University Case Study: Legal, Ethical, and Security in Data Science

This case study analyzes the legal, ethical, and security aspects of data science through the lens of GoldCare Ltd, a UK healthcare company. The report addresses several key issues, including GoldCare's handling of a cyberattack, compliance with GDPR and data protection regulations, and the legality of various actions taken by the company. It examines the legal positions of both the company and an affected patient, Debra, regarding data privacy and the right to rectify and erase personal data. The case study also explores intellectual property rights related to employee contributions and the use of data mining, as well as the implications of non-disclosure agreements and trademark infringement. The analysis references relevant laws and sections, offering advice on the legality of specific actions and providing a comprehensive overview of the legal challenges in data science. The assignment also discusses potential legal concerns and challenges that arise with data science practices.

Case study on legal
aspects of data science

Table of Contents
INTRODUCTION ..........................................................................................................................3
MAIN BODY...................................................................................................................................3
QUESTION 1...................................................................................................................................4
(A) Discussion on legality of the following conduct by the company GoldCare Ltd by citing
relevant laws and sections......................................................................................................4
(B) Advise Debra on her legal position regarding the following below citing appropriate
legislation...............................................................................................................................5
QUESTION 2...................................................................................................................................6
Advice to GoldCare on legality of the undertaking the following actions.............................6
QUESTION 3...................................................................................................................................8
Comment on the legality of the actions taken my various RECIPIENTS (R1, R2, R3, R4, A5,)
party to the GoldCare Databank licence agreement. In your answer you must reference
specific sections in the licence agreement..............................................................................8
QUESTION 4.................................................................................................................................10
Research and discuss at least four possible legal concerns and for each concern................10
CONCLUSION .............................................................................................................................14
REFERENCES..............................................................................................................................15

INTRODUCTION
Laws plays an important role in maintaining and regulating the actions of the members
and enforces it by imposing the penalties. It is a rule of conduct which is mainly enacted by the
supreme law making authority which is Parliament in UK. Law follows many practices and
customs so that it can deal with wrongdoing and crimes. Its enforcement is mainly controlled by
the controlling authority (Raiser, Naims and Bruhn, 2017). Data science mainly comprises of two
components which includes firstly the vast amount of data which is characterised by three Vs of
big data, velocity, volume and variety and second is that data science stands for the statistical
model which is implemented through a software which can detect patterns in the data
(Wojciechowski, 2020). There are many legal, ethical and security challenges faced by
companies while dealing in data science and these challenges might arise from misusing it. This
report shall deal with a case study on data science and involves for questions which are to be
answered in the present report.
MAIN BODY
Case scenario:
GoldCare Ltd is the healthcare company in UK which provides clinical treatment to
patients for many health conditions. They employ various administrative staff and medical
professional, including data controller. Two months earlier, data controller have discovered that
a cyberattack has been done in the company which have breached the extensive data. The
organisation have no protocol to deal with it and kept quite due to fear of bad publicity. The
management decided to expand the centre thereby establishing new data science department in
order to pursue the data and research analysis. It employed data scientist uses artificial
intelligence techniques for many activities and also installed new IT system together with
development of new processes and services which can involve collecting non medical and
medical data. The company has online data bank which consists of anonymised data and assess
to it is provided to researchers and other professionals of medical. Any person who needs access
to it requires the signing of special licence agreement.

