It's not just the realm of data scientists and ethicists. As data workers it is imperative that we remain aware of our ethical obligations around gathering and using personally identifiable information. It is also on us to protect and keep the data that we collect secure. Harvard Business School Online has a list of five key tenets of data security for businesses. These are ownership, transparency, privacy, intention, and being aware of outcomes.
The first principles is ownership, specifically that individuals have ownership over their personal information. This means it's important to obtain consent before collecting data. This can be done in a number of ways, from written agreements to the ubiquitous popups allowing tracking to be done through cookies. The second principle is transparency. This means that data subjects should know or be able to find out how you collect, store, and use their data. This should be apparent when individuals give consent to the collection of their data, or there should be digital policies that users can review. The third principle is that individuals have a right to privacy. The best way to ensure this is to keep personally identifiable information in a secure database. This can also be accomplished by anonymizing data, so that even if something happens the data isn't traceable back to a specific person.
The fourth principle is to monitor your own intentions around data. You should assess your intentions behind the collection and use of any data, and whether or not each data point is necessary to collect. You should strive to collect the minimum viable amount of data needed to best protect your users. Lastly, it's important for us to consider outcomes. Even with the best of intentions, our use of data could possibly affect individuals or groups in a negative way. By considering the possible outcomes of our work beforehand, we can work to mitigate the disproportionate impact our data analysis and usage can have. By keeping all of the above in mind, we can strive to make meaningful change through our work while still respecting and protecting those whose data we utilize.