It has become increasingly difficult for individuals to exercise meaningful control over the personal data they disclose to companies or to understand and track the ways in which that data is exchanged and used. These developments have led to an emerging consensus that existing privacy and data protection laws offer individuals insufficient protections against harms stemming from current data practices. However, an effective and ethically justified way forward remains elusive. To inform policy in this area, we propose the Ethical Data Practices framework. The framework outlines six principles relevant to the collection and use of personal data-minimizing harm, fairly distributing benefits and burdens, respecting autonomy, transparency, accountability, and inclusion-and translates these principles into action-guiding practical imperatives for companies that process personal data. In addition to informing policy, the practical imperatives can be voluntarily adopted by companies to promote ethical data practices.
Keywords: Confidentiality & privacy; health policy; regulatory issues.