Chapter 2 — Data Handling Ethics (DMBOK v2 aligned, full depth)

1. Introduction

1.1 What “data handling ethics” means in DMBOK v2

DMBOK treats data handling ethics as the discipline concerned with how
an organization procures, stores, manages, uses, and disposes of data
in ways aligned with ethical principles.

A key DMBOK idea is that data often represents (or affects) people, and
therefore the way we handle data can create harm or benefit. DMBOK
highlights three core concepts that drive why ethics must be addressed:
impact on people, potential for misuse, and the economic value of
data.

1.2 The three core concepts (as DMBOK frames them)

A) Impact on people

DMBOK’s point is not abstract: individuals’ data must be maintained with

quality and reliability because it is used to make decisions that affect
people’s lives.

Examples

 Healthcare: Wrong allergy or medication data can cause direct harm.

 HR: Incorrect “termination reason” or “performance flag” can damage

a career.

 Finance: Incorrect “delinquency” labels can deny loans or increase

interest rates.

Ethical handling here means your organization treats accuracy,

completeness, timeliness, and traceability as moral responsibilities, not
only technical requirements.

B) Potential for misuse

DMBOK emphasizes that even valid data can be misused, producing negative
effects on people and organizations.

Examples

 Using customer location data collected for delivery to infer sensitive

behavior (e.g., visits to clinics).

 Using workplace communications data to discipline staff based on

biased interpretations.

Misuse is commonly enabled by weak governance: unclear “acceptable use,”

weak oversight, and poor escalation paths.
C) Economic value of data

DMBOK calls out that data has economic value and organizations must
decide how and by whom that value can be accessed.

Examples

 A company monetizes aggregated insights (ethical only if consent,

transparency, and protection are appropriate).

 A team extracts value by internal resale of datasets (often unethical if

it bypasses policies or violates purpose limitations).

The ethical question is not “does it create value?” but “who benefits, who
bears risk, and who decides?”

2. Business Drivers

DMBOK v2 treats ethics as a business-relevant capability, not a philosophy. In

the DMBOK framing, an organization typically runs a data handling ethics
capability/program to: define ethical data handling, educate staff, establish
the desired culture, and monitor the organization’s approach (automation
is not listed as a DMBOK business driver in that slide set).

2.1 Why this becomes urgent (the “why now” logic)

DMBOK’s logic is that organizations are using data in new ways and
legislation cannot keep up; relying only on “letter of the law” thinking creates
ethical risk.

2.2 Opportunities and threats that motivate ethics programs

One DMBOK-aligned way to express drivers is as opportunities (value) and

threats (risk), such as: increasing trustworthiness and improving
stakeholder relationships, while reducing organizational risk and securing
data from criminals.

Examples mapped to the drivers

 Increase trustworthiness: Publish governed definitions, lineage, and

quality indicators so stakeholders can trust analytics.

 Improve relationships: Demonstrate responsible handling to

partners/regulators to enable data sharing agreements.

 Reduce organizational risk: Prevent privacy violations,

discriminatory outcomes, misleading reporting, and reputational harm.

 Secure data from criminals: Strong ethical posture reinforces

investment in security controls and access discipline.
2.3 Inputs needed to define ethics for an organization (DMBOK view)

DMBOK highlights typical inputs such as organizational ethics, business

strategy/goals, organizational structure, business culture, regulations, and
existing policies.
Instructor explanation: ethics cannot be “one generic document.” It must
be grounded in:

 What your business does (e.g., healthcare is higher sensitivity than

retail)

 How you are organized (central vs federated data teams)

 The regulatory landscape (local + cross-border if applicable)

 Existing corporate values and disciplinary processes

3. Essential Concepts

DMBOK v2 explicitly breaks “Essential Concepts” into six groups (3.1–3.6):

Ethical Principles for Data; Principles Behind Data Privacy Law;
Online Data in an Ethical Context; Risks of Unethical Data Handling
Practices; Establishing an Ethical Data Culture; Data Ethics and
Governance.

3.1 Ethical Principles for Data

3.1.1 What “ethical principles” mean in DMBOK framing

DMBOK treats ethics as principles of behavior based on right and wrong,

often focusing on ideas such as fairness, respect, responsibility,
integrity, quality, reliability, transparency, and trust.

Below is how an instructor would teach each principle with operational

meaning:

A) Fairness

Meaning: data and analytics should not systematically disadvantage certain

groups without justification and oversight.

Example: A fraud model flags transactions from a particular district more

often because historical policing data was biased. Ethical handling demands
review for bias, validation, and governance sign-off.

B) Respect
Meaning: treat individuals as more than “data points.” Respect includes
honoring reasonable expectations of privacy and avoiding deceptive
collection.

Example: burying key tracking details in unreadable terms may be legal in

some settings but violates respect.

C) Responsibility

Meaning: professionals and organizations accept accountability for

outcomes of data use.
Example: “The algorithm decided” is not an ethical excuse. Somebody
approved the model, the data, and the deployment context.

D) Integrity

Meaning: do not manipulate data or interpretation to achieve a desired

narrative.

Example: selectively excluding negative records to “improve KPIs” is an

integrity failure.

E) Quality & Reliability

Meaning: decision-impacting data must be accurate enough for the

consequences it drives.
Example: if eligibility decisions are based on income data, missing/incorrect
income values become ethical risk, not just “data quality noise.”

F) Transparency

Meaning: people inside the organization can explain how data is collected,
defined, transformed, and used.

Example: a KPI should have a governed definition, lineage, and version

history (glossary + metadata).

