Before The Model Goes Live: A Privacy Risk and Data Ethics Checkpoint Framework for Deploying Machine Learning in Nigerian and UK Financial Institutions

References

[1] Bank of England and Financial Conduct Authority (2019). Machine learning in UK financial services. London: Bank of England.

[2] Barocas S, Selbst AD (2016). Big data's disparate impact. California Law Review, 104(3), 671–732. https://doi.org/10.15779/Z38BG31

[3] Board of Governors of the Federal Reserve System and Office of the Comptroller of the Currency (2011). Supervisory guidance on model risk management (SR 11-7). Washington, DC: Federal Reserve.

[4] Bracke P, Datta A, Jung C, Sen S (2019). Machine learning explainability in finance: An application to default risk analysis (Staff Working Paper No. 816). Bank of England.

[5] Cavoukian A (2011). Privacy by design: The 7 foundational principles. Information and Privacy Commissioner of Ontario.

[6] Central Bank of Nigeria (2018). Risk-based cybersecurity framework and guidelines for deposit money banks and payment service providers. Central Bank of Nigeria.

[7] Data Protection Act (2018). Data Protection Act 2018, c. 12. https://www.legislation.gov.uk/ukpga/2018/12/contents

[8] Financial Conduct Authority (2022). A new Consumer Duty (Policy Statement PS22/9). Financial Conduct Authority.

[9] Floridi L, Taddeo M (2016). What is data ethics? Philosophical Transactions of the Royal Society A, 374(2083), 20160360. https://doi.org/10.1098/rsta.2016.0360

[10] General Data Protection Regulation (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), as retained in UK law.

[11] Goodman B, Flaxman S (2017). European Union regulations on algorithmic decision-making and a "right to explanation." AI Magazine, 38(3), 50–57. https://doi.org/10.1609/aimag.v38i3.2741

[12] Information Commissioner's Office (2020). Guidance on AI and data protection. Information Commissioner's Office.

[13] Jobin A, Ienca M, Vayena E (2019). The global landscape of AI ethics guidelines. Nature Machine Intelligence, 1(9), 389–399. https://doi.org/10.1038/s42256-019-0088-2

[14] Kroll JA, Huey J, Barocas S, Felten EW, Reidenberg JR, Robinson DG, Yu H (2017). Accountable algorithms. University of Pennsylvania Law Review, 165(3), 633–705.

[15] Mehrabi N, Morstatter F, Saxena N, Lerman K, Galstyan A (2021). A survey on bias and fairness in machine learning. ACM Computing Surveys, 54(6), 115. https://doi.org/10.1145/3457607

[16] Mitchell M, Wu S, Zaldivar A, Barnes P, Vasserman L, Hutchinson B, Spitzer E, Raji ID, Gebru T (2019). Model cards for model reporting. In Proceedings of the Conference on Fairness, Accountability, and Transparency (pp. 220–229). ACM. https://doi.org/10.1145/3287560.3287596

[17] Mittelstadt BD, Allo P, Taddeo M, Wachter S, Floridi L (2016). The ethics of algorithms: Mapping the debate. Big Data & Society, 3(2). https://doi.org/10.1177/2053951716679679

[18] National Information Technology Development Agency (2019). Nigeria Data Protection Regulation 2019. NITDA.

[19] Nigeria Data Protection Act (2023). Nigeria Data Protection Act, 2023. Abuja: Federal Republic of Nigeria.

[20] Nissenbaum H (2004). Privacy as contextual integrity. Washington Law Review, 79(1), 119–157.

[21] Prudential Regulation Authority (2023). Model risk management principles for banks (Supervisory Statement SS1/23). Bank of England.

[22] Raji ID, Smart A, White RN, Mitchell M, Gebru T, Hutchinson B, Smith-Loud J, Theron D, Barnes P (2020). Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (pp. 33–44). ACM. https://doi.org/10.1145/3351095.3372873

[23] Wachter S, Mittelstadt B, Russell C (2018). Counterfactual explanations without opening the black box: Automated decisions and the GDPR. Harvard Journal of Law & Technology, 31(2), 841–887.

@article{1724136,
      author = {Onyinye Lydia Abuo},
      title = {Before The Model Goes Live: A Privacy Risk and Data Ethics Checkpoint Framework for Deploying Machine Learning in Nigerian and UK Financial Institutions},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {4},
      pages = {3191-3197},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1724136.pdf},
      abstract = {In Nigerian financial institutions, and across the UK, machine learning (ML) is already part of the fabric of credit applications, fraud detection and customer onboarding processes, but privacy and ethical concerns are only tackled at the back-end, inconsistently or once the machine learning solution is deployed. There is no existing guidance that is consistent or organized around a single decision point that a model should pass before it is allowed to go live. This conceptual review attempts to fill that gap by bringing together literature and regulatory sources in both jurisdictions. It establishes the concept of privacy risk, data ethics, model deployment governance and model risk management, puts the analysis in the context of privacy by design, contextual integrity, accountability and fairness and compares the Nigerian and UK regulatory frameworks. Then it highlights the key privacy and ethical issues that occur during deployment. Based on this, the paper suggests the Pre-Deployment Privacy and Ethics Checkpoint Framework, a gated framework of six stages: data and purpose validation; privacy impact and lawful basis check; fairness and bias testing; explainability and human oversight; security and third-party review; and go-live approval with monitoring hand-off. There is an evidence requirement and a pass/fail gate for each stage, with a named owner for each stage. The paper provides a practical, jurisdictionally flexible structure which turns dispersed obligations into a deployable and auditable trail, and it sets out limitations and testing requirements to move to the point where the framework could be considered valid.},
      keywords = {machine learning; financial institutions; privacy by design; data ethics; model governance; fairness and bias; regulatory compliance},
      month = {October},
      doi = {https://doi.org/10.64388/IREV10I4-1724136}
  }