MIT8111 Ethics and Law Hub

Study Session 1 · Lesson slides 01 · Readings 1A, 1B, 1C

Data privacy and legal frameworks (GDPR, HIPAA, NDPR)

In one sentence: data privacy is a person's right to control who sees and uses their personal information, and laws such as the GDPR (General Data Protection Regulation, Europe), HIPAA (Health Insurance Portability and Accountability Act, United States) and the NDPR (Nigeria Data Protection Regulation) turn that right into rules that IT systems must be designed to follow, using both technical and organisational measures.

Think of it like

Your medical file at a private hospital in Port Harcourt. You hand it over so the doctor can treat you. You would be upset if the hospital sold your file to a drug company for adverts, kept it unlocked at reception, or kept your details for 30 years after you moved away. Privacy law says: use the data only for the reason it was collected, take only what you need, keep it safe, keep it accurate, delete it when you no longer need it, and be able to prove you did all of that.

Part A: What data privacy is and why it matters

The course reading defines data privacy as "the protection of personal data from those who should not have access to it and the ability of individuals to determine who can access their personal information." So privacy has two halves: protection (keeping data away from the wrong people) and control (letting the person decide who sees, uses or shares it).

Why it matters

It builds and keeps trust. Strong privacy practices prevent misuse such as identity theft, fraud and discrimination, and show ethical behaviour towards stakeholders.

Why regulators care now

Big data, AI (Artificial Intelligence) and cross-border data flows. Nearly 79% of the world's population is now covered by some form of privacy law (GDPR, NDPR, and US state laws like the CCPA, California Consumer Privacy Act).

Personal data is any information that identifies a living person directly or indirectly: name, phone number, NIN (National Identification Number), BVN (Bank Verification Number), address, location, photos, health records. Sensitive data (health, biometrics, religion, political views) needs extra care because misuse causes bigger harm.

Two roles you must know: controller and processor

Role	Plain meaning	Example
Data controller	Decides why and how personal data is processed	A bank in Lagos decides to collect customers' BVNs for account opening
Data processor	Handles data on behalf of the controller, following its instructions	The cloud company that stores the bank's customer database
Data subject	The living person the data is about	The customer

Memory hook

Controller = Chooses. Processor = Performs. The controller is still responsible even when a processor does the work, which is why contracts with vendors matter (Part F).

Part B: The three laws compared (GDPR, HIPAA, NDPR)

	GDPR (European Union)	HIPAA (United States)	NDPR (Nigeria)
Year	2018	1996	2019
Who it covers	Any organisation processing personal data of EU residents, even outside the EU if it targets or monitors them (extraterritorial)	US healthcare providers, health plans, healthcare clearinghouses and their business associates. Not outside the US, not non-health data	Data processed in Nigeria, and data of Nigerian citizens wherever they live
Main focus	All personal data, broad principles and strong rights	Confidentiality, integrity and security of health information	Citizens' data and the digital economy; modelled on the GDPR
Rights	The most comprehensive: access, rectification, erasure, restriction, portability, objection	Limited to health data: mainly access, correction and an accounting of disclosures	Similar to GDPR: access, rectification, erasure, portability, objection
Key duties	Privacy by design and default; DPIAs (Data Protection Impact Assessments) for high-risk processing; DPOs; 72-hour breach report	Three rules: Privacy Rule, Security Rule (administrative, technical and physical safeguards for electronic health records), Breach Notification Rule	Appoint DPOs, publish a data protection policy, submit audit reports; 72-hour breach report
Penalties	Up to €20 million or 4% of global annual turnover, whichever is higher	Up to $50,000 per violation, capped at $1.5 million per year, plus possible criminal penalties	For controllers handling data of more than 10,000 people: ₦10 million or 2% of annual gross revenue, whichever is greater (smaller controllers: ₦2 million or 1%)

Exam trap

HIPAA is not a global law. If a question describes a Nigerian hospital or a European clinic, HIPAA does not apply. HIPAA also does not stress data minimisation as strongly as the GDPR and NDPR. And the GDPR reaches companies outside Europe: a Nigerian app that targets users in Germany must comply.

Nigeria today

The readings use the NDPR (2019). In 2023 Nigeria passed the NDPA (Nigeria Data Protection Act 2023), which set up the NDPC (Nigeria Data Protection Commission) as the regulator. The slides mention the NDPA alongside the GDPR and HIPAA, and the readings note that the NDPC is short of staff and funding. Earlier the agency in charge was NITDA (National Information Technology Development Agency). In a case study answer, name the NDPR as the course does and add that the NDPA 2023 now sits above it.

One fine detail differs between readings: Reading 1A gives the NDPR fine as "₦10 million or 2%", while Reading 1C says "₦10 million or 1%" for controllers with over 10,000 subjects. The regulation's wording is the version in the table (2% for the larger group, 1% for the smaller). If a CA question gives only one of these figures among the options, pick the one offered.

Part C: The seven principles of data protection

Every lawful system follows these principles. The slides pair each principle with what it means for an IT system, which is exactly how CA questions are written.

Accountability sits under everything: you must be able to show you followed the other six.

Principle	Plain meaning	What the IT system must do (from the slides)
Lawfulness, fairness and transparency	Have a valid legal reason, be fair, and tell people clearly	Log the legal basis for each processing activity; show clear privacy notices
Purpose limitation	Collect for specified, explicit, legitimate purposes; don't reuse for something incompatible	Tag data with purpose flags; block unauthorised reuse
Data minimisation	Collect only what is strictly necessary	Forms with only the necessary mandatory fields; auto-delete excess data
Accuracy	Keep data correct and current; fix errors quickly	Edit and audit workflows; user portals where people update their own details
Storage limitation	Keep data only as long as needed	Automated deletion schedules and archive rules
Integrity and confidentiality	Protect data from breaches, leaks and damage	Encryption, access controls, regular penetration testing (authorised simulated attacks)
Accountability	Demonstrate compliance proactively	Audit trails, documentation tools and DPIA frameworks

Telling them apart

A loan app collects your BVN to verify you (purpose), then uses it to sell insurance: purpose limitation broken. A school form asks for parents' salaries and church name to enrol a child: data minimisation broken. An employer keeps CVs of rejected applicants for ten years: storage limitation broken. A hospital that cannot show who viewed a patient's record: accountability broken.

Memory hook

"Little People Make Awesome Shiny Imported Accessories": Lawfulness, Purpose, Minimisation, Accuracy, Storage, Integrity, Accountability.

Part D: Technical measures (things the technology does)

Privacy by Design means embedding privacy into the system architecture from the very start (inception), being proactive (prevent breaches) rather than reactive (fix things after a breach). Examples: default data minimisation in form design and automated retention enforcement. Privacy by Default means the system automatically applies the most private settings without the user having to do anything. Both are legally required under GDPR Article 25.

Four principles of Privacy by Design (Reading 1B)

Proactive, not reactive (prevent rather than respond); end-to-end security (protect data from collection to deletion); user-centric (give users control and transparency); minimal data by default. Example: a social app that asks only for email and password at sign-up, sets profiles to private by default and offers easy consent options.

Anonymisation vs pseudonymisation

Anonymisation removes identifiers irreversibly: nobody can link the data back to the person. Pseudonymisation replaces identifiers with artificial markers (for example, patient "Ada Okafor" becomes "P-10293"); with the key, it can be reversed. Both reduce re-identification risk. Pseudonymised data is still personal data under the law.

Technical measure	What it does
Encryption	Scrambles data so only key holders can read it. At rest (in storage): AES-256 (Advanced Encryption Standard, 256-bit key). In transit (moving over a network): TLS 1.3 (Transport Layer Security). Use end-to-end encryption for sensitive messages and rotate keys regularly
Access controls	Role-based permissions plus MFA (Multi-Factor Authentication: password plus a code or fingerprint)
DLP (Data Loss Prevention)	Monitors and blocks unauthorised data transfers, such as an employee emailing a customer list to a personal Gmail
PETs (Privacy-Enhancing Technologies)	Tools that let you use data without exposing people: differential privacy in analytics (adds statistical noise), homomorphic encryption (compute on data while it stays encrypted), federated learning (train AI without moving raw data)
Secure storage and deletion	Encrypted databases; cryptographic erasure (destroy the key so the data becomes unreadable) when data is no longer needed

Exam trap

In the slides' own mid-lesson question, the answer to "Which of the following is a Privacy-Enhancing Technology (PET)?" was Encryption, not DLP, firewall or data mining, because encryption makes data unreadable to unauthorised people and directly protects confidentiality. Data mining is the opposite of privacy-enhancing.

Implementation checklist from the slides: run DPIAs for new systems; use pseudonymised data in test environments (never real customer data); automate access revocation when staff change roles; schedule cryptographic wiping of decommissioned storage.

Part E: Organisational measures (things people and policies do)

Policies and procedures

1. Data protection policy: documents the lawful basis and the rules for handling data. 2. PIA (Privacy Impact Assessment) / DPIA process: mandatory for high-risk processing; covers data flows and third-party sharing risks. 3. Breach notification procedure: the GDPR's 72-hour reporting window plus an internal escalation path. 4. Retention policy: maximum storage time per data type, with automated deletion triggers.

Roles and training

DPO (Data Protection Officer): required for public bodies and large-scale monitoring; reports directly to senior management. Accountability framework: board-level responsibility and an annual compliance sign-off. Training: role-specific modules (HR vs IT), phishing simulations, quarterly refreshers on password hygiene and secure file sharing.

Auditing and monitoring

Annual privacy audits (sample-check policies, verify third-party processor contracts); data flow mapping (see every collection and sharing point, spot unauthorised transfers); automated alerts for unusual access patterns and overdue deletions; centralised logging for investigations.

What a DPO does

An independent adviser: monitors processing, trains staff, liaises with regulators during audits. To build a privacy culture: clear breach-reporting channels, regular impact assessments for new projects, and pushing privacy-aware design in IT procurement.

Exam trap: technical or organisational?

Technical = encryption, anonymisation, pseudonymisation, access controls, DLP, firewalls. Organisational = PIA/DPIA, policies, breach procedure, retention policy, DPO, training, audits. The slides ask this directly: PIA is organisational; anonymisation is technical.

