Ethics: good, evil, and moral duty: business ethics are absolutely critical today, but first organizations must define what is ethical and understand that what is ethical today may not be ethical tomorrow. (BusinessMatters).

At the Core

This article:

* Discusses how ethics affects information management

* Examines how organizations can deal with shifting ethical rules

The importance of ethical behavior can be found everywhere in newspaper headlines today. Watching a world-renowned auditing company implode over a period of a few short months because of its perceived violation of ethical norms should place ethics on everyone's business agenda.

The news is filled with examples of how unethical practices strike at the heart of information management. Erasing data is potentially an obstruction of justice; transmission of data is potentially an invasion of privacy; and accidental disclosure of data is a potential dereliction of duty to protect the property of clients.

Ethics can be approached from at least two different directions. One can speak about ethics in the abstract, never bringing individuals into the discussion and, in doing so, ignore its very essence, or allow that ethics is a personal, contentious issue, admitting that any honest discussion must use real-life examples to serve any useful purpose.

Ethics is about deciding whether an action is good or bad and what to do about it if it is "bad." The problem in discussing ethics is that it turns everyone into judge and jury, each deciding what is good or bad behavior, inevitably attempting to impose that judgment on others. The community to which we belong, then, decides the ultimate ethics.

What Is Ethical?

The first challenge is to determine what is ethical and to define what is right and wrong. This isn't easy. If it were, there would be peace on earth. The technique available to sidestep the debate is to publish a proclamation or code of ethics that states clearly what is right and wrong within a particular community or organization as defined by that group. By publishing its code of ethics, an organization states "These are the rules we adhere to." However, publishing ethics doesn't guarantee everyone will agree with them. Consider the following ethical directive taken from the Australian Computer Society (ACS) Code of Ethics (www.acs.org.au/national/pospaper/acs131.htm):

4.3.1 Priorities: I must place the interests of the community above those of personal or sectional interests.

The ACS included this moral directive in its code of ethics only after receiving its voting members' majority approval; as such, it represents the group's ethical beliefs. Yet in the author's opinion, the directive is itself "unethical" because he does not personally believe that the group's interests should always supersede the individual's rights.

The purpose of this example is not to denigrate the ACS' Ethics. Its document is excellent, worthy of examination and, perhaps, even adoption by other organizations. It is used, juxtaposed with the author's own beliefs, to demonstrate that one community's ethics can sometimes conflict with individual ethics.

The point is that one society's chopping block is another's pedestal. To assume that an ethical rule adhered to at home or in a particular organization is ethical elsewhere inevitably causes problems. Privacy with respect to unsolicited e-mail is one such example. Countries such as the United Kingdom, Canada, and the United States have begun to define through the legal process what is right and wrong with respect to bulk e-mail. Other countries have, as of yet, done nothing. Organizations embarking on international e-mail marketing campaigns should not assume their mail strategy will receive equal acceptance under the law in every country. What is welcomed or ignored in South America may result in a lawsuit against the sender elsewhere.

If the first challenge is to determine what is ethical, the second is how to respond to unethical behavior. Ethics entails the underlying belief that encountering a "wrong" behavior or practice involves a moral duty to do something about it. If not, the observer is as guilty as the perpetrator. At best, this is a heavy burden that some carry better than others. Years ago, a young, naive information technology manager was asked to pre-screen candidates for an IT position with a subsidiary--a simple enough task until ethics entered the scene. After interviewing 20 potential candidates, the manager sent three of them along to the second interview. A day later, the manager was taken aside and told in ambiguous phrases that he shouldn't waste management's time by sending certain "types" to second interviews. Welcome to Ethics 101.

The example illustrates that in most ethical dilemmas, the person being unethical is fully aware of this fact. Advising management that discriminatory hiring practices are wrong serves no useful function. They already know that, but they choose to do it anyway. They also wish to avoid bringing the issue into the full light of day. That's why the conversation between the young manager and his superior was a surreal, almost Kafka-like experience, with nothing really said and everything inferred: "Nudge, nudge, wink, wink, you know what I mean?"

