Ethical and/or legal obligation to report the breach to its customers
Scenario
A few years ago Clare Applewood started a small outdoor equipment business called Mountain Top View. The company is a sole proprietorship. The company began as a single storefront and has grown rapidly to include online ordering through the company website. The company’s website includes the statement, “We are committed to keeping customer information secure and protected.” Clare also uses social media sites to market the company.
Carlos Rodriguez has worked for the company since the beginning. He oversees both store and online operations. Clare and Carlos make most decisions together.
Steve, the company’s Information Technology lead, discovered that the company database of customer information was hacked. Customer names, addresses, and phone numbers were accessed for only those customers who placed online orders in the first quarter of the year. Steve was able to correct the code that allowed the hack and is confident that the database is now secure.
When Carlos overhears Steve talking about the database fix in the store break room, he questions Steve about why he did not bring the breach to anyone’s attention. Steve explains that because he was able to quickly correct the code that led to the breach, and because only address and phone number information for a handful of customers was accessed, he didn’t think it was necessary to say anything.
Clare asks Carlos to evaluate whether the company has an ethical and/or legal obligation to report the breach to their customers and to recommend a course of action. She also asks Carlos to select an ethical test or framework that all employees can use in the future to help guide their decisions.
Directions:
Report:
Evaluate whether the company has an ethical and/or legal obligation to report the breach to its customers. Your evaluation should be framed as a report for the owner, Clare, that includes the following sections and information. Cite your sources using APA style.
Sample Solution
Mountain Top View is a small outdoor equipment business that was started by Clare Applewood a few years ago. The company has grown to include both physical and online stores, with an emphasis on customer privacy and security. Recently, the company’s database of customer information was hacked, leading Carlos Rodriguez to question whether or not the company has an ethical and/or legal obligation to report the breach to their customers. This report will evaluate this issue in order to recommend a course of action for Mountain Top View.
The breach occurred in the first quarter of this year when customer names, addresses, and phone numbers were accessed from the company’s database system. Steve, the company’s Information Technology lead, quickly corrected he code that led to the hack and is confident that the database is now secure. Steven felt no need at that time to report it because only address and phone number information for a handful of customers was accessed.
Various laws exist regarding data security breaches such as GDPR which outlines what companies must do when they suffer from a data leak (European Commission 2020). Additionally there are several ethical tests or frameworks which can be used guide employee decision making processes; one example being Kant’s Categorical Imperative (Kant 1785).
Based on current laws surrounding data protection it appears Mountain Top View does have an obligation notify its customers about any future breaches take place within their systems (European Commission 2020). Furthermore using ethical principles like Kant\’s Categorical Imperative leads us conclude that protecting customer’s private data paramount duty(Kant 1785). Therefore seems clear Mountain Top View should contact affected customers alerting them potential risk while also providing tips prevent similar events occurring again future.
It appears clear after analysis Mountain TopView has both legal obligations ethically responsibility follow protect their customers’ private information. In light this would recommend contacting all affected informing them potential risks along with steps they can take guard themselves offered suggestions how prevent similar incidents recurring future operations . Moreover implementing some form ethical test framework help employees make better decisions concerning needs ensure adequate levels privacy .