Part F: Implementing compliance in IT systems (Reading 1B)

1. Data mapping and inventory, the foundation

Data mapping shows how personal data moves through the organisation (collection → processing → storage → sharing). A data inventory is the record of data types, purposes, locations, retention periods and who has access. It supports GDPR Article 30 (Records of Processing Activities), spots excessive collection, and makes it possible to answer DSARs (Data Subject Access Requests). Key activities: identify all sources (websites, CRM (Customer Relationship Management) systems, HR systems); categorise data (PII, Personally Identifiable Information, vs sensitive); map flows including third parties; document the legal justification (consent, contract).

2. Access controls and data minimisation

RBAC (Role-Based Access Control)

Access by job function. HR staff see employment records but not payroll.

ABAC (Attribute-Based Access Control)

Access by characteristics such as department, location or data sensitivity. "Only Abuja-branch staff, during working hours, for non-sensitive records."

Best practices: enforce MFA for sensitive data, review access rights regularly as roles change, collect only what is needed and delete it when done, and anonymise or pseudonymise where possible. Apply least privilege: give each person the minimum access they need.

3. Incident response and breach notification

Notify the regulator within 72 hours (GDPR and NDPR) when people's rights are at risk.

A breach notice should describe the breach, the data involved, the actions taken and advice for affected people. Under the CCPA and other US state laws timelines vary by state.

4. Encryption, secure storage and secure transmission

Secure storage

Disk and database encryption; least-privilege access; reputable cloud providers with certifications such as ISO 27001 (International Organization for Standardization standard for information security).

Secure transmission

HTTPS/TLS for websites; SFTP (SSH File Transfer Protocol) or FTPS (File Transfer Protocol Secure) for files; VPNs (Virtual Private Networks) for remote access.

5. Vendor and third-party risk management

Vendors who process data for you create risk. Keep an inventory of vendors and their data access; assess their security with frameworks like SOC 2 (System and Organization Controls 2) or ISO 27001; put privacy and security obligations in contracts; monitor them through regular reviews and audits.

Part G: Challenges, strategy and operations

Challenge (slides)	Why it hurts
Legacy systems	Old systems often lack encryption and proper access controls, so adapting them to GDPR/NDPR is hard
Data silos	Systems that are not integrated make consistent policies hard; data may be shared wrongly or kept for different, excessive periods
Resource gaps	Too few privacy specialists and too little money for tools
Regulatory complexity	Overlapping laws (GDPR plus sector rules) and frequent updates need adaptable processes
Evolving tech	Cloud, AI and IoT (Internet of Things) bring new collection risks

Strategy

Risk-based approach: start where a breach would hurt most (customer databases) and spread resources by risk level. Documentation: records of all processing and breach responses. Privacy culture: train staff to spot phishing and handle files securely.

Operations

Regulatory monitoring: a team tracks changes to GDPR, NDPA and HIPAA. Cross-team collaboration: legal and IT review vendor contracts and run PIAs together. Tech upgrades: replace outdated systems with modular ones, with safe data migration.

Part H: When privacy fails: ethics, consequences and trends (Reading 1C)

Harm to individuals and society

Psychological harm (anxiety; a leaked address can endanger a domestic-violence survivor or whistleblower); identity theft and fraud; loss of autonomy (stigma, discrimination when health or political data leaks); societal impact (people stop trusting digital services, which slows innovation).

Organisational responsibility

Proactive safeguards (technical controls and training); transparency (explain how data is collected, used and protected); swift breach response (contain, notify, fix).

Reputational and business impact

Loss of customer trust; investors and partners pull back; negative publicity; lower employee morale and higher turnover.

Remediation after a breach

Incident containment → root cause analysis → transparent communication (notify individuals and regulators, support victims) → policy and technical upgrades (better controls, revised policies, retraining).

Trend (Readings 1A and 1C)	Meaning
Harmonisation / regulatory expansion	Countries align laws for smoother cross-border flows, but a growing "patchwork" (India's DPDPA, Brazil's LGPD, US state laws) demands flexible compliance
Accountability and enforcement escalation	More documentation and risk assessments; bigger fines and scrutiny
Data subject empowerment	A surge in requests for access, correction and deletion
PETs and technological integration	Privacy by design, homomorphic encryption, federated learning
AI and privacy	Consent, bias and misuse concerns; the EU AI Act responds
Zero-trust security	Verify every access attempt continuously instead of trusting anyone inside the network perimeter
Data sovereignty	Countries require data to be stored and processed within their borders
Trust as a competitive edge	Privacy is now seen as crucial for business success

Recommendations for sustained compliance: adopt privacy by design; use centralised compliance platforms (automate consent management, subject requests and reporting to cut human error); invest in PETs; enhance transparency; implement zero trust; manage third-party risk; train employees.

Summary

Data privacy = protection plus control. GDPR (EU, 2018, extraterritorial, €20m/4%), HIPAA (US health, 1996, $50k per violation, $1.5m a year), NDPR (Nigeria, 2019, citizens anywhere; NDPA 2023 and the NDPC now above it).
Seven principles: lawfulness/fairness/transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity/confidentiality, accountability.
Technical measures: privacy by design and default (GDPR Art. 25), anonymisation vs pseudonymisation, AES-256 at rest, TLS 1.3 in transit, RBAC/ABAC, MFA, DLP, PETs, cryptographic erasure.
Organisational measures: policies, DPIA/PIA, 72-hour breach procedure, retention policy, DPO reporting to senior management, training, audits, data flow mapping.
Incident response: preparation → detection and containment → eradication and recovery → post-incident review.
Challenges: legacy systems, silos, resources, regulatory complexity, evolving tech. Answer: risk-based, documented, privacy culture, cross-team work.

Study Session 2 · Lesson slides 02 · Readings 2A, 2B, 2C

Intellectual property in IT

In one sentence: intellectual property (IP) is legal protection for creations of the human mind, and in IT it comes in four types: copyright (the code and content as written), patents (new technical inventions), trademarks (names and logos) and trade secrets (confidential know-how), with software licences deciding how others may use what you made.

Think of it like

A Nollywood film. The script and the film itself are protected by copyright the moment they exist. A brand-new camera stabiliser the studio invented could be patented. The studio's name and logo on the poster are trademarks. The secret budget formula that lets it shoot a film for half the usual price is a trade secret, protected only as long as nobody leaks it. When the studio lets a TV station show the film for one year, that permission is a licence.

Part A: What IP is and why it matters

IP is legal protection for creations of human intellect: software, databases, designs, logos and other digital assets. It secures the right to use, reproduce and profit from those creations, which encourages innovation and attracts investment.

Why IP matters (slides)

Protects investments and ideas so inventors and firms get returns; builds competitive advantage; reduces compliance risk and costly disputes; gives investors confidence and can raise company valuations; shields future revenue from copying.

How IP encourages innovation

It rewards creators financially and with recognition, gives security to R&D (Research and Development), motivates problem-solving, and keeps the IT sector competitive. The slides' quiz answer: IP law promotes innovation by offering exclusive rights to creators.

Part B: The four types of IP

Ask: is it the written work, the invention, the brand or the secret?

Type	Protects	How you get it	How long	IT examples
Copyright	Original works: source and object code, documentation, manuals, UI layouts and icons, website structures, game audio and animations	Automatic once the work is created (in most countries)	Creator's life + 70 years	The code of a Lagos fintech's app
Patent	Technical inventions and new methods, unique algorithms, hardware-software systems, some UI innovations	Application, examination and approval by an official authority	Up to 20 years from filing	Amazon 1-Click; M-Pesa's mobile payment technology
Trademark	Logos, product names, slogans, app icons, domain names; prevents consumer confusion	Registration (stronger protection)	Renewable indefinitely with proper use	"Photoshop", the TikTok logo, Google.com
Trade secret	Confidential business information giving a competitive edge: algorithms, processes, proprietary databases	No registration; you must keep it secret	As long as it stays secret; once disclosed, protection is lost	Andela's developer-training model

Copyright vs patent (Reading 2B)	Copyright	Patent
Protects	The expression (the code itself)	The underlying idea or process
Term	Life + 70 years	20 years
Registration	Automatic	Requires an application
Scope	The specific implementation	Broad technical concepts

Patentability criteria: novelty (new), non-obviousness (not a trivial step for an expert) and utility (useful, with industrial application). In return for 20 years of exclusive rights, the inventor must publicly disclose how the invention works.

Memory hook

"Code, Invention, Brand, Secret" → Copyright, Patent, Trademark, Trade secret. And for patents: "New, Not obvious, Needed" (novel, non-obvious, useful).

Exam trap

"Which of the following protects software code?" → Copyright (slides). A patent protects an inventive method, not the lines of code. "What keeps trade secret protection alive?" → Confidentiality, not patent filing, open-source licensing or public disclosure. Filing a patent actually publishes the idea, which ends secrecy.

Part C: Who protects IP: institutions

Nigeria

NCC (Nigerian Copyright Commission; careful, in telecoms NCC means the Nigerian Communications Commission); the Trademarks, Patents and Designs Registry; NOTAP (National Office for Technology Acquisition and Promotion), which guides technology transfer. Nigeria's current law is the Copyright Act 2022.

International and regional

WIPO (World Intellectual Property Organization) and the WTO (World Trade Organization) set global standards and treaties. ARIPO (African Regional Intellectual Property Organization, mainly English-speaking Africa) and OAPI (African Intellectual Property Organization, French-speaking Africa) offer one registration covering several countries. Courts, customs and police enforce rights.

Treaty / law	What it does
Berne Convention	Automatic copyright protection in member countries (no registration needed)
TRIPS Agreement (Trade-Related Aspects of Intellectual Property Rights)	Sets minimum standards of IP protection for WTO members
WIPO Copyright Treaty	Extends copyright to digital works
US Title 17 (Copyright Act); Nigeria Copyright Act 2022	National laws that apply these standards locally
DMCA (Digital Millennium Copyright Act, US)	Gives the "takedown notice" process used against online infringement, like YouTube strikes

Part D: Software licensing models

A licence is how the copyright holder states the conditions for using the software. The user usually gets the right to use, not ownership.

