Data Protection Moral Dilemmas

GDPR compliance answers whether you may process data and how, not whether you should. This blog looks at a few examples of moral dilemmas DPOs may face and what to do (or not) about them.

A data protection moral dilemma arises where processing is lawful under the GDPR but conflicts with:

what the organisation says it stands for
the reasonable expectations of the people affected
your own views as a practitioner.

Those three aren't the same and they don't always pull the same way. A decision can be perfectly aligned with company policy and still leave the data subject blindsided. It can satisfy everyone in the room and still be the thing you're still thinking about years later.

It’s a question of, only because you can, does it mean you should?

If something is likely to raise eyebrows, the DPO and their team need to decide which route to take and how to explain their choice beyond the law.

Lawful but…

Data Sharing

Allow me to share my first data protection dilemma.

I was working on a police request. The materials caught by it included information about a third party that surprised me because:

a) the request didn’t say anything about it, and

b) that third party was vulnerable.

Because of b), I knew that by sending this information, other organisations would get involved. Although it would have been the right thing to happen, I felt I would be responsible for it.

My team decided there was nothing in the law to suggest we shouldn’t or mustn’t include that information about the third party. As a discloser to the police and given the seriousness of the matter, we thought it may even be detrimental to the third party (and an incomplete response) not to include them.

I still wonder what happened to these people and whether this request changed their life course.

In this “dilemma”, the request was lawful and so was the response, but the response itself sat hard with me because I felt like I was asked to make a choice I didn’t want to make. Of course, this was just my job and it could have been someone else from my team. But this is a reminder that your views as a person do matter very much in your role as a data protection advisor.

Employee Monitoring

Sometime ago I wrote about the lawfulness of employee tracking, inspired by Meta’s plans at the time.

On paper, legitimate interests could suffice if they are properly defined and considered. In theory, your DPO may very well sign this off and say it’s a balanced exercise and people’s rights aren’t badly affected.

In principle, however, should we be tracking employees’ every click and mouse move? What kind of organisation do we become and do we like our new strategy?

The GDPR might say go ahead, but it would be a policy decision whether or not it’s worth it.

Online Tracking

Cookie fatigue is real and people just click whatever button on the cookie banner just so it can disappear as fast as possible.

In theory, you have consent for placing cookies, but in practice, it’s rarely of the needed standard. Should a website be relying on this consent when the website content is more sensitive, for instance health related or about gambling, and there are targeting cookies or Meta pixels that will allow Facebook to show the user similar ads?

I wrote about the real privacy price for the consent or pay mechanism and how it quickly crumbles when you consider sensitive issues such as miscarriage. The ICO says this mechanism could work, but only because the regulator has not given a red light, should it continue as a money-making activity?

Cycle Tracking

I am a fan of technology that helps women with their well-being and understanding their bodies, cycle tracking devices included.

However, in the US especially, the company developing them may legally be required to provide cycle information to the police, which can become a serious problem for the woman using it in certain states.

Where a US law bans abortion, this information in the hands of a government authority can become dangerous to a woman who is already vulnerable and grieving. It’s a much wider political and societal decision whether this should be the default even though some laws allow it.

Read my blog on online data dangers focusing on women.

Not Notifiable Personal Breaches

Personal data breaches that are unlikely to cause high risk to people’s rights and freedoms don’t have to be communicated to them. The threshold to notify people is usually higher than that of notifying the regulator, and the decision on what to do will often fall on the facts of the breach.

Notifying people can be onerous and come at “a price” for the organisation:

Admitting to a mistake
Attracting bad press
Damaging the brand and trust
Managing people’s responses and complaints
Communicating to a large number of people.

What that list has in common is that every item on it is a cost to the organisation, not to the people whose data it was. That matters because the threshold for notification is about risk to individuals and yet, the pressure in the room will almost always be about brand.

This is where the dilemma actually is – in the case where senior management may reach for the "not high risk" conclusion because the alternative is bad press.

On paper, a notification may not be required, but the team should consider what notification would cost them and what the lack of notification would cost the people affected.

Solving Dilemmas

I realise I have asked many “should you”-s in this blog but this is the nature of a dilemma. Apart from “use your judgement”, below are some notes you could use for next time.

Start with the Legal Question

Is what you’re doing lawful? If yes, continue with “only because we can, does it mean we should?” and record this in your advice note.

If the answer is no, you don’t have a dilemma but an activity that you either have to influence to change or a risk you need to record because of unlawful processing.

Apply the Gut Test

After deciding something is lawful, if you can explain the decision to the data subject alone without shifting in your seat, you've probably got it right.

Apply the same standard when you say no. A refusal is a decision too, and it has consequences for someone, usually someone who never finds out it was made. "No" should be as explainable as "yes".

In the end, it is only your advice. The organisation is the controller and may go another way. You'll have done your part, and you'll have a record of it.