Ethical Issues
Collecting data about individuals
Collect only the fields genuinely needed for the database system (e.g., name, contact, payment reference).
Privacy concerns
Customer data must be protected from unnecessary exposure. This links to the Australian Privacy Principles, confidentiality in the CIA triad, and to symmetric/asymmetric encryption protecting stored and transmitted personal data.
Appropriate use of data
Data collected for one purpose (e.g. bookings) shouldn’t be reused elsewhere for other purposes without consent. Authorisation (AAA) and access control lists enforce this by limiting what each user/system can do with the data. This can also relate to APP5.
Reliability of data sources
External data feeding into the database (e.g. session times, pricing) must be accurate. See Factors influencing quality of data.
Acknowledgement of data sources
External datasets used in the database should be credited in documentation.
Use of data mining
Data mining is taking multiple sources of data, mining that data to reveal new information not known previously. Data mining can reveal sensitive information beyond original consent. Australian Privacy Principles and ICT Code of Conduct could limit this, but it’s more likely to just state an example and recommend this doesn’t occur – as it’s not usually illegal.
Security Issues
Keeping personal data private
Implemented directly through symmetric encryption (data at rest, e.g. stored payment details) and asymmetric encryption (data in transit, e.g. booking submissions over the network), plus confidentiality in the CIA triad.
Backups of organisational data
Supports availability in the CIA triad, and is a key mitigation against ransomware and other threats that target data availability.
Restricting access to data
Enforced through access control lists, firewall filtering, and authentication/authorisation (AAA framework), ensuring only approved users/roles can read or modify specific data.
Ownership and control of data
Supported by user training, the ICT code of conduct, and accounting (AAA), which makes actions on data traceable to a responsible individual.
Legal Issues
See Privacy Act 1988