QUESTION 1
(A) Discussion on legality of the following conduct by the company GoldCare Ltd by citing
relevant laws and sections.
1. Goldcare Ltd remained quite about cyber attack
The NIS Regulations imposes security duties on the operator of essential services which
includes duty to notify the incident to competent authority. This regulation have identified sector
based authorities like health, transport, energy, etc. with National Cyber security Centre. Under
the data Protection Act of 2018 and the United Kingdom GDPR, the controller is required to
notify the incident which involves personal data to ICO without the undue delay and within 72
hours after becoming aware of it. In the present scenario, the company was duty obliged to notify
the competent authority regarding the cyber attack which may result in penalties and
punishments. The company may be liable for the fine up to higher of 2% of the annual
worldwide turnover or 10 million pounds (Rodrigues and Papakonstantinou, 2018).
2. GoldCare Ltd edited their security logs to remove any evidence of the data breach that
they experienced, before submitting the logs to the Information Commissioner.
Every person or company who is being subject to data breach is obliged to provide all the
evidence and record of it to the concerned competent authority. The company must not hide or
remove any evidence which relates to data breach, otherwise it can face legal consequences. In
the present case scenario, GoldCare Ltd have edited their security logs in order to remove the
evidence from it before submitting the logs to information commissioner which have resulted in
gross breach and the company is liable to face legal consequences (Hernández-Ramos and et.al.,
2019).
3.GoldCare Ltd, told the ICO that would not disclose any communications which they had
with their lawyers.
Whenever, there is a data breach which have been occurred, the company or individual is
liable to communicate all the information to ICO. These information includes the following-
 The nature of the incident.
 Contact details of company's data protection officer.
 Consequences of incident

 Measures taken or proposed to be taken in order to address the incident.
While, the company is not obliged to share the communication which it had with the lawyer as it
is not mandatory to share it with ICO regarding the conversation it had with the lawyer (Kelleher
and Tierney, 2018).
(B) Advise Debra on her legal position regarding the following below citing appropriate
legislation.
Case scenario:
Debra is a patient of GoldCare Ltd. She received the letter which invites her to join gym
with a special rate for the diabetic people. She was surprised as she was not aware of it. She
wrote to the GoldCare Ltd in order to ask her about the information which it had of her. She
received the information from the hospital where she was listed as diabetic and her telephone
number was also incorrect. She was also referred to as Chubby.
(i) She wants to stop GoldCare Ltd from using her information to target her to buy
products/services.
Under Data Protection Act, 2018, the company is liable to use the information in a fair,
legal and transparent manner. The statute also imposes strong protection for the sensitive
information which relates to race, ethnic background, health, etc. In this, Debra's health related
information is being communicated by company to others. So she has a legal right to stop or
restrict the processing of data (Tikkinen-Piri, Rohunen and Markkula, 2018)
 She is concerned about her incorrect telephone number and wants it corrected.
Under the GDPR, the individual has right to get the inaccurate information as rectified or
complete it if it is incomplete. Here in this scenario, Debra can make the request to organisation
to rectify her telephone number and the GoldCare Ltd have 1 month to respond to the request. It
is the right of Debra to ask the concerned authority for rectification (Malgieri and Comandé,
2017).
 She wants to have the reference to her as “chubby” removed from her record.
The GDPR of UK also introduces right of the individual to have the personal data erased.
This right is also called as the right to be forgotten. In this case scenario, Debra can make a
request either in writing or orally and this right is not absolute rather it applies to some
circumstances. She can make the request to GoldCare to remove the reference of chubby from
her personal records (Ross, Iguchi and Panicker, 2018).

 She would like to have her medical records transferred to a new doctor in a new
medical centre.
As per the data protection Act, this legislation permits the healthcare worker to disclose
the protected health data and information about the person without its authorisation to other
health care for the treatment of the concerned person. Debra has to fill the authorisation form for
giving the permission to the GoldCare Ltd to share her information to other doctor and mark out
what information she requires to be transferred. Fees is also required to be paid by her in order to
make the transfer permissible (Wendehorst, 2020).
QUESTION 2
Advice to GoldCare on legality of the undertaking the following actions.
1. The company GoldCare Ltd wants to include the company excellence paper in their
portfolio which is written by an employees but they do not want the name of employee to be
published as author. The employee insist on publishing its name on paper and its
employment contract does not address such issue.
According to intellectual property rights law, the person who creates the work is the
owner of it and is entitled to get protection under IPR. The employee who has created a work
during the course of its employment, then the employer is entitled to that intellectual property
right. However, the employee has to right to claim the compensation if the employer has
outstanding benefit out of it. The employment contract must always deal with the assignment and
ownership of the intellectual property rights which is created by it (Pangrazio and Selwyn, 2019).
2.The researcher at the BestHealth wants to perform the data and text mining on the
information which is extracted from the database which they legally access. The agreement
of licence do not address the issue of the text and data mining.
Under Article 3 and 4 of DSM Directive permits the reproduction of the copyrighted
work. It also permits the extraction of the information from the database if the user who is
performing text and data mining have lawful access to it (Singhai, 2019). In this scenario, the
researcher at BestHealth has to lawful access to the database which gives them right to extract
the text and data mining.