Dual licensing (MySQL) offers the same software under an open licence and a paid proprietary one.

Model	Rules	Examples
Proprietary	Privately owned; source code not public; users get the compiled version only; no modification, redistribution or reverse engineering	Microsoft Office, Adobe Photoshop
Freeware	Free to use but no modification	Skype
Open source (OSS)	Source code publicly accessible; anyone may view, modify and distribute under a licence meeting the OSI (Open Source Initiative) criteria	Linux, Firefox
Copyleft (a type of open source)	Derivative works must use the same licence and stay open	GNU GPL (General Public License)
Permissive (a type of open source)	Few restrictions; can be used inside proprietary products	MIT, Apache, BSD (Berkeley Software Distribution)
Dual licensing	Same software offered under open-source and proprietary terms	MySQL

OSS key features (slides)

Accessible source code; redistribution rights; derivative works allowed; no discrimination against people or uses; community-driven. The four freedoms: to use, study, distribute and modify.

Impact of open licensing

On development: collaborative, rapid innovation. On innovation: code sharing and modification. On access: wider access to software, especially in developing countries.

Exam trap

"MIT licence" here means the MIT open-source licence (named after the Massachusetts Institute of Technology), not your course code. The GPL is copyleft; MIT and Apache are permissive. If a Nigerian startup wants to use open code inside a closed, paid product without opening its own code, it needs a permissive licence, not the GPL.

Part E: Infringement, fair use and enforcement

Type of infringement	Example
Unauthorised copying and distribution	Software piracy, illegal streaming, selling cracked software at Computer Village
Unlawful derivative works	Modifying and redistributing software or content without approval
Circumvention of DRM (Digital Rights Management)	Bypassing the security that protects software or media
Code plagiarism	Copying code without attribution

Detection uses audits, watermarking, similarity analysis and platform monitoring. Penalties can be civil, criminal or administrative: fines, injunctions (court orders to stop) and, in severe cases, prison.

Fair use (US) / fair dealing (Nigeria, UK)

Limited use without permission for education, criticism, commentary, research or parody. Courts weigh four factors: purpose (commercial or transformative?), nature (factual or creative?), amount (small excerpt or substantial?), market impact (does it harm the original's value?). It never allows wholesale copying, and licence terms may restrict it.

Other exceptions

First sale doctrine (you may resell a physical copy you bought); de minimis use (too small to matter); adaptations for disability access.

Memory hook

The four fair-use factors: "PNAM", or Please Never Abuse Material: Purpose, Nature, Amount, Market.

Enforcement challenges: borderless infringement (piracy crosses jurisdictions; IP law is territorial); anonymity of infringers; rapid dissemination (content spreads before takedown); access inequality (innovators in low-resource settings may not afford to register and enforce IP).

Part F: The landmark cases

Case	Area	What happened	Lesson
Oracle v. Google (2010–2021)	Copyright	Google used Java API (Application Programming Interface) method headers in Android without a licence. The US Supreme Court ruled it was fair use	APIs may be seen as functional; fair use can protect transformative reuse; encouraged interoperability
Napster (1999–2001)	Copyright	Peer-to-peer MP3 sharing; sued by the RIAA (Recording Industry Association of America); shut down, later became a legal streaming service	Platforms can be held accountable for enabling mass infringement; build IP compliance into design
Apple v. Corellium	Copyright	Virtual iOS devices for security research	Ruled fair use (research purpose)
Adobe v. Forever 21	Copyright	Piracy allegations over unlicensed software use	Settled; companies must licence the software staff use
Apple v. Samsung (2011–2018)	Patent (and design)	Slide-to-unlock, pinch-to-zoom, UI and icons; large damages (a $539M settlement), some overturned on appeal	UI innovations can be patentable; design is a valuable asset
Amazon 1-Click	Patent	One-click buying patent enforced against Barnes & Noble; criticised as obvious; expired 2017	Simple processes can be patentable if novel and non-obvious at filing
Microsoft v. i4i	Patent	Microsoft paid $290M over Word's XML editor	Software patents carry big financial risk
Alice Corp. v. CLS Bank	Patent	The court rejected abstract software patents	An abstract idea done "on a computer" is not enough
M-Pesa (Kenya)	Patent	Patented mobile payment technology	Helped scale across Africa and stopped copycats
Andela	Trade secret	Kept its developer-training model secret	Trade secrets can be a competitive advantage
Microsoft v. MikeRoweSoft	Trademark	A student's domain sounded like Microsoft; settled, Microsoft helped him rebrand	Trademarks protect even against unintended mimicry if consumers may be confused
Booking.com v. USPTO (2020)	Trademark	The US Patent and Trademark Office called the name generic; Supreme Court disagreed	Generic terms can be trademarked once they gain brand distinctiveness
Pinterest v. Pintrips	Trademark	Dispute over "Pin"	"Pin" ruled too generic to monopolise
Meta v. Meta PC	Trademark	Name conflict after Facebook renamed itself	Cost Meta PC millions; check names before branding
MongoDB SSPL	Licensing	Moved from AGPL (Affero GPL) to the SSPL (Server Side Public License) to stop cloud providers profiting without contributing; Red Hat dropped it	Licence changes affect adoption and trust
Microsoft v. Linux community	Licensing	Patent accusations in the 2000s; later Microsoft bought GitHub and built VS Code	IP strategies evolve from litigation to collaboration
The Pirate Bay	Piracy	Torrent links; founders jailed; repeated shutdowns and revivals	Piracy pushes owners to innovate in delivery
AutoCAD cracking	Piracy	Heavy piracy by students; Autodesk introduced discounted student versions and cloud subscriptions	Affordable, ethical licensing reduces piracy

Exam trap

In Oracle v. Google, the Supreme Court did not say "APIs can never be copyrighted". It ruled that Google's use was fair use. That is the slides' answer to "What key legal principle was upheld?"

Part G: Ethics of IP and licensing

Ethical dimensions (Reading 2A)

Respect for creators (credit authorship, no plagiarism, share improvements in open-source communities); balancing protection and access (avoid monopolies that stifle competition); corporate responsibility (don't abuse IP claims to block smaller innovators or interoperability); global equity (frameworks should support, not exploit, innovators in developing economies).

Ethical issues in licensing (slides and Reading 2B)

Software ownership, user rights, access to knowledge, economic models, and the balance between individual rights and community benefit. Concerns arise when licences limit access to essential tools (expensive software for education), cause vendor lock-in, exploit community contributions, or hide invasive data collection inside complex EULAs (End User Licence Agreements).

Ethical dimension	Open source	Proprietary
Freedom	High (modifiable)	Low (restricted)
Transparency	High (source visible)	Low (closed code)
Business model	Donations, services	Sales, subscriptions
Control	Community	Vendor

Patent trolls

Companies that hold patents only to sue others rather than to create. Overlapping or obvious patents can stifle progress. A key challenge listed on the slides, alongside confusing open-source licences, piracy and cloning, and territorial limits.

Real-world dilemmas

GitHub Copilot: trained on open code; concerns about licence violations and attribution. Adobe and Venezuela: blocked paying users because of sanctions, raising questions about political control of access to tools.

Best practices for IP protection (slides): understand and comply with every licence you use; track creation dates and keep version records; register patents, trademarks and copyrights to strengthen claims; protect confidential information with secure methods and strict policies (for example NDAs, Non-Disclosure Agreements).

Part H: Emerging IP challenges

Area	Issue
AI-generated content	Who owns code or art made by Copilot or Midjourney? Courts have generally ruled that AI-generated works are not eligible for copyright without human authorship
Blockchain and NFTs (Non-Fungible Tokens)	Owning the token usually does not mean owning the copyright; enforceability is unclear when content is stored off-chain. Nike v. StockX (NFT sneakers) shows trademarks extending into virtual goods; blockchain can also verify IP ownership records; smart contracts may automate licence compliance
The metaverse	Who owns virtual items, spaces and identities? Hermès v. MetaBirkins highlighted brand dilution in digital spaces
Digital rights management	New DRM models for distributing content; global IP law adapting to new technology

Summary

Four IP types: copyright (expression, automatic, life + 70), patent (invention, novel/non-obvious/useful, apply, about 20 years), trademark (brand, renewable), trade secret (no registration, lost on disclosure).
Institutions: NCC (Nigerian Copyright Commission), Trademarks, Patents and Designs Registry, NOTAP; WIPO, WTO, ARIPO, OAPI; Berne (automatic), TRIPS (minimums), WIPO Copyright Treaty (digital).
Licences: proprietary, freeware, open source (four freedoms), copyleft GPL, permissive MIT/Apache/BSD, dual (MySQL).
Fair use / fair dealing: purpose, nature, amount, market. Oracle v. Google = fair use for APIs.
Challenges: piracy, patent trolls, confusing licences, territorial law, anonymity. Best practice: comply with licences, keep records, register, protect secrets.
Ethics: respect creators, balance protection and access, no abuse of IP, global equity, no hidden data collection in EULAs.

Study Session 3 · Lesson slides 03 · Readings 3A, 3B, 3C · Case study: TechCare Solutions

Ethics in software development and data ownership

In one sentence: developers are responsible for both the intended and unintended effects of their software, so they must build in fairness, transparency, accountability, privacy and "do no harm", respect that people own and control their personal data, get real consent (not a tick-box trick), and balance the rush to innovate with responsible innovation.

Think of it like

A bridge engineer in Abuja. A bridge that stands up is a technical success, but if it has no walkway, wheelchair users and pedestrians are left out, and if it shakes in heavy rain, people get hurt. Software is the same: "it works" is not the same as "it is ethical". The reading puts it plainly: technical success should not be equated with ethical success.

Part A: Responsibility in software development

Developers are accountable for both intended and unintended consequences.
Anticipate how the software might be used (and misused).
Always prioritise minimising harm over maximising speed, profit or convenience.
Put safety, accessibility and user well-being at the centre of design.
Encourage ethical reflection at every stage: planning, coding, testing and deployment.

Slide summary

"Software development is inherently ethical work." Ethics should guide every stage of the SDLC (Software Development Life Cycle). Data ownership and user consent are fundamental rights. "The code we write today shapes tomorrow's world: code with integrity."