G) Trust

Meaning: trust is an outcome produced by consistent ethical behavior,

controls, and transparency over time.

Example: once trust is broken (e.g., undisclosed data sharing), even correct
analytics will be rejected by stakeholders.

3.2 Principles Behind Data Privacy Law

DMBOK v2 explicitly includes this section because privacy law

operationalizes many ethical principles into enforceable obligations (and
ethics should go beyond compliance).
A DMBOK-aligned way to teach this section is:

 Privacy law is built around principles like

lawfulness/fairness/transparency, purpose limitation, data
minimization, accuracy, storage limitation, integrity &
confidentiality, accountability (commonly taught via GDPR as an
example).

Instructor mapping: ethics → law

 Respect → consent/notice, limits on secondary use

 Quality/Reliability → accuracy obligations

 Security → integrity/confidentiality

 Responsibility → accountability, auditability, governance

Examples

 Purpose limitation: collecting phone numbers for delivery does not

automatically justify using them for unrelated marketing campaigns.

 Storage limitation: retaining sensitive logs indefinitely increases

harm potential and typically violates good practice.

3.3 Online Data in an Ethical Context

This section addresses modern realities: organizations use data from digital
channels where boundaries blur.

Key ethical issues in online data:

 Tracking and profiling at scale

 Data captured passively (cookies, device IDs, location)

 Platform ecosystems and third-party sharing

 Re-identification risk (even when “anonymized”)

Examples

 Consent illusion: “Accept all cookies” banners designed to

manipulate users undermine ethical consent.

 Context collapse: social media data may be public, but using it for
employment decisions is ethically high-risk without clear policy and
governance review.

 Re-identification: combining multiple “non-PII” datasets can

reconstruct identity; ethical programs treat this as a risk class, not a
loophole.
3.4 Risks of Unethical Data Handling Practices

DMBOK calls out that unethical handling can emerge from specific
practices/challenges. The referenced DMBOK-aligned study materials list
examples such as timing, misleading visualizations, unclear definitions
or invalid comparisons, bias, problematic transforming/integrating
data, and obfuscation/redaction issues.

Below is how to understand these risks in practice:

A) Timing (context and recency risk)

Using old or incorrectly timed data can mislead decision makers.

Example: reporting “monthly churn” using partial month data without

disclosure.

B) Misleading visualizations

Charts can ethically fail even when numbers are correct (misleading axes,
wrong denominators, inconsistent categories).

Example: a pie chart that implies totals not equal to 100% misrepresents
reality.

C) Unclear definitions / invalid comparisons

If “customer,” “active,” “revenue,” “incident,” etc. are not defined

consistently, comparisons become ethically misleading.

Example: comparing two regions’ “performance” when one counts

cancelled orders and the other excludes them.

D) Bias

Bias can be introduced intentionally or unintentionally (data collection bias,

sampling bias, cultural/context bias).

Example: collecting only urban users’ feedback and applying conclusions to

rural populations.

E) Transforming and integrating data

ETL/ELT transformations can silently change meaning (unit conversions,

rounding, de-dup logic).
Example: merging “household” and “individual” data without clear rules
produces misleading “customer counts.”

F) Obfuscation/redaction failures

Improper masking can either expose individuals or remove crucial context.

Example: redacting identifiers but leaving quasi-identifiers (location +
timestamp) that re-identify people.

3.5 Establishing an Ethical Data Culture

DMBOK emphasizes that ethics must become part of culture, not an isolated
policy document. In DMBOK-aligned teaching materials, establishing ethical
culture includes outcomes supported by governance controls.

What an “ethical data culture” looks like (operationally)

 People ask “should we?” not only “can we?”

 Ethical escalation is safe (no retaliation)

 Incentives and KPIs do not reward unethical shortcuts

 Training is continuous, role-based, and practical

 Teams document definitions and transformations by default

Practical culture-building mechanisms (DMBOK-aligned)

 Code of conduct statements specific to data use

 Ethics training program

 Communication plan (repeated, not one-time)

 Updated policies and reporting mechanisms

 Aligned incentives / KPIs / targets

Example
If a sales team is rewarded solely on conversion, they may pressure analysts
to “optimize” metrics presentation. Ethical culture aligns incentives so
integrity is protected.

3.6 Data Ethics and Governance

This subsection is the bridge: ethics becomes enforceable through

governance structures, decision rights, stewardship, policies, and
controls.

DMBOK-aligned training materials identify that governance bodies,

executives (CDO/CIO), coordinating data stewards, SMEs, change managers,
and data management services are key stakeholders in conducting ethical
data handling activities.

How governance operationalizes ethics

  Policies define acceptable use, retention, sharing boundaries

 Standards define how consent, minimization, classification, and

lineage are handled

 Stewardship manages definitions, issue escalation, and ethical

exceptions

 Controls include monitoring, auditability, and corrective actions

 If ethics conflicts with a business request, governance provides the

decision forum and accountability

The “six core activities” (DMBOK-aligned program view)

A DMBOK-aligned ethics capability commonly includes activities such as:

reviewing current practices, identifying principles/practices/risk factors,
creating an ethical strategy, addressing gaps, communicating/educating, and
monitoring/maintaining alignment.

Deliverables (what the program should produce)

DMBOK-aligned training materials list deliverables such as: current practices

and gaps, ethical data handling strategy, communication plan, ethics training
program, ethical corporate statements, awareness of ethical issues, aligned
incentives/KPIs/targets, updated policies, and ethical data handling reporting.

Metrics (how you know it’s working)

Example metrics taught in DMBOK-aligned materials include: number of

employees trained, compliance incidents, and executive involvement.