3. The company BestHealthhas been approached by Medix Ltd for developing the new
medical device. A non disclosure agreement is signed with Medix Ltd and they held three
meetings in secret with the company in order to disclose their ideas about it. Later on due
to financial issues, the talk broke between them and now GoldCare Ltd wants to use these
ideas to develop this similar device.
The Non disclosure agreement is extremely common for protecting the ideas of peop,e
from being stolen. There are two restrictions in non disclosure agreement which are discussed
below-
 It prevents recipient from disclosing confidential information to third party.
 The provision of non use prevents recipient from using information other than for
specific purpose (Borissova, 2018).
In this case scenario, the best Health cannot use the idea which is being discussed in the
non disclosure agreement as it will breach the agreement. There is specific purpose mentioned in
the agreement so the company is not allowed to use the idea embodied in non disclosure
agreement.
4.GoldCareLtd wants to import the drug from the country Mexico but they are aware that
drug is manufactured without the from licence from pharmaceutical company of UK which
developed the drug.
It is important for the organisations to obtain the compulsory licence from the authorised
agency or organisation so that it has valid and lawful reason to manufacture it (Frolova and et.
al., 2018). In this case scenario, Goldcare is planning to import the drug from the company which
do not have licence to produce it which may lead to problems for the company. So under
intellectual property rights law, the company must take the drug from the organisation which has
compulsory licence of manufacturing it.
5. GoldCare wants to use the similar trademark of other company in UK so that they can
trick the customers for buying similar products which is produced by other company.
The infringement of the trademark relates to unauthorised use of registered trademark by
other third party on the goods which are identical or similar with the goods that are specified on
register. Section 10 of the trademark act provides that the unauthorised third party which utilises

the mark which is identical to registered trademark. It should be reproduced without any
modifications and even a minor modification which is unnoticeable from average consumer
perspective shall be considered as identical for trademark infringement. Moreover clause 2 and 3
of this sections states that if the unauthorised third party places the identical registered
trademark on similar offering or similar trademark on identical offering which creates confusion
about the origin of the offering, then it is trademark infringement (Matthews and Zech, 2017).
Under this case scenario, if GoldCare Ltd, uses the similar trademark of other company in
order to create confusion in the minds of customers, it shall lead to infringement of trademark
and the company can be held liable under it.
QUESTION 3
Comment on the legality of the actions taken my various RECIPIENTS (R1, R2, R3, R4, A5,)
party to the GoldCare Databank licence agreement. In your answer you must reference
specific sections in the licence agreement.
(A) Recipient 1 have received the email regarding information that the data-bank shall be
accessed during the morning of next day due to update processes and also no downloading
shall be allowed. On next day on morning, due to an emergency work, the R1 attempted to
access the data-bank and downloaded the 2GB data for completing the report.
In this scenario, the company notified the recipients about the non access of the data
through the email. According to Section 6 of the licence agreement, The GoldCare Ltd has the
power to notify its recipients about the further conditions for access or use of the data. The
company through the email notified that no recipient is allowed to access and download of data
till the next day due to update process. When the Recipient was required to access and download
the data, according to Section 7.1 of the licence agreement, the recipient must take the written
permission from the GoldCare Data bank Manager in order to access data when it was restricted.
(B) R2, a company in Germany is unable to access the data bank for 6 weeks which have
resulted in loss of revenue to it. They called GoldCare Ltd to regain the access and accused
the company for not honouring their duty under licence agreement. So they are about to
launch the lawsuit against the GoldCare Ltd in Court of Germany.