Part B: Five ethical principles in software design (Reading 3A)

Principle	Plain meaning	Nigerian example from the reading
1. Fairness and equity	No user or group is disadvantaged, especially vulnerable groups. Equity goes further: tailor solutions for people who need more help	A mobile banking app that still works in rural areas with unstable internet; extra support for low-income and informal workers
2. Transparency and explainability	Clearly communicate how the system works, how data is used and how decisions are made	Users should understand why they were denied a loan or flagged on a platform; many users grant broad app permissions without understanding them
3. Accountability and professional responsibility	Systems built so faults can be traced and harms addressed, even after deployment	Lean startup teams must still set clear roles so privacy or security issues are caught quickly
4. Privacy, consent and data stewardship	Privacy is a fundamental human right; consent must be a clear process, not just a checkbox; privacy by design; also respect collective (group) privacy	Community-level data such as land ownership or health data must be protected
5. Non-maleficence and harm reduction	"Do no harm": prevent physical, psychological, financial or reputational harm	Fintech platforms must protect users from scams and fraud; don't exclude people with disabilities

Classic bioethics names you may see

Beneficence = do good. Non-maleficence = do no harm. Autonomy = respect people's right to decide for themselves. Justice = fairness and equitable distribution of benefits and burdens. The slides' quiz: "Which principle is most concerned with software being fair and equitable to all users?" → Justice.

Why diverse teams matter

From the slides: diverse teams are more likely to identify and mitigate potential biases, because different perspectives uncover issues a uniform team would miss. (Not because they are cheaper or better at marketing.)

Memory hook

"FAT PN": Fairness, Accountability, Transparency, Privacy, Non-maleficence.

Ethics at every SDLC stage

Stage	Ethical question or action
Requirements	Who benefits and who may be excluded? Understand local infrastructure, digital literacy and culture
Design	Inclusivity and accessibility: language diversity, mobile compatibility, different literacy levels
Implementation	Secure coding, no hard-coded assumptions, test for bias from skewed training data
Testing	Does it work fairly for all users, including people with disabilities and low-end phones?
Deployment	Clear privacy notices, multilingual guides, offline access where needed
Maintenance	Security updates and acting on user feedback

Professional codes and Nigerian law

The ACM (Association for Computing Machinery) and IEEE (Institute of Electrical and Electronics Engineers) codes of ethics stress public well-being, transparency and honesty, but must be read in local context. The NDPR (2019), closely modelled on the GDPR, is the minimum threshold: many startups are unaware of it or see it as bureaucracy, so ethical developers should go beyond compliance. Good examples: OpenMRS (open medical records) and FarmStack (agriculture data), where collaborative governance and transparency increased trust and adoption.

Part C: Data ownership

Data ownership means the legal rights and control over personal or organisational data, including deciding who can access, use and share it. Individuals own their personal data (name, address, medical history); companies may own operational data (customer lists, employee records). The slides' quiz: data ownership gives users control over how their personal information is used and shared. Selling other people's data is not a data ownership right.

Why ownership of data is tricky

Data is non-rivalrous: unlike a phone, it can be copied and shared without you even knowing, and you still "have" it. Companies often take wide control through long terms of service. The ethical ideal is informational self-determination: users control how their data is collected, used and shared.

What ethical platforms do

1. Minimise data collection. 2. Give real-time transparency about what is collected. 3. Let users control, review and delete their data. Nigerian mobile money and ride-hailing apps are criticised for collecting a lot without these options.

Ownership rights you should list

Right to access your data, to rectify (correct) it, to erasure (the "right to be forgotten"), and to data portability (take it to another service).

Part D: Consent

User consent is permission for data to be collected, stored and processed. Informed consent means the user fully understands what is collected and how it will be used before agreeing.

Opt-in

The user must actively choose to allow collection (an unticked box they tick). This is the GDPR standard for consent.

Opt-out

Collection happens by default; the user can choose to stop it later. Consent is assumed. The slides' quiz: opt-in requires active agreement, opt-out assumes consent.

Clear and concise privacy policies let users make informed decisions: easy to read, explaining collection practices, purposes and users' rights. Transparency builds trust and supports compliance. Policies hidden in fine print fail ethically even if they exist legally.

Nigerian fintech loan apps that demand access to contacts and call logs in exchange for a loan show coercion: consent is not voluntary when someone desperate for money must agree to get the service. Better practice: clear consent flows; progressive disclosure (ask for permissions step by step, when needed); real-time options to revoke consent.

Why transparent consent is hard (slides)

Challenge	What it looks like
Information asymmetry	The company knows far more than the user: limited awareness, hard-to-read policies, misunderstood risks, reliance on defaults, gaps in digital literacy
Choice overload	Too many pop-ups and notifications, so people become desensitised and click "Accept all"; complexity, inconsistent experiences, lost trust
Dark patterns	Design tricks that push you to agree: pre-selected options, misdirection through visual hierarchy (big green "Accept", tiny grey "Decline"), forced action or false urgency, bundled consent, deceptive wording
Evolving technologies	Passive, invisible data gathering (IoT); complexity beyond user understanding; retroactive discovery of data use; dynamic re-identification risks; granular control becomes impractical

Exam trap

If a scenario describes a cookie banner where "Accept all" is big and coloured while "Manage settings" is a faint link, the issue is a dark pattern (misdirection), not choice overload. If users simply get so many pop-ups that they stop reading, that is choice overload. If the company knows things the user cannot reasonably understand, that is information asymmetry.

Part E: The data lifecycle and user rights (Reading 3B)

Each stage brings its own risk and its own user right.

Collection: right to know what is collected, and to refuse without losing the whole service.
Storage: secure, with transparency about where (jurisdiction) and how long.
Processing: right to be told how data is processed and to challenge automated decisions; no discriminatory profiling.
Sharing: users informed and able to opt out of third-party sharing; third parties must meet the same standards.
Deletion and portability: irreversible deletion and easy export. Many Nigerian services keep data indefinitely with no retention policy.

Local cases (Reading 3B)

Digital lending apps mining contact lists and texting debtors' family and friends (violates third-party privacy, exploits desperation). Biometric data for SIM registration and banking collected without explicit consent or ability to review or delete. EdTech platforms monetising children's data without informed parental consent.

Who builds ethical capacity

Developers (dignity, precise consent, user control); tech companies (ethics culture, privacy in the business model, incident processes); civil society (advocacy, education, holding firms to account); universities (ethics in curricula); government, for example NITDA, strengthening enforcement.

Part F: Balancing innovation with ethical responsibility (Reading 3C)

The innovation-ethics tension is "fast vs fair". Pressure to ship quickly (especially to fill infrastructure gaps in Nigeria) can override caution. Example: a Lagos recruitment platform whose algorithm unintentionally screens out qualified rural candidates because of biased training data: it works technically, but fails ethically.

Memory hook: "AIRR" (Anticipation, Inclusivity, Reflexivity, Responsiveness). It also appears in Module 6.

Principle	Course example
Anticipation (before)	A school-security facial recognition system could misidentify students with darker skin; spot it early
Inclusivity (who is involved)	Include rural and low-literacy users in testing
Reflexivity (look inward)	Ask whether you are prioritising efficiency over fairness
Responsiveness (after)	Redesign a problematic feature or fix an unclear data-sharing policy after feedback

Moral grey zone	The tension
Surveillance vs safety	A ride-hailing app's real-time tracking and audio recording: are users safer or just more watched?
Automation vs accountability	EdTech auto-grading or hiring algorithms make errors: they must be auditable and users able to challenge decisions
Nudging vs manipulation	Reminders and incentives help, but can tip into guilt, anxiety and exploitation
Open data vs data sovereignty	Civic-tech apps sharing community data for social good may face opposition from communities left out of the decision

Ethical leadership: a product manager who delays a launch until consent flows are clear; founders who publicly commit to privacy standards or hire ethics officers before the law requires it; tech hubs and bootcamps teaching ethics alongside coding.

Part G: Case study, TechCare Solutions (Nigerian health-tech)

Background and problem

Founded 2018: telemedicine, EHRs (Electronic Health Records), appointments and health information by mobile app. In 2021 it underperformed in rural areas with poor connectivity, and some features were unusable for low-literacy users. Three problems: inaccessibility for vulnerable groups, inequitable service delivery, and data privacy concerns (collection not transparent or secure enough; consent and security worries).

Solution mapped to principles

Fairness and equity: lightweight, mobile-friendly design with text-to-speech and voice commands. Transparency: clear privacy policy; users can track and delete their data. Privacy and consent: privacy by design, encryption, informed consent, user control over sharing. Non-maleficence: extensive testing in rural communities; culturally sensitive redesign.

Implementation phases

Requirements gathering with community health workers and residents → redesign for simplicity, accessibility, privacy and local languages → NDPR compliance (and international certification) → pilot testing in rural areas → phased national deployment with continuous monitoring.

Results

50% rise in rural engagement in the first quarter; 40% rise in trust (clearer privacy policies); full compliance with NDPR and GDPR standards; handles 10,000 concurrent users with low latency even on slow internet.

Lesson

Aligning technology with societal values and the needs of vulnerable groups led to more trust, user satisfaction and regulatory compliance. Ethics was good for business. The discussion questions (consent with low-literacy users; alternative models; reaching even more remote areas; using AI and IoT ethically) are practised in the Case study prep tab.

Summary

Developers own intended and unintended consequences; harm reduction beats speed, profit or convenience; ethics at every SDLC stage.
Five principles: fairness/equity, transparency/explainability, accountability, privacy/consent/stewardship, non-maleficence. Justice = fairness; diverse teams catch bias.
Data ownership = control over use and sharing; data is non-rivalrous; informational self-determination.
Valid consent: informed, voluntary (freely given), specific, unambiguous, reversible. Opt-in = active; opt-out = assumed.
Consent challenges: information asymmetry, choice overload, dark patterns, evolving technologies.
Lifecycle: collection, storage, processing, sharing, deletion/portability.
Responsible innovation: anticipation, inclusivity, reflexivity, responsiveness. Grey zones: surveillance/safety, automation/accountability, nudging/manipulation, open data/sovereignty.
TechCare: inclusive, private-by-design redesign → +50% rural engagement, +40% trust, NDPR/GDPR compliance.

