Both columns are true at once, and this deck is not an argument for the second against the first. Digital delivery has reached people the paper system never found. The discipline is to hold the gain and the cost in view together, because programmes that see only one of them make predictable mistakes.

The left and right columns are the same questions at different prices. Nothing in this deck is technically difficult; almost all of it is cheap early and close to impossible late, which is why the timing is the substance of the argument.

The practical corollary: instrument the failures. A count of authentication rejections, by shop and by day, is a cheap piece of engineering and is usually the only way exclusion becomes visible to anyone with the power to act.

The first row is the most consequential question in this field. Removing ineligible claimants and removing eligible ones look identical in the headline number, because both appear as a fall in the beneficiary count. Only disaggregated follow-up distinguishes success from exclusion.

The second row is the honest trade-off. Removing clerical discretion removes petty corruption and removes the human who could make an exception for the widow whose name is spelled two ways. Both effects are real, and the second is rarely costed.

The left column is where most practitioners have real power and where it is least often exercised. A field officer choosing not to collect caste in a survey that does not need it has done more concrete good than a policy paper on data minimisation.

Every bad answer in the right column is true and non-responsive, which is what makes them persuasive in a meeting. Each answers a question about the average case when the question asked was about the failing case.

The examples are deliberately South Asian. Most digital-ethics material is written about European regulation and American platforms, and its assumptions — that consent is meaningful, that opting out is possible, that a regulator will act — hold differently here.

“It is just a phone number” is how most leaks begin, and the same logic applies field by field. Personal data is not a category of field; it is a property of a combination, which is why minimisation has to be judged across the whole record rather than one column at a time.

Privacy is about control, not concealment. The question is not whether a fact is shameful but who gets to decide where it travels — and a person who cannot decide has lost something whether or not the fact is embarrassing.

The judgment is the foundation for everything in this section and is not self-executing. It supplies a test that any data-collecting programme can be measured against; it does not supply anyone to do the measuring, which is what Section 11 is about.

The third step is the one that decides most real cases. Almost every data collection has a legitimate aim; far fewer can show that the least intrusive means was considered. Asking “what would we do if we could not collect this?” is the practical form of the test.

The second row is the one that decides whether the rest matter. Consent given because the alternative is losing a pension is not free in any meaningful sense, however well the form is drafted, and no amount of explanation repairs it.

The last row is the one NGOs get wrong most often. A grievance system that stores identifiable complaints without a strict access rule is a list of people who spoke up, and in a small community that is a dangerous document to hold.

The Act does not exempt you for being small. The obligations scale with what you process, not with your budget, and an organisation holding beneficiary records is processing digital personal data in exactly the sense the Act means.

Anonymisation is a spectrum, not a state. A dataset is re-identifiable in proportion to how many other datasets exist to join it against, and that number only grows. “It is anonymised” describes an intention rather than a guarantee.

None of these is a mathematical question, which is the point. The maths is neutral in the trivial sense that it optimises whatever it is given; every choice about what to give it is a decision about people, made by people, and usually undocumented.

Every row shares one shape: the group that was under-served historically generates less and worse data, and the model reads that absence as a property of the group rather than a property of the record.

The model is not wrong about the data; it is wrong about the world, and it has no way to tell the difference. Absence in a dataset means “not recorded”, and every model treats it as “not there”.

“We do not collect caste” is not a fairness claim. In South Asian data, surname and locality reconstruct it well enough for a model to act on, and dropping the column simply removes your ability to check whether it is doing so.

The loop is self-confirming, and from inside it looks like accuracy. Each cycle the model’s predictions match outcomes more closely — because the model is causing the outcomes it predicts. Performance metrics improve while the exclusion deepens, so the dashboard reports success.

These cannot all hold at once when base rates differ between groups — a result that is mathematically proved, not a matter of engineering effort. Any system claiming to be simply “fair” has chosen one and not told you which.

The first row is the whole audit in one line. Aggregate accuracy is the number a vendor will lead with and the number that hides the harm; an overall error of 12 per cent is compatible with 26 per cent for the group that can least afford it.

“Amplifier” is the right word for what AI does here. Applied to a well-designed process with good data, it extends reach. Applied to a process with an unexamined exclusion in it, it applies that exclusion faster, more consistently and with a confident interface.

Opacity removes a right without ever debating it. The right to contest an adverse decision depends on knowing the reason for it, so a system that cannot state a reason has quietly abolished the appeal while appearing merely technical.