The sad fact is that little is easy when encountering unethical practices that are in line with the organization's unwritten ethics. In these circumstances, there are at least four distinct choices:

1. Do nothing. Stay with the organization and become party to its practices.

2. Leave the organization, leaving behind the unresolved problem.

3. Make the unethical practice public and prepare to live with the sometimes huge and lasting consequences of a "righteous crusade."

4. Use the current example of imploding audit companies to make a strong case that an unethical practice's "benefits" are insufficient to justify the company's risk of becoming a headline in newspapers worldwide.

Ethical Information Management

Information managers' responsibilities are clearly detailed in "ISO/PDTR 15489-2: Information and Documentation--Records Management." Strip away all the trappings and the core function is one of stewardship. IM professionals are the custodians of data chartered to protect it from (1) loss and/or tampering, and (2) unauthorized use or access.

Data is defined here as recorded information, regardless of storage medium or the degree to which raw data is processed. Also, maintaining access to data is part and parcel of protecting it from loss, since inaccessible data is as good as lost. Protecting data from loss includes preventing destruction by either accidental or intentional shredding. If the data retention process is well thought out, this is relatively easy to manage, especially if the rules regarding data ownership are well defined.

First and foremost, all data is owned by the organizational entity. The responsibilities of ownership are then relegated to particular departments or functions within the organization. For example, the accounting department owns accounting information, which, in turn, is maintained in trust by IM. An authorized individual within the accounting department could decide to erase an account and all transactions relating to that account from the active system. This active data falls well within their domain of ownership. What they could not do is erase the audit trail that records that erasure. Nor could they request that all traces of the account and related transactions be erased from the father/grandfather/great-grandfather cycle of backups, nor from the archival data storage.

This type of historical data belongs only to the organization, not to individual departments. In other words, departmental ownership extends to the data itself and not to the historical record of what happened to that data. Nor is historical data owned by IM; they are merely custodians of it for the time period required by law.

The organization's ethics are afforded unique protection if deep erasure is either impossible or extremely complicated and time consuming. If IM data retention processes are properly installed and functional, it does not matter if a rogue analyst shreds a thousand documents. Competent stewardship exercised by IM can prevent most, if not all, incidents of ethical breach of conduct. Naturally, data tampering is a step below outright erasure. But again, if proper audit trails of changes are maintained, then the organization is protected against intentional ethical violations by individuals.

In addition, audit trails of erasure or tampering could include built-in warning systems that would flag suspicious behavior. The degree to which these safeguards are installed and utilized is a measure of how much importance the organization places on ethical practices.

In a sense IM professionals are the only true historians we have. They make no judgments of the past. As guardians of past data, they strive to preserve it as accurately and as permanently as they can. If they succeed, they've preserved not only data, but also the "truth" of the organization. The IM responsibility to protect data from unauthorized use or access poses more difficult ethical challenges. System security provides the necessary barrier to prevent casual breach of ethics. Browsing through the payroll files, whether done with idle curiosity or malicious intent, is prevented by the most rudimentary of security procedures.

As with all systems, sincerity in their use is proven not by how the safeguards were originally implemented, but by how they are maintained. When John Doe leaves the organization, are all the passwords in his possession automatically deleted from the system or changed? If not, IM is grossly negligent with respect to its role as data custodian. Well-implemented IM systems can create the necessary barriers to prevent both accidental and intentional ethical violations.

Issues relating to what is right and what is wrong with respect to data access are simple. The ethical mandate boils down to "try and prevent others from doing the wrong thing," and "do the right thing." Data use, however, is the proverbial can of worms.

Shifting Ethical Rules

Organizations have in their databases contact information for a wide variety of individuals--patients, clients, vendors, advertisers, customers, subscribers, and so on. All this data was collected at some point in time for a particular business reason. Assume that yesterday one such organization merged with a company that produces "product X."

Product X's target market is the very people in the database. The problem is that X has absolutely nothing to do with the initial business reason that got those contacts into the database. Is it appropriate to send them information on product X? A decade ago, the answer was affirmative; today, it might not be.