Study Session 4 · Lesson slides 04 · Readings 4A, 4B, 4C

Social media, privacy and ethical dilemmas

In one sentence: social media platforms constantly watch, collect and profile what users do, which brings real benefits (personalisation, safety) but also erodes privacy, creates a chilling effect on free speech, enables manipulation and discrimination, and concentrates power in a few data monopolies, so users need strong rights and must also accept responsibilities.

Think of it like

A free "owambe" party where the host gives you food and music at no cost, but has cameras in every corner, writes down who you talk to, what you eat and how long you dance, then sells that notebook to caterers and politicians. The party feels free. You are paying with your behaviour. The slides ask: "Are we the users, or are we the product being observed?"

Part A: What digital surveillance is

Digital surveillance is the use of technology to monitor, collect and analyse users' online activities, behaviour and interactions: what they post, websites visited, location and social connections. Platforms, advertisers and governments use it for targeted advertising, content personalisation and security.

Part B: The ethical concerns (slides)

Concern	What it means
Erosion of privacy	Constant monitoring makes people censor themselves out of fear
Free expression and the chilling effect	The chilling effect is self-censorship caused by knowing you are watched; it stifles free expression and open debate
Censorship	Users avoid posting controversial or political opinions because the data might be used against them
Data collection and profiling	Users don't know how much is collected, leaving them feeling vulnerable and uncomfortable
Manipulation and influence	Data powers highly targeted ads and content that steer decisions: targeted political ads influence voting; content recommendations narrow exposure to diverse views
Social sorting and discrimination	Classifying and ranking people by their data can reinforce systemic discrimination: algorithmic bias in hiring or credit scoring; selective content exposure creating filter bubbles
Power imbalances and lack of transparency	Data monopolies (Facebook, Google, Amazon) hold enormous power; opaque algorithms ("black boxes") hide how decisions are made, preventing accountability

Filter bubble

When algorithms show you only content similar to what you already like, so you rarely see other viewpoints. The slides' answer to "How do recommendations threaten diversity of thought?" → by showing users only content aligning with their existing views.

Data monopoly

A few companies control most personal data, creating power imbalances. They control what content users see and how their data is used, and the consequence is greater dependence on a few platforms.

Exam trap

"What is the primary ethical concern of surveillance's impact on free expression?" → the chilling effect (self-censorship), not faster internet, more engagement or better recommendations. "Which practice lets platforms influence behaviour through collected data?" → highly targeted political ads, not encrypted messaging or disabling cookies (those protect users).

Part C: Five actors who watch (Reading 4B)

Each actor gives a different justification, but the combined effect erodes privacy, trust and autonomy.

Actor	Why they watch	Examples
State	National security, crime prevention, public interest	China's social credit system (citizens scored, penalties on travel and services); the US PRISM programme revealed by Edward Snowden (the NSA, National Security Agency, accessing communications); Nigeria's #EndSARS protests (online surveillance of youth activists, account takedowns, frozen bank accounts). SARS = Special Anti-Robbery Squad
Corporate	Profit: predict preferences and target ads	Facebook and Instagram extract data from passive actions (scrolling, clicking); Google location tracking uses Wi-Fi and Bluetooth beyond GPS; Nigerian free apps abusing permissions
Employer	Productivity and security, especially remote work	Tracking logins, app use, browsing; Slack and Microsoft Teams admin access to private messages; always-on webcams, keystroke logging. Called a "digital panopticon" (a prison design where inmates never know if they are being watched)
Peer	Social curiosity and gossip	Story views, read receipts; screenshots from WhatsApp or Telegram groups shared without permission; doxxing (publishing someone's private information)
Platform	Content moderation, policy enforcement, engagement	Algorithmic moderation lacking cultural nuance; filter bubbles; Nigerian influencers shadow-banned or suspended without explanation

Ethical test for surveillance

Ethical workplace surveillance must be transparent, justifiable and respectful of privacy. Across all actors, the reading's conclusion is that ethical surveillance is driven by transparency, proportionality, consent and accountability. State surveillance in particular challenges transparency, autonomy and proportionality.

Three lenses on surveillance (Reading 4B)

Theory	How it judges surveillance
Utilitarianism	Ethical if benefits outweigh harms; unethical if it breeds fear or control
Deontology	Wrong if it violates rights such as privacy or autonomy, regardless of benefits
Rights-based ethics	Must be lawful, transparent and proportional to respect freedom and dignity

Part D: Privacy challenges in social media data (Reading 4A)

Challenge	Example in the reading
Third-party access, "the open backdoor"	Apps get data through APIs; oversight is weak. Cambridge Analytica: a quiz app harvested data of over 87 million users without consent for political manipulation, including in Nigeria. A 2023 Nigerian Instagram-linked app leaked private messages and location to a foreign company
Data repurposing	Clearview AI scraped billions of social media photos to build a facial recognition database for police, violating users' original intent. Concern that NIN and voter-registration biometrics could train AI without consent
Lack of regulation and enforcement, "second-class digital citizens"	NDPR exists but many SMEs (Small and Medium-sized Enterprises) ignore or misunderstand it; the NDPC lacks staff and funding. Global platforms give Europeans full protection but weaker policies in Nigeria
Algorithmic profiling and discrimination	Facebook's job-ad system showed high-paying jobs more to men even with gender-neutral targeting. Nigerian digital credit scoring using social media and phone data can deny loans based on neighbourhood, with no explanation or appeal
Unclear data ownership	Terms of service give platforms broad licences to use, modify and sublicense your content. A photographer's viral Calabar Carnival image used by a tourism board without credit or pay
Device permissions abuse	A flashlight app asking for contacts, location, microphone and SMS. Driven in Nigeria by free apps, low digital literacy, weak marketplace oversight and limited NDPR enforcement
Public shaming and involuntary virality	Lagos 2022: a schoolgirl's dance video shared by an influencer without consent went viral, leading to bullying, suspension and trauma
Children's privacy	Children lie about age; face targeted ads, predators posing as peers, and data mining that builds lifelong profiles. The NDPR has no specific child protections

Memory hook

"Third Party Repurposes, Regulators Rest, Algorithms Assume, Owners Unclear, Permissions Pile, Posts go Public, Children Exposed." Eight challenges, in reading order.

Part E: User rights (Reading 4C)

Recognised in the GDPR and Nigeria's NDPR, though enforcement varies.

Right	Meaning and Nigerian angle
Right to information	Know what is collected, why, how it is used and who it is shared with. Policies should use simple language, accessible formats and local languages
Right to access and portability	See everything a platform holds about you and move it to another service. Many Nigerians don't know this right; small firms may lack the systems to comply
Right to erasure (right to be forgotten)	Request deletion, especially of outdated data or data collected without valid consent. Deletion should remove all traces, including backups
Right to object	Opt out of specific uses such as targeted ads or profiling. Platforms should use privacy-by-default so the least invasive setting is the default
Right to redress	A way to complain when data is mishandled. NDPR requires DPOs and redress, but enforcement is weak; good systems are transparent, accessible and offer human support, not only bots

Part F: User responsibilities (Reading 4C)

1. Read and adjust privacy settings

Many users never change defaults through lack of awareness or confidence. Learn the options and set them to match your preferences.

2. Avoid sharing harmful or private content

No revenge porn, doxxing, hate speech, misinformation or cyberbullying. Ask: "Would this violate someone's dignity or safety?"

3. Report abuse and violations

Report harassment on WhatsApp or disinformation on X (formerly Twitter). Reporting protects vulnerable groups and pushes platforms to act.

4. Be ethically aware and think critically

Verify sensational stories, avoid rumours, practise digital empathy. In Nigeria misinformation can incite panic or violence.

Exam trap

The slides' summary says both platforms and users share responsibility for ethical standards. An option saying "only the platform is responsible" or "users have no responsibilities if the platform has a privacy policy" is a trap. Ethical digital citizenship needs empowerment and empathy.

Part G: Possible solutions (the essay questions)

The slides end with essay questions on data monopolies and opaque algorithms. Ideas to use:

Regulatory: strong data protection laws with real enforcement (GDPR-style fines, a funded NDPC); algorithmic transparency requirements and independent audits; competition (antitrust) action against monopolies; data portability so users can switch; specific child-protection rules.
Technical and design: privacy by default; clear consent and permission screens; letting users opt out of profiling or choose a chronological feed; explanations for moderation decisions and an appeal route; end-to-end encryption.
Balancing corporate interest and accountability: disclose how ranking and moderation work in general and give regulators confidential audit access, without forcing firms to publish trade-secret code.

Summary

Digital surveillance = monitor, collect, analyse online behaviour, for ads, personalisation and security.
Concerns: privacy erosion, chilling effect (self-censorship), censorship, profiling, manipulation (political ads, recommendations), social sorting (algorithmic bias, filter bubbles), data monopolies and opaque "black box" algorithms.
Five actors: state (#EndSARS, PRISM, social credit), corporate, employer (digital panopticon), peer (doxxing, screenshots), platform (shadow-banning).
Reading 4A challenges: third-party access (Cambridge Analytica, 87m), repurposing (Clearview AI), weak enforcement (second-class digital citizens), profiling, unclear ownership, permission abuse, involuntary virality, children.
User rights: information, access and portability, erasure, object, redress. Responsibilities: settings, don't share harm, report, think critically.
Theories: utilitarian (benefits vs harms), deontology (rights regardless of benefit), rights-based (lawful, transparent, proportional).

Study Session 5 · Lesson slides 05 · Readings 5A, 5B, 5C · Case study: SecureNet Technologies

Cybersecurity ethics and compliance in IT

In one sentence: compliance means making every part of the IT infrastructure (hardware, software, network, data, processes and people) meet the laws, industry standards and internal policies that apply, while ethics asks what is right even when no rule demands it; real breaches such as Equifax, Uber and Yahoo show what happens when organisations follow neither.

