Data and Intelligence Network: ethics framework

Appendix 1: The Ethics Workbook

The Ethics Assessment Process will be set out in a workbook to help guide project teams through the life of the project. Each of the stages will have prompt questions to aid that journey and to help this to be an integral part of the process and not a one off exercise. The stages it covers are: The Project; The Data or technology; The Public; Project Close.

1. The Project

1.1 State the purpose and scope of your project.

Necessary: What is the particular need for your project? How have you shown that your project is proportionate to the intended aims?

1.2 State the intended impact of your project on the pandemic.

Beneficial: How have you justified the need for your project in the context of the public health emergency?

1.3 What is the public benefit of your project?

- At an individual level?

- At an aggregated level?

- At an institutional level?

- At a societal level?

Beneficial: How have you considered public benefit across a variety of groups, communities and categories?

1.4 What are the potential risks of your project?

- To the individual?

- At an aggregated level?

- At an institutional level?

- At a societal level?

Insightful: What steps have you taken to identify limitations of the project with regard to both the data and the intended impacts?

1.5 How do you plan to mitigate these risks?

Responsible: How will you ensure you use the data responsibly?

Observant: What relevant legislation and codes of practice will you reference to support your answers?

1.6 What other methods have you considered to deliver this project? Why have you selected this method?

Insightful: How have you shown that data is the only way you could achieve the intended outcomes?

Necessary: What makes this method proportionate to the project aims?

1.7 Which other stakeholders or institutions might benefit (directly or indirectly) from the use of this data and/or methodology?

Responsible: How have you identified potential positive and negative applications of your project? What are the implications?

2. The Data and Digital Technology

2.1 What data sources are required for this project?

Necessary: How have you identified and chosen these sources?

2.2. How will these data sources be used, for what purpose, for how long and what will happen to it at the end of the project?

2.3 Have you completed the necessary Information Governance / Data Management /Data Protection Impact Assessment protocols for a COVID-19 D&I Network project?

Observant: Reference the relevant legislation and codes of practice appropriate to your project. Evidence clearly additional legislation as a result of the Pandemic.

2.4 What steps have you taken to ensure that the minimum data required, or synthetic data, is used in your project?

• Responsible: What data variables have you chosen to include and why?
• How are you balancing public benefit and privacy against project accuracy?

2.5 If bringing together data sets, what are the risks of this data linkage exercise?

- At an individual level?

- At an aggregated level?

- At an institutional level?

- At a societal level?

Insightful: What steps have you taken to mitigate any risks associated with data linkage?

2.6 What steps have you taken to ensure the limitations of the data and the digital technology being used are fully understood, including metadata?

• Insightful: Have you considered limitations such as bias, representation, data gaps, data variables, accuracy, excessiveness etc.? How have you communicated any limitations to the project team?

2.7 How are you identifying and how do you intend to deal with errors and biases in the data?

Accountable: What strategies have you used? How have you ensured that these will be reviewed and assessed appropriately?

2.8 How will you embed privacy by design in any insights or outputs of the project?

2.9 Have you designed the approach with the public, the service user, policy team or a subject matter expert; including providing sufficient time and information for this to be effective?

Widely Participatory: How have you engaged with the public on your project so far, and how has this impacted your project's design?

2.10 How will you communicate any assumptions throughout the project?

Accountable: How have you justified any assumptions made?

Beneficial: How have you ensured that assumptions made are still for public benefit?

Widely Participatory: How have you ensured that this information is widely accessible?

2.11 How will you communicate the accuracy, credibility and reliability of any insights and outputs?

Insightful: How have you documented the accuracy of your project?

Widely Participatory: What steps have you taken to ensure this information is widely accessible?

2.12 How will you ensure replicability? Could another analyst repeat your procedure based on your documentation?

Accountable: How have you documented your work, and who can access this information?

2.13 Where can you publish your methodology and outputs?

Observant: What guidance, legislation and requirements have you considered when decided where to publish your work?

Widely Participatory: How, if appropriate, have you planned to make this work widely accessible?

2.14 How much of the work can you and your team speak about openly while protecting privacy?

Beneficial: What steps have you taken to ensure the whole project team is aware of their responsibilities?

2.15 How do you intend to explain the methodology and output of the project to a variety of audiences?

Accountable: What communications channels have you considered to ensure that your project methodology and results are easily accessible and transparent?

Widely Participatory: What format/language/style would allow your methods to be widely accessible? If not appropriate to publish your findings publicly, explain why.

3. The Public

3.1 Have you clearly explained why you need to use this data in ways that members of the public could understand?

3.2 Do the public identify the same benefits and risks? Do the public balance them in the same way?

3.3 Does this use of data or technology interfere with or risk the rights or freedoms of individuals?

- If the answer is yes, is there a less intrusive way of achieving the objective?

- have you set out a mitigation strategy to reduce the risks?

3.4 How will you reconcile the rights of the individual with the interests of the community or society?

- Have you engaged the public to ensure the risk/ benefit analysis is viewed by them in the same way?

- By using data irresponsibly that the public has freely volunteered, would your project jeopardise people providing this again in the future?

- If yes, what is your mitigation strategy?

3.5 How has your proposal taken account of the views of the public and the groups adversely affected?

3.6 Have you thought through how you will engage the public in using the outcomes in the next phase of the work?

3.7 Have you completed an engagement plan which segments audiences, identify existing opportunities for engagement and plans for public participation for the design, delivery and scrutiny of your work; particularly where issues are contentious. Have you got senior sign-off for this plan, including the resources needed and the implications for the timeframe for decision-making and implementation?

3.8 How will you ensure that the whole team working on the project are aware of the D&IN's ethics values and principles?

3.9 How have you communicated an appropriate reporting framework for any ethical issues that arise during project delivery and after implementation?

4. Project Close Out

4.1 How confident are you that the outputs are valid and reliable, and that any limitations and assumptions have been accounted for?

4.2 What is the quality of the project outputs, and how does this stack up against the project objectives?

4.3 If necessary, how can you (or external scrutiny) check that the combined data or algorithm is achieving the right output decision when new data is added?

4.4. What technology, if any, will be required for your project outputs to be used successfully? What are the implications of using this technology? (E.g. mobile apps)

4.5 Who has access to insights or outputs of the project, and how are they being given the appropriate support and training to use these outputs responsibly?

4.6. To which audiences will you communicate your findings/share project outputs, and why?

4.7 What structures are in place to ensure that your project outputs are used only for their original purpose and in the context of the pandemic? Are these boundaries clearly stated?

For further information, contact

Data.intelligencenetwork@gov.scot