In this scenario, the Recipient 2 was facing failure to access the data from the past 6
weeks which resulted in loss of revenue to it. According to section 11 of the licence agreement,
the company GoldCare shall not bear any responsibility for any loss or damage caused to any
recipient due to unavailability, break in access or due to other reason. In this scenario, the
recipient was not given access to the data for around 2 months which resulted in loss of it. And
the terms of agreement clearly states that the company shall not be liable for any loss caused due
to failure or break in access.
(C) Before signing the agreement, R3 was told by the sales representative for GoldCare Ltd
that data bank is available for the access for 24 hours and 7 days a week without the
interruptions. Due to regular and daily interruptions in accessing the last 2 months data,
R3 decided to sue the company for giving access as promised by the sales representative.
In this scenario, the sales representative have given representation that the data bank is
accessible for 7 days and 24 hours. According to Section 5 of the Licence agreement, any
warranties or the representations which is given by any member on behalf of GoldCare Ltd shall
be excluded to the maximum extent which is permitted by law. So in this, the representative
given by the sales representative is not permitted under the agreement and hence it is not valid
and any recipient on such warranty or representation cannot bring the claim for loss or damage.
As R3 was unable to access the data for continuous 2 months and is bringing the suit on the basis
of representation or warranty, then the recipient cannot bring such lawsuit. Moreover, the section
11 of the licence agreement provides that any unavailability or break out in accessing the data,
the company shall not liable under the agreement for it.
(D) R4 consists of the 50 people who are working on many projects. All have access to the
data-bank and download it free at any time without any restrictions. The username and the
password for the access has been published in monthly hard copy newsletter which is
distributed to all the staff.
In this scenario, the recipients are using the data of GoldCare from their Data- bank. They
have free access and downloading of data. As per section 3 of the licence agreement, the
recipients are allowed to use the data of the GoldCare only for the purpose of research, health
care operations and the public health. And they are not allowed to use the data for the
commercial purpose.

Commercial use as defined under Section 1.1 of the licence agreement provides that
commercial use is copying, linking or downloading the data of company for further sale,
redistribution or licensing for the fee. It also includes posing data on service or site which
incorporates advertisement and using the data for services or work which is made available for
licensing and sale and also includes using data of GoldCare for profit organisation for the
purpose of promotions whether for the fee or otherwise.
Here they are using the data for the purpose stated in the agreement and are not using for
commercial purpose so their access is verified and correct.
(E) R5 have used the data in GoldCare data bank in order to do the research on drug
effects on cancer patients. Some data collected was incorrect and resulted in drug company
being suingR5. The court of United Kingdom order R5 to pay the compensation of 4
million Pounds to company as damages. R5 then filed the lawsuit against GoldCare for
providing incorrect information which resulted in loss of 4 million Pounds.
In this scenario, the R5 have used the data of GoldCare for the purpose of research. The
licence agreement of GoldCare clearly states that the company shall not bear any responsibility
for comprehensiveness and accuracy of the data which is used by any recipient. Moreover, the
recipient is not allowed to make any claim against the company for any indirect, direct or
consequential or incidental damage which may arise by using the data from GoldCare data-
bank. According to section 11 of the Licence agreement, R5 cannot make any claim against the
company as the agreement clearly states that no suit shall be brought against the company for
any loss or damage caused due to using the data of GoldCare data- bank.
QUESTION 4
Research and discuss at least four possible legal concerns and for each concern.
Scenario: Goldcare Kltd requires the advice on the possible legal concerns on the use of machine
learning which is analytical and the predictive capabilities in context to healthcare as specified in
case study.
Issue 1
Legal concern: Profiling of the patients by lack of skilled resources who cannot use the machine
learning is also one of the concern for the company.