Think of it like

Running a filling station in Kano. Compliance is having the fire extinguishers, licences and safety inspections the regulator requires. Ethics is telling customers and neighbours immediately when you discover a fuel leak, even if the inspector won't come for weeks. A station can pass inspection and still behave badly. The reading puts it as two questions: compliance asks "What am I required to do?"; ethics asks "What is the right thing to do, even if I'm not required?"

Part A: What IT infrastructure compliance is

IT infrastructure compliance is the adherence of IT systems (hardware, software, networks and data) to relevant legal, regulatory and internal standards, plus regular monitoring and assessment so they keep meeting them.

Layer of requirement	Examples (slides)
Legal requirements	GDPR, HIPAA, CCPA (California Consumer Privacy Act), NDPR, Nigeria's Cybercrimes Act 2015
Industry standards	ISO/IEC 27001, NIST CSF (National Institute of Standards and Technology Cybersecurity Framework), PCI DSS (Payment Card Industry Data Security Standard)
Internal policies	Data retention rules, access controls, acceptable use, breach notification procedures

Why compliance matters (four drivers)

1. Legal and regulatory requirements (avoid legal trouble). 2. Risk mitigation (breaches, attacks, failures). 3. Maintaining trust and reputation. 4. Business continuity (disaster recovery and continuity plans are part of compliance).

What is NOT a driver or benefit

The slides' trick answers: "minimising IT budgets" is not a primary driver (compliance avoids far costlier fines and breaches); "increased employee turnover" is not a benefit. Benefits are better security, fewer legal liabilities and better efficiency.

The six areas compliance covers

Scope	What must be compliant
Hardware	Servers, storage and network equipment; physical security (locked server rooms, access control)
Software	Operating systems, databases, apps and security tools; updates and patching; no unauthorised software
Network	Secure protocols, firewalls, intrusion detection systems, encryption in transmission
Data	"At the heart" of compliance: privacy and secure storage, processing and transmission
Processes	Policies for retention, backup and audit trails
Personnel	Training on data protection and incident reporting; managing user roles and permissions

Memory hook

"Happy Students Never Do Poor Projects": Hardware, Software, Network, Data, Processes, Personnel.

Part B: The key frameworks and standards

Framework	Type	What it is for
GDPR	Law (EU)	Personal data of people in the EU: consent, access, minimisation, right to erasure
HIPAA	Law (US)	Health information kept private and secure, especially in storage and transmission
NDPR	Regulation (Nigeria)	Data privacy in Nigeria: user consent and secure handling
Cybercrimes Act 2015	Law (Nigeria)	Nigeria's main cybercrime law (with the NDPR, defines the national compliance landscape)
PCI DSS	Industry standard	Protects payment card (cardholder) data for anyone handling card payments
ISO/IEC 27001	International standard	Establish, implement, maintain and continually improve an ISMS (Information Security Management System) to protect confidentiality, integrity and availability
NIST CSF	Framework (US)	Five core functions: Identify, Protect, Detect, Respond, Recover
ISO 22301 and NIST SP 800-34	Standards	Business continuity and contingency (disaster recovery) planning. SP = Special Publication
COBIT, ITIL, ISO/IEC 38500	Governance frameworks	COBIT (Control Objectives for Information and Related Technologies), ITIL (Information Technology Infrastructure Library) and ISO/IEC 38500 (corporate governance of IT) guide IT governance best practice

Memory hook: "I Prefer Doing Real Revision".

Exam trap

"Which standard establishes an ISMS?" → ISO 27001, not the NIST CSF (that is the five-function framework) and not PCI DSS (card data only). ISO 27001's purpose is not "to eliminate all cybersecurity risks". Nothing removes all risk; it manages risk systematically.

Part C: Maintaining compliance, risk management and governance

Four best practices (slides)

1. Regular audits and reviews of control effectiveness. 2. Employee training and awareness, continuously. 3. Security controls and monitoring (encryption, firewalls, access control, constant monitoring). 4. Documentation and reporting of handling practices, measures and audit results, essential during regulatory inspections.

Compliance strategy

A comprehensive strategy includes risk assessment, policy development, implementing security controls, and ongoing monitoring. Compliance is ongoing and proactive, never a one-time implementation. Common challenge: resource constraints.

Risk management identifies and reduces threats: identify threats → analyse vulnerabilities → prioritise responses using tools such as risk registers and threat modelling. There are four ways to treat a risk:

Strategy	Meaning	Example
Avoidance	Stop the risky activity	Don't store card numbers at all
Transfer	Shift the impact to someone else	Buy cyber-insurance; outsource to a certified provider
Mitigation	Reduce likelihood or impact	Patch systems, add MFA, encrypt data
Acceptance	Live with a small risk knowingly	An old internal printer with no sensitive data

Controls are technical (firewalls, encryption), administrative (policies, training) and physical (locks, guards). Defence in depth layers them so that if one fails, another still protects.

Risk-based vs standards-based compliance (essay question)

Standards-based: follow a checklist such as ISO 27001 or PCI DSS. Pros: clear, auditable, recognised. Cons: can become box-ticking and miss risks the checklist doesn't name. Risk-based: spend effort where threats and impact are greatest. Pros: efficient, tailored. Cons: harder to audit; depends on good risk judgement. Best: combine them, using the standard as the baseline and risk assessment to prioritise and go further.

BCDRP (Business Continuity and Disaster Recovery Planning)

Business continuity keeps operations running during a crisis; disaster recovery restores IT after an incident. Components: BIA (Business Impact Analysis), risk assessment, preventive and corrective strategies, documented recovery plans, and regular testing. The 2017 WannaCry ransomware attack (which hit hospitals) showed why.

IT governance

Makes sure IT supports business goals effectively and ethically: accountability, transparency, risk management, performance measurement. Led by boards, CIOs (Chief Information Officers) and IT steering committees. Internal controls: audit logs, access restrictions, role-based permissions. Regular monitoring and audits catch non-compliance.

Cyber warfare

State-sponsored attacks on power grids, finance or hospitals; hard to attribute and often outside international law. Ethics: attribution and proportionality (don't over-retaliate) and civilian harm. Guidance: the Tallinn Manual and UN GGE (Group of Governmental Experts) reports, but enforcement is inconsistent.

Part D: Ethics in cybersecurity (Reading 5A)

Theory	Core idea	Cybersecurity example
Utilitarianism	Maximise benefit for the greatest number	Exposing a flaw in widely used software disrupts some users but protects millions; quick breach disclosure protects more users
Deontology	Some actions are right or wrong in themselves, regardless of outcome	Hacking is wrong even with good intentions because it breaks rules and duties; duty to protect user data
Virtue ethics	Focus on the person's moral character	Honesty, integrity and responsibility guide conduct

Responsibilities of security professionals

1. Respect confidentiality and privacy. 2. Disclose vulnerabilities responsibly (not for personal gain or sabotage). 3. Avoid conflicts of interest when assessing risk or recommending products. 4. Be transparent with stakeholders about incidents and weaknesses. 5. Educate staff and users. Guided by codes from the ACM and (ISC)² (International Information System Security Certification Consortium).

Ethical challenges they face

Confidentiality (handling sensitive data); risk response (ignoring small threats or delaying because of budget); internal whistleblowing (reporting misconduct, especially by leaders); surveillance vs user privacy (monitoring needs clear limits); lack of ethics training.

Global and cultural perspectives: privacy expectations differ (strict consent in the EU, more lenient elsewhere); surveillance allowed in one country may be illegal in another; data sovereignty (hosting data on foreign servers may break local law). Shared values to hold on to: respect, consent and fairness.

ACM Code of Ethics

Four parts: general ethical principles, professional responsibilities, leadership principles, and compliance with the code. Emphasises integrity, competence, privacy, fairness and respect; in security that means confidentiality, responsible disclosure and honest communication. The 2018 update added AI, data bias, surveillance and inclusion. ACM, IEEE and (ISC)² codes all converge on preventing harm and promoting responsibility.

Part E: Anatomy of a breach and the big case studies (Reading 5C)

Common ethical failures: ignoring known vulnerabilities, delaying notification, mishandling data.

Case	What happened	Ethical failure / lesson
Equifax (2017)	Failed for months to patch a known Apache Struts flaw; 147 million people exposed; disclosure delayed; executives sold shares before telling the public	Dishonesty, poor transparency, disregard for privacy; violated ACM standards; lost public trust
Facebook–Cambridge Analytica (2018)	Third-party app harvested user data for political profiling without explicit consent	Informed consent, platform responsibility; legal in some places yet unethical; led to fines and policy reforms
Yahoo (2013–2014)	State-sponsored attackers accessed 3 billion accounts; disclosed years later, during the Verizon acquisition	Failure to notify promptly; underinvestment in encryption; silence harms trust and valuation
Target (2013)	Attackers entered through a third-party HVAC (heating, ventilation and air conditioning) vendor and put malware on point-of-sale terminals; 40 million customers' card data	Weak vendor risk management; slow response; brand image over transparency; weak PCI compliance
SolarWinds (2020)	Nation-state attackers compromised the Orion software used by companies and US agencies (a supply chain attack)	Vendors' duty to develop securely and disclose risks; who is accountable in supply chains?
Uber (2016)	Data of 57 million users accessed; Uber paid the hackers to delete it and stayed silent for over a year	Concealment for brand reasons; fined $148 million; its CSO (Chief Security Officer) charged with obstruction of justice
Colonial Pipeline (2021)	Ransomware shut a major US fuel pipeline; panic and shortages; paid a $4.4 million ransom	Paying ransom may be legal but incentivises future attacks; preparedness and communication
Edward Snowden	Whistleblower who revealed mass surveillance	When does disclosure become a moral duty? National security vs individual rights

Memory hook for the numbers

Yahoo 3 billion · Equifax 147 million · Cambridge Analytica 87 million · Uber 57 million · Target 40 million. Uber's fine $148m; Colonial's ransom $4.4m.

Ethical decision-making in a crisis

Four steps for ethical analysis: identify the dilemma → gather facts and stakeholder perspectives → apply ethical principles → make a decision and reflect on the outcome. In the Uber case, a utilitarian might argue concealment prevented panic; a deontologist says it broke the duty of transparency.

