An independent study reference written by Dr Phuc V. Nguyen. It is not official subject material — for assessment requirements always follow your subject outline and vUWS.
Ethics by design
Ethics by design means building safeguards into a system rather than reviewing them at the end. It descends from Cavoukian's privacy by design, which says: be proactive rather than remedial, make the protective setting the default, and embed the safeguard in the architecture rather than bolting it on. The regulatory version is Article 25 of the GDPR, data protection by design and by default. In analytics the practical form is a short list of artefacts produced while the work happens: a documented purpose, a dataset record, a model record, a stated error budget naming who absorbs each kind of error, and a route to contest the outcome.
Why it matters
The difference is when the question gets asked. Reviewing a finished model is like asking about fire exits once the building is up. You will get an answer, it will be expensive, and it will be a compromise. Asking the same question during design costs one meeting. Most ethical safeguards are cheap while they are still a requirement and close to impossible once they are a retrofit.
A team is close to the deployment date for a churn model when someone asks how a wrongly flagged customer would find out and object. What does an ethics-by-design practice change about this moment?
Worked examples
A lender is building an automated decline model and wants the ethical work done properly without adding a six-month review stage.
Four artefacts, produced as the work happens rather than after it. A purpose statement naming the decision, the population it applies to and the data that may feed it. A datasheet for the training data recording where it came from, who is under-represented and what it does not cover. A model card recording performance broken out by group rather than only in aggregate. And a stated error budget: how many wrongly declined applicants is the business accepting, and what does a declined applicant do next. The fourth is the one teams skip, and it is the one that turns a score into something a person can argue with.
A team is asked to ship a location-tracking feature switched on by default, because opt-in rates would otherwise be low.
Privacy by design says the protective setting is the default, so the feature ships off and interested users turn it on. The objection that opt-in rates will be low is the design working, not failing. A low opt-in rate is evidence about how much users actually value the feature, and shipping it on by default converts a weak preference into a strong-looking usage number that will then be cited as justification. If the feature is genuinely useful, the case for it survives being asked. If it only survives being assumed, that itself is the finding.
Common mistakes
- ✗Ethics by design means an ethics committee reviews the project. A committee reviews finished work at intervals. Design-time practice puts the questions inside the artefacts the team already produces, so they get answered by the people making the choices, while the choices are still cheap to change.
- ✗It slows delivery down. It moves cost earlier rather than adding it. A purpose statement and a datasheet take hours during the build. Retrofitting an appeal path, retraining on a different label or withdrawing a deployed model takes months.
- ✗Privacy by design is only about privacy. The principles generalise: be proactive, make the safe setting the default, embed the safeguard, protect the whole lifecycle, and be visible about what the system does. Each applies just as well to fairness, contestability and safety.
- ✗A positive-sum outcome is always available, so the trade-offs are not real. Cavoukian argues against accepting false trade-offs, which is not a claim that none exist. Some genuinely conflict, and design-time practice makes the conflict explicit and hands it to somebody who can decide, instead of letting a default settle it silently.
Revision bullets
- •Build the safeguard in; do not review it at the end
- •Cavoukian: proactive, protective default, embedded, whole lifecycle, visible
- •GDPR Article 25: data protection by design and by default
- •Artefacts: purpose statement, datasheet, model card, error budget, appeal route
- •A default is a decision made for everyone who never opens the settings
- •The cost moves earlier, it does not get larger
Quick check
A team is close to the deployment date for a churn model when someone asks how a wrongly flagged customer would find out and object. What does an ethics-by-design practice change about this moment?
Which change best matches the principle "privacy as the default setting"?
Connected topics
More in Ethics and Governance
Sources
- Cavoukian, Privacy by DesignCavoukian, A. Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario, Canada, 2011 (originally published 2009).Source of the proactive, default-protective, embedded, end-to-end and transparent principles.
- Regulation (EU) 2016/679, Article 25, "Data protection by design and by default." Official Journal of the European Union, L 119, 4 May 2016.The binding version of the principle, including the requirement that by default only data necessary for each specific purpose is processed.
- Gebru, T., Morgenstern, J., Vecchione, B., Vaughan, J. W., Wallach, H., Daumé III, H., & Crawford, K. "Datasheets for Datasets." Communications of the ACM, 64(12), 86-92, 2021.Proposes a standard record for a dataset covering motivation, composition, collection process and recommended uses.
- Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I. D., & Gebru, T. "Model Cards for Model Reporting." Conference on Fairness, Accountability, and Transparency (FAT*), 2019.Proposes reporting model performance disaggregated by group alongside intended use and known limitations.