straightforward question, getting to the heart of the panel.

“The first thing is basically from the ethical side of it, to be a good custodian of the data that’s entrusted to us,” she explained

This is not so much a strategy, she admitted, but a stamp of responsibility that comes with being entrusted with the data of millions of people. Paramount to being a good custodian is a cultural shift in understanding this responsibility.

“Instilling a good healthy cyber culture around the organisation,” is key to ensuring this responsibility is engrained to every facet of an organisation.

“Cyber should not just be with the IT organisation with the IT side of the business to run, it should be a team sport – everybody should participate in it,” she said.

Cybersecurity and proper data management should not just fall to the IT department – after all they are not the only people in an organisation handling sensitive data or making deals with third parties to share user data.

As many data breaches are the fault of human error, keeping the focus on people is vital: “To me, its always a people piece as well. Do you know who in your organisation actually cares about it?” Adam Sorka, director of Hypercube Consulting asked.

Data ethics and protection has to be something that everyone in an organisation cares about – “I think that sort of champion of leadership and corporate culture is a part of that,” he added.

Changing the culture of responsibility was clearly highlighted, but panel members also shared practical advice they’ve seen organisations skip out on time and time again, much to their frustration.

From regular backups to vulnerability testing, to incident response times – most of these “common sense” for data protection, Zibby Kwecka, CISO for Quorum Cyber explained.

“It’s such common sense that it almost gets pushed to the bottom. It’s very important to plan, but most people see that the plan isn’t tested,” he explained.

Data protection cannot be left to theory, and must be tested with the same vigour as fire alarms even in a mostly empty office block, the panel affirmed.

Overall, the panel appeared frustrated at the continual failings of data protection and cybersecurity measures, with Zibby Kwecka lamenting the failings of improper guidance and regulations.

“If people simply followed the principles, we wouldn’t be having any of these issues,” he said.
But what are these principles, why is it easy for people to follow best practice, and how can we incentivise businesses to follow good data ethics?

Data Ethics: The Nitty Gritty of Regulations

Ethics and business are often seen as antagonistic advancements – more consumer protections are labelled as red paint for businesses trying to reach maximum profits, and emerging technologies that can help businesses transform the working world only seem to give rise to moral quandaries from the public and privacy watchdogs alike.

Aligning these two important facets of data and technology, however, is vital for each to flourish and for everyone to benefit from advancing technologies like AI, machine learning, and automation, as well as protecting them from emerging threats.

The first thing businesses need to do is admit to how they use personal data – “If your organisation is not making money on selling personal records, then don’t sell personal records, and take care of them,” Zibby said simply. “If your business is making money on those, then it should be more protective with this data, and ensure it is getting consent from the people whose data it is.
“You should not be exploiting these people by not telling them how you’re keeping your data,” he finished.

Formalised, informed consent is vital to data ethics, and these principles have been paramount to regulation – but these regulations have issues themselves.

According to Zibby, regulation and enforcement often leaves too much to interpretation, can be overly technical and complex for those who are not tech experts, and can therefore be reactive rather than proactive for emerging technologies and an evolving cyber landscape.

“Too often, you know the principle, however, it is too easy reading a lot of ways for people to decide what is right and what is wrong, as far as technical measures for protecting data,” he explained.

Guidelines, when followed, can mitigate risk and encourage consumer trust. But if they remain as guidelines or are too vague, they risk being interpreted incorrectly, or in ways which can serve business needs and underserved consumer protection.

Recommended reading

• “Common Sense” Changes Coming to Data Protection & Digital Information Bill
• NHS Welcomes AI-assisted CT Scans From Scots Company
• Data Breaches Risk Domestic Abuse Victims’ Lives, ICO Warns

On the other hand, however, overly technical advice and legislation is at risk of falling behind the trends, leaving organisations without guidance and at risk of emerging threats.
The likes of generative AI and its growing potential risks to data and cybersecurity is just one example of how dramatically and quickly the landscape can transform.

“I think it needs to be an active stance,” Adam said. “I think organisations really need to match the pace of change – this space is going to really accelerate.”

Maintaining a balance of not-overly-vague but not-overly-specific guidance and regulation is key in the tech sphere as it continues to evolve and change. Agility is key.

“Its the hype that kills us,” Rhona MacLenna, lead data consultant at Forth Point warned, lamenting how new technologies can rush in to distract us from current underlying problems.

“People talk about unintended consequences, but there aren’t any, it’s not thinking of consequences,” she reiterated.

The solution for regulations, she proposed, is by mastering the art of the carrot and the stick, by bringing in all stakeholders – companies, data rights groups, consumers – to to table to discuss how to protect personal data.

“The world has fundamentally changed, but the problems are still the same. And we have to tackle these problems, collectively, universally,” Rhona said.