Crisis tension	What goes wrong
Speed vs transparency	Rapid decisions lead to half-truths or delayed disclosures
Legal vs moral duty	Waiting for the legal deadline instead of acting in the public's interest
Paying ransoms	Not illegal, but ethically questionable and sets a precedent
Communication	Ethical leadership needs honest, clear, timely updates to all stakeholders, and accountability without scapegoating

Lessons: prevention and response

Proactive defence (regular patching, vulnerability scans, staff training); secure development (SDLC best practice, especially in supply chains); incident response planning (ethical roles defined before a crisis).

How breaches drive change

Policy impact: Equifax and Cambridge Analytica pushed stronger laws (GDPR, CCPA). Ethical culture: boards now see cybersecurity as a moral duty, not just compliance. Continuous improvement: post-breach audits include ethical reflection; training uses case simulations; whistleblowing channels strengthen ethics.

Part F: Case study, SecureNet Technologies (Nigerian cybersecurity firm)

Background and problem

Offers threat detection, encryption, vulnerability assessments and incident response to banks, hospitals, telecoms and government. In 2022 it found a serious vulnerability in a client's system (an international financial institution with millions of daily transactions) that had been there over a year, overlooked because of other priorities. Problems: unethical vulnerability management; legal and ethical uncertainty about disclosure (fear for reputation); internal whistleblowing (a senior incident responder found management had ignored vulnerabilities for months: escalate internally or tell the client?).

What SecureNet did

Immediate disclosure and transparency to the client with a mitigation plan; internal ethics training and policy review; a confidential, anonymous whistleblower system with no retaliation; compliance with Nigeria's Cybercrimes Act and the NDPR (worked with its legal team).

Implementation

Flaw identified, analysed and patched within 48 hours; client told exactly what happened; ethics training for all staff; anonymous reporting system; legal and compliance reviews against local and international law.

Results and lesson

Kept the client's trust and its reputation; stronger internal culture and more vigilant staff; stayed compliant with no legal consequences. Lesson: transparency, accountability and prompt disclosure maintain trust.

Summary

Compliance = IT systems meet legal (GDPR, HIPAA, NDPR, Cybercrimes Act), industry (ISO 27001, NIST CSF, PCI DSS) and internal requirements, continuously.
Drivers: legal, risk mitigation, trust, business continuity. Scope: hardware, software, network, data, processes, personnel.
ISO 27001 = ISMS; NIST = Identify, Protect, Detect, Respond, Recover; PCI DSS = card data.
Maintain: audits, training, controls and monitoring, documentation. Risk treatment: avoid, transfer, mitigate, accept; defence in depth; BCDRP with BIA; governance via COBIT, ITIL, ISO 38500.
Ethics vs compliance: "required" vs "right". Theories: utilitarian, deontology, virtue. Professionals: confidentiality, responsible disclosure, no conflicts of interest, transparency, education.
Breach stages: compromise, lateral movement, exfiltration, discovery. Cases: Equifax, Cambridge Analytica, Yahoo, Target, SolarWinds, Uber, Colonial Pipeline. Four-step ethical analysis.
SecureNet: disclose quickly, patch in 48 hours, train, whistleblower system, comply with Cybercrimes Act and NDPR.

Study Session 6 · Lesson slides 06 · Readings 6A, 6B

Ethical dilemmas in emerging technologies and case studies

In one sentence: new technologies such as AI, biotechnology and social media raise the question "just because we can, should we?", and three ethical theories help answer it: utilitarianism (judge by consequences), deontology (judge by duties and rules) and virtue ethics (judge by character), which can reach different conclusions on the same case.

Think of it like

Three people judge a danfo driver who drove through a red light to rush a sick child to hospital. The utilitarian asks, "Did it produce the best outcome for everyone?" (a life saved, nobody hurt: probably right). The deontologist asks, "Did he break a duty or rule?" (traffic law exists for everyone: wrong, whatever the result). The virtue ethicist asks, "What does this say about his character?" (compassion and courage, but was it also reckless?). Same act, three lenses.

Part A: The three ethical theories

Ethical theory is the systematic study of what counts as moral behaviour and how ethical decisions should be made. Different theories give distinct ways of deciding what is right.

Memory hook: Outcomes, Obligations, Ourselves.

Theory	Key ideas	Strength	Weakness
Utilitarianism (a form of consequentialism)	The right action brings the greatest good for the greatest number; judges outcomes, not intentions. Act utilitarianism: judge each individual act by its consequences. Rule utilitarianism: follow rules that generally lead to the greatest happiness over time	Practical; weighs real benefits and harms	Can overlook individual rights and justify harming a minority for the majority
Deontology	Some actions are obligatory, forbidden or permitted in themselves, regardless of consequences. Moral duties (tell the truth, keep promises). Immanuel Kant's categorical imperative: act only on rules you could will to be universal; treat people as ends in themselves, never merely as means	Protects rights, consent and dignity even when breaking them would be efficient	Rigid; duties can conflict; may ignore terrible consequences
Virtue ethics	Asks "What kind of person should I be?" rather than "What should I do?". Virtues: honesty, courage, compassion, wisdom, integrity, empathy. Built through habit until good actions come naturally	Focuses on the people building technology; flexible	Gives less precise guidance in a specific dilemma

Exam trap

The slides' distractors include ethical egoism (do what benefits yourself), relativism (morality depends on culture) and consequentialism (the family utilitarianism belongs to). "Judges an action by adherence to rules or duties" → deontology. "Maximises overall happiness" → utilitarianism. "Good character traits such as honesty" or "the moral character of the scientist" → virtue ethics. "Least overall harm, even if it violates a rule" → utilitarianism.

Part B: Ethical dilemmas in AI

Dilemma	The question
Autonomous vehicles and the trolley problem	The trolley problem is a thought experiment: kill one person to save several? How should a self-driving car be programmed when harm is unavoidable: save the most lives, the young, or the passengers?
Algorithmic bias in facial recognition and criminal justice	AI can perpetuate or amplify social bias. Facial recognition is less accurate for people of colour; predictive policing and risk-assessment tools can produce unfair arrests and sentences
Job displacement from automation	Manufacturing, retail and transport jobs replaced; should developers and businesses help with retraining and support?
Autonomous weapons ("killer robots")	Choose and engage targets without human intervention. If one kills civilians, who is responsible: the machine, the developer or the military? Does it respect international humanitarian law?

Lens on AI	Focus
Utilitarian	Weigh AI's benefits against its harms to society; maximise overall well-being
Deontological	Is it morally permissible to build machines that make life-or-death decisions at all, whatever the outcome? (Autonomous weapons violating the duty "do not kill")
Virtue ethics	What virtues should AI developers have? How can AI embody compassion, fairness and respect for dignity?

Part C: Ethical dilemmas in biotechnology

Genetic engineering and human enhancement

Genetic engineering changes an organism's genetic material. Human enhancement improves traits beyond the normal range (intelligence, strength, lifespan). Questions: should we only treat disease, or also enhance? Risk of a return of eugenics (trying to "improve" the human race by selecting traits, historically discriminatory).

CRISPR (Clustered Regularly Interspaced Short Palindromic Repeats)

CRISPR-Cas9 edits DNA precisely. It could treat genetic disorders, but germline editing (changes passed to future generations) risks unintended mutations across the gene pool. Should it be used only for disease, or also for enhancement?

Access and equity

Costly biotech may reach only the rich, widening social, economic and health gaps, possibly creating a society split between enhanced and non-enhanced people.

Synthetic life

Building life forms from synthetic DNA. Useful for medicine, farming and conservation, but: do humans have the right to create life, and could releasing synthetic organisms cause irreversible harm to biodiversity?

Lenses: utilitarianism weighs cures against risks such as genetic side effects and inequality; deontology asks whether altering the genome or creating life is permissible in itself; virtue ethics asks scientists to show responsibility, wisdom and compassion.

Part D: Ethical dilemmas in social media

Dilemma	Details
Misinformation and hate speech	Misinformation is false or misleading information spread deliberately or by accident (for example anti-vaccine content). Hate speech promotes violence, discrimination or hatred against groups and can incite real-world violence
Privacy, data collection and algorithmic targeting	Platforms collect search history, interactions and location; algorithms target ads and content; users are often unaware, raising informed-consent issues
Mental health and well-being	Social comparison with curated lives, addictive design, cyberbullying; anxiety, depression and loneliness, especially in young people
Censorship vs freedom of expression	Platforms can remove posts and ban users. Who decides what is harmful, and where is the line between protecting people and restricting free speech?

Lenses: utilitarian (connectivity benefits vs misinformation, privacy and mental-health harms); deontological (platforms' duties to protect privacy, be transparent and promote truthful information); virtue ethics (a moral community built on honesty, respect, fairness and compassion).

Part E: The two case studies

Case 1: Cambridge Analytica and data misuse

Harvested data from millions of Facebook users without consent to influence the 2016 US election and the Brexit referendum. Dilemma: privacy, informed consent and manipulation through targeted political ads. Utilitarian view: the harm (manipulated voters, misinformation, lost autonomy, less trust in democracy) outweighs any benefit. Deontological view: harvesting without consent is inherently wrong; it treats people as means to an end, violating Kant. Solutions: stronger regulation like the GDPR; transparent consent where users explicitly agree.

Case 2: Deepfakes and trust in truth

Deepfakes use AI to create hyper-realistic fake video or audio, such as invented political statements or impersonated public figures. Dilemma: is it acceptable even as parody or satire, given possible harm? Deontological view: inherently unethical because it violates the duty to truth, even for entertainment. Virtue view: intent to deceive shows a lack of honesty and integrity. Solutions: regulation with penalties for malicious intent; detection technology and labelling.

Model answers from the slides

Facial recognition in public spaces: a utilitarian weighs crime reduction against privacy erosion and misidentification of marginalised groups, and may endorse it if it prevents more harm than it causes; a deontologist objects to the violation of consent and dignity even if it is beneficial. The conflict is outcome-based versus rule-bound reasoning. Personalised algorithms: they threaten autonomy through addictive design and filter bubbles; virtue ethics asks designers for integrity (transparency), justice (fair distribution) and empathy (reduce polarisation); practical steps include opting out of profiling, bias audits and putting well-being above engagement metrics.

