Information Technology and Ethics/The Gap Between Legal and Ethical Compliance

The Gap Between Legal and Ethical Compliance In the growing field of cybersecurity, following the legal requirements of cybersecurity are crucial on the basis of protecting user data, privacy, and systems. While legal compliance is a baseline, it does not hold the ethical responsibility of carrying an organization. Such laws like the GDPR (General Data Protection Regulation) and the CCPA (California Consumer Privacy Act), set out specific rules for customers rights but do not cover the growing real-world scenarios. These include many questionable behaviors that continue from a legal perceptive, but not necessarily ethical. Many companies meet standards, but do not meet practices that cover the gray areas that the law abandons. Examples of the Gap between Legal and Ethical Compliance Data collections are an example of a gap that occurs within these two compliances. The nature of data collection practices is to gather and measure information, for the sake of answering a research question, evaluated outcome, or a test hypothesis. (HHS GOV, 1998)GOV HHS Data Collection 1998 https://ori.hhs.gov/education/products/n_illinois_u/datamanagement/dctopic.html Many organizations use long, lengthy policies before a certain website, app, or entrance to an account in order to create a complex read for the user. The documents often hold information that includes how certain data is being used, shared, and held. But without time on the user's side, and the decreasing time patience users hold with the growing cyber world, individuals unwittingly agree to these terms. As Daniel J. Solove stated, this practice is what is known as "privacy paradox"- a phenomena where individuals say they value their privacy highly, yet in their behavior relinquish their personal data for very little in exchange or use measures to protect their privacy.Solove Daniel J. The Myth of the Privacy Paradox Georgetown Law Journal 131 2021 1–48 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3536265 By agreeing to different data harvesting practices, the principle of informed consent raises ethical questions. Delayed Breach Disclosures are referred to the instances where an organization fails to report a data breach in time. This happens for a variety of reasons, such as law enforcement cooperation and consideration, national security considerations, and challenges in determining materiality, but it all leads down to harming the individual. Cybersecurity regulations often give companies to provide a 30-90 day window gap to handle data breaches, and to begin the legal statement processing. Alder Steve Delaying Breach Notifications is a Violation of the Breach Notification Rule August 11, 2017 https://www.hipaajournal.com/delaying-breach-notifications-is-a-violation-of-the-breach-notification-rule-8923/#:~:text=A%20look%20at%20the%20breach,and%20need%20to%20be%20notified. However, the monthly long wait affects customers on an ethical standpoint, since many individuals expect changes passwords, account fixes and credit return as soon as possible. The Equifax Breach of 2017 is a large example of how one of the three largest consumer credit reporting agencies in the United States managed to breach the personal data of 148 million Americans. The company delayed notifying the public for nearly 6 weeks, and within that time names, home addresses, phone numbers, date of births, social security numbers and more were breached. On March 19, 2017, an internal email notification was sent to Equifax administrators to apply an Apache path, but the vulnerability was left unpatched until 4 months after, on July 29, 2017.Rotenberg Marc Equifax Data Breach February 14, 2018 https://archive.epic.org/privacy/data-breach/equifax/ Additionally, the data broker industry holds a large place in the gap between ethical and legal compliances. The data broker industry is built to target consumers with ads, create increasing risks of data breaches, discriminate in housing, employment, and credit, along with much more. Ayoub Emile Closing the Data Broker Loophole February 13, 2024 https://www.brennancenter.org/our-work/research-reports/closing-data-broker-loophole#:~:text=This%20underregulated%20data%20broker%20ecosystem,personal%20information%20without%20legal%20process. Data brokers legally purchase and collect consumer data from different sources, including sensitive data. The data oftentimes holds personal accounts, such as location data from apps or online behavior. The transaction does not violate the laws in any legal manners, but for the individual whose data is being bought and sold they are left with no informed consent. Why Ethical Compliance Matters in Cybersecurity While following the legal matters in a situation might give a sense of comfort for an individual, users fail to realize companies and organizations use the bare minimum required standards. By barely holding onto the legal compliances, the ethical nature of privacy and consent gets left on a shaky baseline. Ethical compliance asks what is right, and not just simply permitted. The CIS (Center for Internet Security) and IAPP (International Association of Privacy Professionals), argue that ethical leadership creates a stronger cyber culture, and they are critical for maintaining the trust of users, as well as protection.Koerner Katharina Privacy and Responsible AI January 11, 2022 https://iapp.org/news/a/privacy-and-responsible-ai References