Social, ethical and legal issues in using data: HSC Enterprise Computing Data Science
“Investigate the ethical use of data for social or enterprise research purposes; explore social, ethical and legal issues associated with using data, including bias, accuracy of the collected data, metadata, copyright and acknowledgement of source data, intellectual property and respect for ownership, including Indigenous Cultural and Intellectual Property (ICIP), permissions, rights and privacy of individuals, including cultural responsibility, and security”
Ethical data use needs informed consent, purpose limitation, minimisation, de-identification and honest reporting. The issues to apply are bias, accuracy, metadata, copyright and acknowledgement, intellectual property including ICIP, permissions, privacy and cultural responsibility, and security. Say whether each is social, ethical or legal in the scenario.
Jump to a section
What this dot point is asking
NESA wants you to judge whether data is used ethically in research and by enterprises, and to discuss a specific list of social, ethical and legal issues. Learn the list, because questions often name one issue and ask you to apply it to a scenario.
The answer
Ethical use of data for research
Whether the research is social (a university study) or enterprise (market research), ethical data use rests on:
- Informed consent: participants know what is collected, why and how, and can decline or withdraw.
- Purpose limitation: data is used only for the stated purpose.
- Minimisation: collect only what is needed.
- De-identification: remove identifiers where possible, and consider re-identification risk when datasets are combined.
- Benefit and harm: the value of the research should outweigh risks to participants, especially vulnerable groups.
- Transparency and accountability: methods and limitations are reported honestly.
The issues NESA lists
- Bias: sampling, measurement and historical bias make data unfair or unrepresentative, and decisions based on it can discriminate.
- Accuracy of the collected data: errors lead to wrong decisions (incorrect credit records, wrong medical data). Organisations must take reasonable steps to keep data accurate and let people correct it.
- Metadata: data about data (author, time, GPS location, device). It helps organise and verify data, but it can reveal more than intended.
- Copyright and acknowledgement of source data: datasets, images and text may be protected under the Copyright Act 1968 (Cth). Use data within its licence (for example Creative Commons attribution) and cite the source.
- Intellectual property and respect for ownership: databases, algorithms and designs belong to their creators or employers. Using them without permission breaches ownership rights.
- Indigenous Cultural and Intellectual Property (ICIP): Aboriginal and Torres Strait Islander peoples' rights to their cultural heritage, including knowledge, stories, languages, art and designs. ICIP is often communal and ongoing, so copyright alone does not protect it. Respect requires consultation, consent, attribution and benefit sharing.
- Permissions, rights and privacy of individuals, including cultural responsibility: people have rights over their personal information and images; some cultural material (images of people who have died, sacred knowledge) carries responsibilities beyond the law.
- Security: collected data must be protected from unauthorised access, loss and misuse through encryption, access control, backups and breach response plans.
- Legal: required by law (privacy law, copyright law).
- Ethical: what is right, even if legal (not exploiting vulnerable users).
- Social: effects on communities and society (loss of trust, discrimination, cultural harm).
Many issues are all three. Say which aspect you are discussing.
A council wants to publish an open dataset of park usage from its smart bins and footpath sensors.
- Accuracy: sensors miss people in groups; publish a note on known limitations.
- Metadata: include collection dates, sensor locations and definitions so others use the data correctly.
- Privacy: aggregate counts per hour so no individual can be tracked.
- Copyright: release under a Creative Commons attribution licence and ask users to acknowledge the council.
- Security: keep the raw sensor feed private and publish only the processed, aggregated dataset.
- Treating "public" data as fair game
- Public availability does not equal consent for every use.
- Confusing ICIP with copyright
- ICIP includes communal, oral and sacred knowledge that copyright does not cover.
- Listing issues without applying them
- Name the issue, explain it in the scenario and suggest a response.
Practice questions
Original practice questions graded from foundation to exam level, each with a full worked solution. Try them before revealing the solution.
foundation3 marksOutline three ethical requirements for a business that surveys customers about their health habits.Show worked solution →
- Informed consent: explain what is collected and why, and let people decline or withdraw.
- Privacy and security: de-identify responses where possible, encrypt stored data and limit access.
- Purpose limitation: use the data only for the stated research, not for unrelated marketing.
Marking guide: 1 mark per relevant requirement.
core4 marksA tourism company wants to use Aboriginal artwork and Dreaming stories from a local community in its app. Explain the ICIP and cultural responsibility issues and how the company should proceed.Show worked solution →
The artwork and stories are Indigenous Cultural and Intellectual Property. The community has the right to decide whether, how and by whom they are shared. Some stories may be sacred or restricted by gender, age or place, and using them without permission is disrespectful and may cause cultural harm, even if copyright law does not strictly apply.
The company should consult the community's recognised representatives early, seek free, prior and informed consent, agree on attribution, benefit sharing and any restrictions in writing, allow the community to review how content is used, and remove content if consent is withdrawn.
Marking guide: 2 marks for explaining ICIP and cultural issues, 2 marks for appropriate protocols.
exam6 marksA university research team wants to scrape public social media posts to study young people's mental health. Evaluate the social, ethical and legal issues in this plan.Show worked solution →
- Consent and privacy
- Posts being public does not mean users consented to research use, and mental health is sensitive information. Young users may not understand how their posts can be analysed, raising ethical concerns about informed consent and potential harm if individuals are identifiable.
- Legal issues
- Scraping may breach the platform's terms of service. Personal and health information is protected under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and researchers may need human research ethics approval.
- Accuracy and bias
- Posts may be exaggerated, sarcastic or written by bots, and the sample only includes people who post publicly, so conclusions may not represent young people generally.
- Metadata and security
- Location and time metadata could re-identify users; the dataset must be de-identified, stored securely and deleted after the study.
- Evaluation
- The research could produce socially valuable insight, but only if it has ethics approval, uses de-identified data, respects platform terms and acknowledges its sampling limitations. Without these, the plan is ethically and legally unsound.
Marking guide: 1 mark each for consent/privacy, legal, accuracy/bias and security issues (4 marks), 2 marks for a balanced, justified evaluation.