Question

Data scandal is huge blow for Facebook The story started four years ago when Cambridge psychologist Aleksandra Kogan approached researcher Michal Kosinski to get Facebook users data, which he had collected using a simple ‘online personality quiz’ app that requires users to log in using Facebook to participate. While Kosinski refused to provide any data from his app was used to collect, Cambridge Analyitca paid Kogan over $800,000 to create a similar quiz app for him with an aim to collect Facebook users’ profile data, including the list of pages they have "liked". Kogan's personality quiz app, dubbed “this is your digital life,” was a hit. Although it is attracted 270,000 Facebook users to take part, Facebook's application programme interface (APIs) allowed collecting wide range of information about each authorized user's friends at the same time. Since an average Facebook user has hundreds of friends in his/her friend-list, Kogan was able to leverage his/her user base of 270,000 people to collect data for about 50 million Facebook users for use in its ad-targeting work. It is not only Cambridge Analytics’ quiz app, there are other thousands of other apps that you might have encountered on your Facebook timeline—such as "how you’ll look in your 80s,, "which celebrity you look like," "who will be your Valentine this year"—that work on the same model. All Facebook apps offer access of Facebook account and grant the app’s developer a range of information from your Facebook profile, like your name, location, email, and friends list. Besides this, ‘Login with Facebook’ option that you might have seen on hundreds of thousands of websites works similarly by allowing site administration to offer one-click login/signup for ease to verify people’s identity.

QUESTIONS

a) Identify the ethical issues in the case of Cambridge Analytica.

b) Critically evaluate the Cambridge Analytica’s action. Support your answer using relevant principles of Data Protection Act (2010) using appropriate moral theories.

Answer 1

a) The Cambridge Analytica scandal highlights a serious research ethics problem. In this case, an academic researcher who may have had legitimate permissions to access Facebook users, behaved badly to say the least. Using social media networks for research is still in its infancy – we have much to learn and there will be mistakes. Cambridge Analytics is an example of deceit that has the potential to make all academic researchers look bad. Yet, there are a number of honest and well meaning researchers exploring new uses of social media platforms like Facebook, Twitter and Instagram who are in uncharted territory operating without much in the way of ethical guidelines. The default, for academic researchers, is to punt the responsibility for regulatory compliance and ethical oversight to the local research ethics board or, Institutional Review Board (IRB). However, in the new age of digital health research that involves the use of mobile apps and passive and pervasive sensing tools (e.g., wearable fitness trackers, apps that can detect blood glucose), the IRB may not be up to speed on the technologies and, as such, unable to properly evaluate risks in relation to potential study benefits. Research conducted with IRB members revealed growing concerns that accurate assessment of study risks and appropriate risk management strategies are increasingly difficult in health research using MISST1 tools and strategies.3 Study participants disclosed an interest in finding experts who could assist with evaluating these studies.

b) Although Cambridge Analytica did all of this for research but it was unethical in nature to take personal data of users without their permission from their Facebook accounts. Not Facebook but This is Your Digial Life also violated User's personal data privacy that they have right to be protected whether it is used for research or not. In research a data is always taken with consent from the participant. If they are not happy with terms of the research they have right to back out from it but here they did not say anything like this to participants and just took the data with but not only unethical in terms of research but also a violation of Personal Data Protection Act of 2010.  

The Personal Data Protection Act 2010 (“PDPA”) is an Act that regulates the processing of personal data in regards to commercial transactions. The Act entrenches the notion that an individual has the right to ensure that his personal information is accurate, and is being used fairly in accordance with the law. At a time when direct marketing is reinventing itself with the widespread use of internet technology and crimes relating to identity are on the rise, the need for privacy and personal data protection has never been greater.The Act requires compliance with the following seven Personal Data Protection Principles:

1. General Principle: Use personal data only for the purpose it was given (eg to perform a contract) or for compliance with legal obligations. Do not collect personal data which is excessive for this purpose and consent is required if you use it for a different purpose or if you process sensitive personal data.
2. Notice and Choice Principle: Consistent with the concept of fair use, you must notify the individual of the nature of the personal data being processed, the purposes for which it is collected and further processed and the data subject’s right to request access to and correction of personal data, etc. Notification can be in electronic form as long as the individual can record and keep a copy.
3. Disclosure Principle: Limit disclosure of the personal data to the purpose which the data subject had been informed of at the time of collection and for which the data subject had consented. You must maintain a list of disclosures made to third parties.
4. Security Principle: Take practical steps to safeguard personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction.
5. Retention Principle: Do not retain personal data for longer than is necessary for the fulfilment of the purpose.
6. Data Integrity Principle: Take reasonable steps to ensure that the personal data is accurate complete, not misleading and kept up-to-date by having regard to the purpose, including any directly related purpose, for which the personal data was collected and further processed.
7. Access Principle: Give a data subject access to his personal data held by the data user and ability to correct that personal data where it is inaccurate, incomplete, misleading or not up-to-date.