In Canada, the answer is a resounding "No." According to the Canadian Personal Information Protection and Electronic Documents Act (www.privcom.gc.ca/information/guide_e.asp#007, the company must

* inform the individual in a meaningful way of the purposes for the collection, use, or disclosure of personal data

* obtain the individual's consent before or at the time of collection, as well as when a new use is identified

Canada is not alone in this approach. In the United States, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (http://aspe.hhs.gov/ admnsimp/final/pvcguide1.htm) rules as follows with respect to marketing efforts using patient information:

   Covered entities may not give away or sell lists of patients or enrollees
   without obtaining authorization from each person on the list.

Other countries are formulating similar legislation, and these rulings affect all trade practices. The challenge organizations face is not just that the rules are changing, but that they are changing at different speeds in different countries, affecting what were once normal business processes. What was legal and ethical yesterday is not only "spam" today, but it is also unethical and could land the sender in jail.

The driving force behind these shifting ethical rules is the unrelenting advance of technology. Every electronic transaction leaves behind an audit trail. Individuals can be electronically tracked from cradle to grave. With that power comes increased opportunities to abuse the rights and privileges which, in the past, were fairly secure and taken for granted. In response to these new tracking capabilities, society erects new ethical barriers to protect privacy and restrict indiscriminate access.

Privacy and its protection is fraught with contradictions. If entities continue to send spam, there should be some way to prosecute them under the law. Yet, privacy implies the right to place oneself behind a layer of anonymity when using the Internet, where no one has the right to know another person's true identity. So what about someone who sends spam under the veil of anonymity? Whose right to privacy takes precedence, the recipient's or the sender's? Does data mining, the sole purpose of which is to find new patterns in data in order to create new uses for it, contravene the ethical concept to obtain the individual's consent before or at the time of collection, as well as when a new use is identified? Does the very notion of target marketing violate an individual's right to privacy? On the other hand, what about customers who want certain vendors to contact them using data at the vendor's disposal, for example, to track literary or musical tastes? The vendors can't; ethical rules forbid it.

None of these questions have answers that will stand the test of time or locality. What was true a decade ago is not true today. What is currently true in the United States may not be true in the United Kingdom, today or a year from now. Globalization ensures that the community in which we operate and in which the ethical rules are set is too fractured for crystal-clear absolutes to exist.

The answer to some of these dilemmas is simple. Create a publicly accessible code of ethics clearly stating what an organization will and will not do with the data in its possession. Making it visible accomplishes two slightly different goals. First, communicating beliefs allows the community to inspect them. If the beliefs are at odds with what the community accepts as true, then it will swiftly bring this to attention and provide the opportunity to respond accordingly. Second, if people find themselves in that awful place where they are ethically opposed to the organization, they can avail themselves of Shakepeare's famous admonition: "To thine own self be true."

References

Kahn, Jeffery P. "Medicine in Your Junk Mail." CNN.com. Available at www.cnn.com/2002/HEALTH/07/08/ethics.matters/index.html (accessed 24 July 2002).

RELATED ARTICLE: Medicine in the mailbox.

Most consumers don't mind receiving free samples of toothpaste and shampoo in the mail, but one American drew the line when she received a sample of a prescription medication.

An unsolicited sample of Prozac arrived in her mailbox in a hand-addressed manila envelope from Walgreens drugstore. A "Dear Patient" form letter enclosed with the one-month free trial of Prozac Weekly said, "Congratulations on being one step closer to full recovery."

But she didn't appreciate the offer. She filed a class-action lawsuit stating that Walgreens, a local hospital, three doctors, and Prozac maker Eli Lilly misused her patient information and medical records and invaded her privacy. It also accuses the drugstore and Lilly of engaging in the unauthorized practice of medicine.

Consumer advocates say they hope that if the woman wins her lawsuit, it will stop the trend of sending unsolicited trial samples of medication to unsuspecting consumers' homes. The marketing practice is more than a little questionable and could potentially cause more harm than just violating patient privacy. For example, who has access to patient records and under what circumstances? And, should patients receive, let alone take, prescription drugs without first consulting their doctor? What if a child gets into the mail and takes the medication?

These are questions that the lawsuit might answer once and for all but, for now, the parties clearly crossed the ethical line.

READ MORE ABOUT IT

Electronic Frontier Foundation: www.eff.org (accessed 23 July 2002).

Peter de lager is a speaker, consultant, and author. He may be reached at [e-mail].