Correcting it requires deliberately counting the invisible error — surveying people who dropped out, auditing rejections rather than approvals, tracking the exception register. None of that happens by default, and all of it is cheap compared with the harm.

The last row is specific to our context and under-discussed. Generated text in a language the deploying team does not read cannot be reviewed by that team, and the fluency that makes it usable is exactly what makes an error invisible.

Calibration is the point. Treating every use as high-stakes produces an oversight process nobody follows; treating every use as low-stakes produces the failures in the previous slides. The judgement is about the cost of being wrong, borne by whom.

The first row hides the most common failure. A tool described as advisory becomes decisive when overriding it requires justification and accepting it requires none. Ask what share of suggestions were overridden last quarter; the answer is usually close to zero.

Getting these distinctions right matters for the argument. Critiques that overstate what the system holds are easy to dismiss and take the well-founded objections down with them. The strongest case against a design is one that describes it accurately.

The same property produces the harm, though. An identity that unlocks everything also gates everything, and the next slide is about the people for whom the gate does not open.

Researchers and journalists have documented specific cases in which authentication failures left entitled people without their ration. Treat the mechanism as established and the national magnitude as contested — that is the honest position, and it is enough to require a fallback.

Fallbacks fail on incentives, not on design. If exceptions are treated as suspicious, the person at the counter will avoid using them, and the route exists on paper only. Whether the operator is rewarded or penalised for using the override decides whether it works.

Apply the test to any system, including your own. “What happens to someone who says no?” converts a policy adjective into an observable fact, and a programme that cannot answer it has not thought about consent at all.

The left column is what gets reported and the right column is what would tell you whether the system works. Every metric on the right is computable from data these systems already generate; the reason they are absent is that nobody required them.

Nobody had to intend surveillance for this to happen. Delivery and monitoring run on the same rails, and the by-product of a well-designed delivery system is a detailed longitudinal record of the people it serves.

Function creep is rarely a decision; it is a series of reasonable requests. Each new use is individually defensible — an investigation, a study, an audit — and the cumulative result is a database doing something nobody would have approved at the outset.

The asymmetry is the finding, not the surveillance. Scrutiny is applied in inverse proportion to power, and the justification — that public money requires accountability — is never applied with equal force to tax expenditures or subsidised credit.

Conditions sort by capacity to comply, not by need. The households that fail a condition are usually the ones facing the constraint the programme was designed for, so conditionality tends to remove exactly the people it was meant to reach.

The harm does not require anyone to be watching. Belief that a record exists and might be read is sufficient, which means chilling effects are produced by ambiguity — and ambiguity is the default state of most systems people encounter.

The technology is not the fault line; the asymmetry is. The same capability in a system where the subject can see, correct and contest is a different thing entirely — which is why the remedies in Section 10 are about visibility and redress rather than about restricting the technology.

The third and fourth rows are ours. Where the person asking for consent is also the person who decides whether you receive help, consent is structurally compromised regardless of how carefully the form is worded or how sincerely it is offered.

Each safeguard has a paper version and a working version, and the difference is whether it is enforced by the architecture or by good intentions. Architecture survives a change of management; intentions do not.

The second row is invisible in most statistics. Household phone ownership is the standard measure and it hides intra-household distribution: a phone owned by a man is counted as access for his wife and daughters, who may use it under supervision or not at all.

The axes stack rather than substitute. A poor, non-literate rural woman with a disability faces all five at once, and a design that fixes one of them changes nothing for her — which is why single-axis accessibility fixes so often fail to move usage.

Most digital-inclusion funding sits at levels one and two, where progress is countable, and most of the benefit sits at level four, where it is not. That mismatch is the standard reason inclusion programmes report success and change little.

Digital-by-default becomes digital-or-nothing wherever the offline channel is quietly withdrawn. It is rarely announced; the counter closes, the form goes out of print, and the staff who handled paper are reassigned. The policy says both channels exist.

Assisted use is the norm, not an edge case, and almost no system is designed for it. Interfaces assume a single user who is the account holder, so every real transaction involving a helper is technically a security violation.

Every row helps more people than the group it targets. Captions help in noisy places, high contrast helps in sunlight, low-bandwidth builds help everyone on a bad day. Accessibility work is rarely a minority accommodation in practice.