Part F: Balancing innovation with ethical responsibility (Reading 6A)

Market pressure to ship fast can overshadow fairness, privacy and inclusivity, especially in AI and blockchain. Responsible innovation proactively shapes technology to benefit society while minimising harm, using the same four principles as Module 3: anticipation (for example security AI misidentifying certain groups), inclusivity (include rural, low-literacy Nigerians in design and testing), reflexivity (if speed over accuracy causes bias, rethink), responsiveness (adapt after launch from feedback).

Issue	Key points
Deployment dilemmas	Surveillance vs privacy (ride-hailing location tracking), automation vs accountability (grading and hiring algorithms must be auditable and challengeable), nudging vs manipulation
AI and IoT challenges	Algorithmic opacity (deep-learning "black boxes" undermine accountability in justice and health), bias and discrimination (predictive policing on biased historical data), surveillance and consent (IoT collects passively without explicit consent). Fixes: transparency, fairness, user control, documentation, diverse input
Privacy and data ownership	Companies often claim ownership of user-generated data. New models: data trusts and personal data wallets give individuals control and a share of value
Automation and work	Displacement of low-skill routine jobs: governments and companies should fund reskilling. The gig economy creates jobs but with insecurity, no benefits and algorithmic surveillance
Ethical leadership	Delay a feature until consent flows are clear; founders commit publicly to privacy; ethics in developer training

Part G: Governance, sensitive contexts and digital sovereignty (Reading 6B)

Global ethical governance

The EU, UNESCO (United Nations Educational, Scientific and Cultural Organization) and the OECD (Organisation for Economic Co-operation and Development) set AI principles of transparency, accountability and fairness. Tension: global norms vs cultural sovereignty (GDPR's individual rights vs countries prioritising national security or communal data sharing). Balance universal principles with local needs.

AI in sensitive contexts

Healthcare: transparency, explainability and human oversight to avoid misdiagnosis; health-data privacy. Education: inclusive, don't widen the digital divide; bias and over-surveillance. Humanitarian aid: privacy, consent, profiling of vulnerable people; "do no harm" and community involvement.

Generative AI: three ethical responses

Transparency: label or watermark AI-generated content. Ownership and consent: respect creators whose copyrighted work trained the model; fair compensation. Accountability: developers and platforms answer for misuse (deepfakes, disinformation).

Algorithmic colonialism vs digital sovereignty

Algorithmic colonialism: imposing foreign digital infrastructure on the Global South and extracting data without consent to build AI that mainly benefits the Global North. Digital sovereignty: the right of individuals and communities to control their own data and technology.

Building fair and inclusive technology means engaging diverse voices (cultural, racial, gender, regional), with transparency and accountability so systems respect rights and promote social justice.

Summary

"Just because we can, should we?" Utilitarianism = outcomes (act vs rule); deontology = duties (Kant: universalise, people as ends); virtue ethics = character (habits). They can disagree.
AI dilemmas: trolley problem in self-driving cars, bias in facial recognition and policing, job displacement, autonomous weapons.
Biotech: genetic engineering, enhancement vs treatment, eugenics, CRISPR germline editing, access and equity, synthetic life.
Social media: misinformation and hate speech, targeting and privacy, mental health, censorship vs free speech.
Cambridge Analytica (consent, people as means) and deepfakes (duty to truth, honesty).
Responsible innovation: anticipation, inclusivity, reflexivity, responsiveness. Data trusts, personal data wallets, reskilling, gig-work fairness.
Governance: EU, UNESCO, OECD; global vs local. Generative AI: label, respect creators, accountability. Algorithmic colonialism vs digital sovereignty.

Marks	What the question asks	What the marker wants
About 10	Knowledge: "Explain…", "Identify…", "Outline…"	Correct definitions and the right course ideas, each tied to one detail of the case
About 15	Application: "Analyse…", "How did…", "Apply…"	Course theories, laws and principles used on the facts of the case, with reasons
About 25	Evaluation: "Evaluate…", "Should…?", "Recommend…"	A balanced argument (both sides), a clear judgement, and practical recommendations

Section	What goes in it	Rough share
Introduction	The organisation, the problem in one or two sentences, and what your analysis will cover	5–10%
Case summary and key facts	Only the facts you will use later: what happened, when, who was affected, any numbers	10%
Ethical and legal issues	Each issue named with the course term (for example "informed consent", "data minimisation", "responsible disclosure")	15%
Stakeholder analysis	A short table: stakeholder, their interest, how they are affected	10%
Analysis	The theories and laws applied to the facts, issue by issue; where theories agree and where they conflict	30–35%
Recommendations	Specific, practical steps (technical and organisational), with who does what	15–20%
Conclusion	Your judgement and the main lesson	5%
References	The course slides and readings, plus any laws you cite	-

Law or standard	Use it when the case involves…	Key points to quote
NDPR (Nigeria Data Protection Regulation, 2019) and NDPA 2023 (Nigeria Data Protection Act)	Any personal data in Nigeria	Lawful basis and consent; data minimisation; DPO (Data Protection Officer); audits; 72-hour breach notice; ₦10 million or 2% of annual gross revenue for controllers of over 10,000 people; NDPC (Nigeria Data Protection Commission) is the regulator
GDPR (General Data Protection Regulation, EU, 2018)	Data of people in the EU, or as the international benchmark	Freely given, specific, informed, unambiguous consent; privacy by design and default; DPIA (Data Protection Impact Assessment); up to €20 million or 4% of global turnover
HIPAA (US, 1996)	Only US health data; useful as a comparison for health cases	Privacy, Security and Breach Notification Rules. Do not say it applies to a Nigerian hospital
Cybercrimes (Prohibition, Prevention, etc.) Act 2015	Hacking, breaches, critical systems, cyber fraud	Nigeria's main cybercrime law; with the NDPR it defines the national compliance landscape
Copyright Act 2022 and the Nigerian Copyright Commission	Software piracy, code copying, content use	Automatic copyright; fair dealing for education, criticism, research
ISO/IEC 27001, NIST CSF, PCI DSS	Security management, banks and card payments	ISMS (Information Security Management System); Identify, Protect, Detect, Respond, Recover; card data protection
ACM, IEEE, (ISC)² codes of ethics	Behaviour of developers and security professionals	Avoid harm, honesty, privacy, confidentiality, responsible disclosure

Theory	The question it asks	Sentence starter
Utilitarianism	Which choice gives the greatest good for the greatest number?	"From a utilitarian view, the benefits to … must be weighed against the harms to …"
Deontology (Kant)	Which duties and rights apply, whatever the outcome? Are people treated merely as a means?	"A deontologist would argue that the company had a duty to … regardless of the consequences, because …"
Virtue ethics	What would a person of good character (honest, fair, responsible) do?	"Virtue ethics asks what an honest and responsible leader would do. Here, integrity requires …"
Rights-based ethics	Which rights (privacy, dignity, free expression) are at stake? Is the action lawful, transparent and proportional?	"The users' right to privacy is engaged, so any monitoring must be lawful, transparent and proportional."

Understand ethics and the law in IT, then prove it in your CAs and case study

Part A: What data privacy is and why it matters

Two roles you must know: controller and processor

Part B: The three laws compared (GDPR, HIPAA, NDPR)

Part C: The seven principles of data protection

Part D: Technical measures (things the technology does)

Part E: Organisational measures (things people and policies do)

Part F: Implementing compliance in IT systems (Reading 1B)

1. Data mapping and inventory, the foundation

2. Access controls and data minimisation

3. Incident response and breach notification

4. Encryption, secure storage and secure transmission

5. Vendor and third-party risk management

Part G: Challenges, strategy and operations

Part H: When privacy fails: ethics, consequences and trends (Reading 1C)

Summary

Part A: What IP is and why it matters

Part B: The four types of IP

Part C: Who protects IP: institutions

Part D: Software licensing models

Part E: Infringement, fair use and enforcement

Part F: The landmark cases

Part G: Ethics of IP and licensing

Part H: Emerging IP challenges

Summary

Part A: Responsibility in software development

Part B: Five ethical principles in software design (Reading 3A)

Ethics at every SDLC stage

Professional codes and Nigerian law

Part C: Data ownership

Part D: Consent

Why transparent consent is hard (slides)

Part E: The data lifecycle and user rights (Reading 3B)

Part F: Balancing innovation with ethical responsibility (Reading 3C)

Part G: Case study, TechCare Solutions (Nigerian health-tech)

Summary

Part A: What digital surveillance is

Part B: The ethical concerns (slides)

Part C: Five actors who watch (Reading 4B)

Three lenses on surveillance (Reading 4B)

Part D: Privacy challenges in social media data (Reading 4A)

Part E: User rights (Reading 4C)

Part F: User responsibilities (Reading 4C)

Part G: Possible solutions (the essay questions)

Summary

Part A: What IT infrastructure compliance is

The six areas compliance covers

Part B: The key frameworks and standards

Part C: Maintaining compliance, risk management and governance

Part D: Ethics in cybersecurity (Reading 5A)

Part E: Anatomy of a breach and the big case studies (Reading 5C)

Ethical decision-making in a crisis

Part F: Case study, SecureNet Technologies (Nigerian cybersecurity firm)

Summary

Part A: The three ethical theories

Part B: Ethical dilemmas in AI

Part C: Ethical dilemmas in biotechnology

Part D: Ethical dilemmas in social media

Part E: The two case studies

Part F: Balancing innovation with ethical responsibility (Reading 6A)

Part G: Governance, sensitive contexts and digital sovereignty (Reading 6B)

Summary

Video lessons

Module practice

Exam mode: the CA simulation

Case study prep: the final assessment

1. What a case study question looks like

2. The four-step method (from Reading 5C)

3. How to structure your submission

4. Your toolkit: what to cite

Laws and standards

Ethical theories

Principles and frameworks to name

5. Worked case 1: TechCare Solutions (Study Session 3)

6. Worked case 2: SecureNet Technologies (Study Session 5)

7. Worked essays from the Session 6 slides

8. Practice cases (try these yourself)

9. Phrase bank

10. Before you submit: checklist

Every abbreviation, in plain English