Importance: This is one of the major issue which is faced by GoldCare Ltd. It is important for
every healthcare centre to profile the details of its patients in an effective manner so that biased
assumptions can be made regarding the patients, their status of health and also the risk factors
associated with them on the basis of their appearances and demographics. When the profiling is
done, it fractures the patient provider relationship and also contribute to the inequitable care
(Barczewski and Sykuna, 2020).
When GoldCare Ltd is employing many data scientists and use of the machine learning
among the artificial intelligence techniques for many of their activities. The main legal concern
shall arise for the profiling of patients by using machine learning. Through this, the predictions
and assumptions can be made easily but it requires the skilled workforce to use this technique so
that analytical content can be developed and managed easily. It is important to have the domain
experience and the in depth knowledge about the mathematics, technology and science.
Two advice to address or mitigate:
 The company GoldCare Ltd must recruit the high skilled and talented employees for
managing and developing the machine learning for the effective profiling of patients. The
organisation shall be required to pay large salaries as these people know their worth.
 The organisation must develop the Healthcare patient profiling planning and analysis
system, which is a guideline to manage the machine learning so that company can get
involved in planning the correct profiling using the machine learning based tools and
deploy efficient staff to handle such work.
Issue 2
Legal concern: Monitoring the patients but lack of quality data can be an issue in monitoring the
patient performance.
Importance: It is important for the GoldCare Ltd and other health care organisations to have the
proper system to monitor the health status of the patients. If monitoring is not done adequately
then it increases the risk of patient to stay longer in the hospital and still not recovering fully or
may result in death (Seuba, 2017). Monitoring the health status of patient regularly is important
as it helps in taking the right action at right time and taking action during the worst sign can help
in preventing the serious problems. The main concern in monitoring the patient may arise if the
quality data is not derived from the machine learning which may result in taking wrong action
and the consequence can be harsh such as death of patient. It is important to have quality data

otherwise it becomes difficult for algorithms to function as intended to them. If there is
incomplete data of patients, this can give rise to quintessential enemies of the ideal machine
learning (Semeler, Pinto and Rozados, 2019).
Two advice to address or mitigate:
 Firstly, the GoldCare Ltd must have the skilled staff who can take time to evaluate the
data and its scope with the meticulous data governance, data exploration and data
integration until and unless the company gets the clear data.
 The company must deploy the remote health monitoring system into its organisation so
that it can collect, analyse and learn from the real time data, automatic gain of knowledge
and making the predictions on patient state. This remote health monitoring system shall
help the organisation to represent the effective solution in order to monitor and control
the growing number of dependent or vulnerable patients.
Issue 3
Legal concern: Analysis and prediction of the healthcare needs of patients but it is difficult to
understand which of the process is required for automation.
Importance: Predicting and analysing the needs of patient is important as it helps in detecting the
early signs of the patient deterioration in the healthcare centre. Analysis and prediction also helps
in identifying the risk patients in their houses in order to prevent the hospitals from re-
admission and also prevents in avoiding the downtime of the medical equipment. As it has
become difficult to separate the fact from the friction in the machine learning in today's time.
The machine learning is the easiest way to automate the process but the main problem arise when
choosing the best process for the automation (Sandalova, Kochubey and Mescheryakova, 2019).
Choosing wrong process can lead to wrong data collection, analysis and prediction which can
create a chaos in the system, thereby affecting the whole record and data. Whenever a process is
chosen, it is important to choose the easy one otherwise complicated process may give rise to
further inspection before the automation. And machine learning helps in automatic processes but
not all problems of automation requires machine learning (Nizamuddin, 2020).
Two advice to address or mitigate:
 The company GoldCare Ltd must come up with such policies and guidelines which can
guide the employees to raise predictions through the machine learning in an effective