Gatekeeping compounds down the stack. An organisation can change its content but not its ranking, change its app but not the store’s terms, change its provider but not at short notice. Each layer is a dependency with its own unilateral terms.

Present both columns. The framing is analytically useful and it is a metaphor with limits; stating the limits is what stops it becoming a slogan and makes the underlying observation — that value flows in one direction — harder to dismiss.

The third row cuts both ways and is worth stating carefully. Newer regulation can also be better designed, having learned from elsewhere; the DPDP Act exists because that argument was won. The risk is the gap between a law passing and a regulator being able to act on it.

Ask the question before you build, not during the incident: what happens to the people we serve if this platform changes its rules, raises its price, or closes our account? A dependency with no answer is a single point of failure sitting outside your control.

Sovereignty is not automatically protective. Moving data from a foreign firm to a domestic government changes who holds it, not whether the person it describes has any say — and for some populations the domestic state is the more immediate risk.

The realistic stance is not refusal. Most organisations cannot leave the platforms their participants already use, and telling them to is advice nobody can act on. Using them with eyes open — and with an exit that exists — is what is actually available.

The distinction between misinformation and disinformation decides the response. A worried relative is a target, not an author, and responding to them as though they ran the campaign loses the only channel into that group.

Trust in the messenger launders the message, and this is why closed-network falsehood is harder to counter than open-platform falsehood, not easier. No label competes with an uncle.

The second row is the intervention within reach of most organisations. Rumour fills a vacuum; saying something true, early and locally — even “here is what we know so far” — is the cheapest thing that reduces the space it fills.

Each scam borrows the shape of a legitimate process, which is why generic warnings do not work. “Never share your OTP” is undermined every time an intermediary legitimately needs it to complete a transaction on someone’s behalf.

Investment tracks revenue, not risk. The languages with the most users and the highest real-world stakes are frequently the least resourced, because moderation spending follows advertising value per user rather than potential harm.

Both columns describe real failures, and neither side is automatically right. A deck that presented only one would be doing advocacy; the honest position is that this is a genuine trade-off with no setting that avoids both errors.

The fourth row is where development organisations already have the asset. Community health workers, self-help group leaders and teachers are trusted messengers who exist, are known and are reachable — which is exactly what no platform intervention can manufacture.

This table is the argument for the whole section. Ethics late is not merely less effective; for several of these decisions it is effectively unavailable, because the cost of reversal exceeds what any organisation will spend on a harm that is already priced in.

Defaults decide outcomes for almost everyone. The share of users who change a default is small in every study of it, so the setting you ship is, in practice, the policy — regardless of what the consent screen offers.

The Principles are a real sector framework, endorsed by many donors, which makes them useful in a proposal as well as a design meeting. Citing them converts an ethical argument into a compliance argument, which is frequently the argument that wins.

The second row is where most exercises are too polite. The realistic misuse case is often a family member with access to a woman’s phone, or a local official with a grudge — not a sophisticated attacker, and not the scenario a security review covers.

Run this audit on your own current survey form. Most organisations find several fields that nobody has analysed in years, collected because the template had them — and each one is a breach that could not have happened if it were not there.

“Nothing about us without us” is a design method here, not a slogan. Each row above is knowledge that exists only in the affected population and is not recoverable by testing, because a test tells you that something failed and not why.

A system with no appeal is not efficient; it is unaccountable. Efficiency claims usually count the cost of handling appeals and not the cost of wrong decisions that stand, because the second falls entirely on people outside the organisation.

The last layer acts most often and is trained least. The person deciding which fields go on a survey makes hundreds of small data-protection decisions a year, and usually receives no guidance at all on any of them.

A law is only as strong as the body enforcing it, and these four properties — not the wording of the statute — determine whether a data-protection regime does anything. They are also observable, so the assessment does not require legal training.

A right nobody knows about protects nobody, and communities you work with are unlikely to hear about these anywhere else. Explaining them is squarely within what a field organisation can do and rarely does.

Most organisations buy rather than build, so procurement is where most of their digital ethics is actually decided — usually by people who were not in any of the conversations this deck describes.

And the structural point stands alongside it. Individual care does not substitute for law, regulators and platform accountability; it is what fills the gap while those are built, and it is the part you control.

Start with Eubanks if you read one. It is the closest to the work most readers of this deck do — welfare systems, eligibility decisions, the people at the counter — and it is built from cases rather than argument, which makes it harder to wave away in a meeting.