Many organizations have codes of practice that define acceptable uses of computing facilities, with the main use being to support the organization's purpose. These codes often permit limited personal use and ban threatening emails or spam. They also restrict access to inappropriate websites and control web server content, while protecting employees who report other users' misuse. Organizational policies state how information is treated, such as restricting access to authorized personnel only, and data ownership lies with the departments that produce it, not the IT department that sets up systems.

1. Information Systems
Ethical Issues

2. Codes of Practice
• Many organisations have a code of practice
• This gives details of what uses can be made
of the organisation’s computing facilities
• Main use is to support the purpose of the
organisation
• Can also define the extent of personal use
permitted

3. Codes of Practice
Examples:
• Use of email
– Usually ban threatening, harassing emails
– Also spamming or producing large number of
unsolicited emails
– Limited use of email for personal uses is often
permitted

4. Codes of Practice
Examples:
• Use of Internet:
– Access to inappropriate websites usually
banned or filtered out
– Control over content of company web
servers
– Limited use of internet for personal purpose
is often permitted

5. Codes of Practice
Examples:
• Whistle Blowing:
– Protection for employees who report other
users’ misuse of the system
– E.g. Organisation’s system administrators

6. Organisational Policies
• Policies stating how information is treated
• Could be on a “need to know” basis where
access to information is restricted, e.g.
storing data in secure areas
• Could be restrictions on access due to
physical limitations

7. Information Ownership
• Data should be owned by the department
who produced it
• They should be responsible for ensuring
that the data is correct and consistent
• Often, the people who provide the final
information are responsible for it
• Even if the IT Department set up the MIS
systems, not ideal for them to be
responsible for the data