Where to start?
Our Director, Clare Paterson, was invited to speak on a panel at the Housing Community Summit 2025 on the topic of “AI ethics”. It was a great opportunity to get the conversation going, and here Clare shares her thoughts in more detail.
“In housing, as in many other sectors, there’s a lot of excitement, but also nervousness, about what artificial intelligence might mean for staff, residents, and decision-making.
But here’s the thing; ethics is slippery. What feels “ethical” to you might feel very different to me.
So where do we start? Luckily, there’s a ready-built framework, that landlords can – and should – use to apply ethics to AI projects and procurement.
Personal ethics vs organisational ethics
I think it’s fair to say that most of us, if pushed, would break the law for something we believe is right. Such as speeding to hospital if your child was ill in the back seat? Or breaking a car window to rescue a dog in hot weather? Maybe even turning a blind eye to someone shoplifting food from a multi-billion pound company?
In our personal lives, we can often justify those types of choices.
But as an organisation? Would you be happy writing in a Board paper that you recommend that the organisation knowingly break the law, because you think it’s the “right thing”? Would you defend that decision to the regulator, ombudsman, or to your residents?
That’s the difference. Organisations can’t rely on personal good intentions. We need a baseline everyone can agree on, and what better shared baseline than the law?
The law isn’t behind
There’s a myth that the law hasn’t caught up with AI. With an undertone of “which means we can do what we want, for now.”
But there is already a whole host of law that applies to – not AI specifically – but to the things we want to use AI to do.
In social housing especially, a lot of the processes AI can and does get used for, involve data linked to people (even “just” address data is linked to people who live or lived in the address). And that means that this data processing is subject to all the data protection law. And there is a lot of data protection law! Not only the (UK)GDPR, and the Data Protection Act 2018, but also the the often forgotten PECR (Privacy Electronic Communications Regs), and the brand new Data Use & Access Act.
“I’m uncomfortable with the thought of AI making a decision about who gets allocated a property, and who doesn’t”
When planning for the Housing Community Summit panel session on AI ethics in housing, the topic of AI-automated housing allocations came up: “I’m uncomfortable with the thought of AI making a decision about who gets allocated a property, and who doesn’t”, went the conversation. I listened for a few minutes, and then agreed that it is worrying…but added that we are already subject to law around automated decision-making that has a significant effect on individuals.
And it’s a law that everyone has heard of, but not everyone understands its scope – the UK GDPR (Article 22 specifically for automated decision-making.)
The problem isn’t a lack of law. The problem is a lack of awareness.
The Ready-built Framework
It’s not just automated decisions though; the UK GDPR already contains the Principles of a robust Data Governance framework, ideal for AI use. Let’s look at the OECD (Organisation for Economic Co-operation and Development) AI Principles, the European Commission Ethics guidelines for AI, and the AI Playbook for the UK Government for examples of the principles we’re being encouraged to follow in AI use.
Common themes include:
- Positive uses of the technology, ” in pursuit of beneficial outcomes for people…”
- Upholding human rights, including privacy, and “use AI lawfully, ethically and responsibly”.
- Transparency and accountability, being able to explain the AI and its impacts.
- Avoiding bias and discrimination in the impacts of the AI use.
- Robustness – in terms of the systems inputs and outputs i.e. data accuracy and data quality.
- Security of data inputs and outputs.
- Appropriate human control or intervention.
I don’t know about you, but I reckon that’s a pretty good list. These principles should help ensure AI is used as a tool for good and reduce the risks involved in its use or misuse.
And (you might see where this is going) the other thing about this list? Every one of these principles is already included in that ready-made framework, the (UK)GDPR!
Even better, several explicit controls are also written into the GDPR, to help those procuring or developing AI systems direct them in accordance with the principles; the rules around automated decision-making mentioned above, but also data breach handling and risk assessment procedures, as well as real clarity on what “lawful” means when processing personal data, and defined contract clauses that put the purchaser in control. Why look further? Of course AI use also involves non-personal data, but why reinvent the wheel looking for principles for non-personal data use, when the existing GDPR principles already fit so well for any type of data?
Self-driving cars and Barcodes
The invention of self-driving cars doesn’t mean we rip up the rules of the road. Stop signs, speed limits, seatbelts, they all still apply. AI is the same; we can think of Data Protection law as the Highway Code, and its requirements as the road signs. Some say ‘stop’, some say ‘give way’, and some set speed limits or parking limits. But they’re already there.
Compare AI to another technology, the barcode. It was invented in the 1940s, patented in the 1950s, and sat around for decades before it found a use. The breakthrough came in 1974, when a pack of Wrigley’s gum was the first item scanned in a supermarket. Today, barcodes are everywhere of course, but only because we found lawful, practical applications.
AI in housing is similar. The technology exists, but the value won’t come from slapping it on everything we do. It will come from finding lawful, ethical uses that genuinely benefit tenants and colleagues.
Parking blind
I’m not saying that project managers and procurement managers need to be data protection experts. But I do believe they need to know there are data protection hazards involved in AI, and to know they need to get someone in to guide them before they hit a hazard.
Like reversing your car into an awkward parking space, you might not see the bollard or the low wall, but you know enough to know there could be something there. So it makes sense to ask someone to help guide you in safely.
That’s what data protection specialists can do in AI projects. They can stop you hitting a hazard you didn’t know was there. And in housing, that “something” is usually your residents’ rights and trust just for starters, as well as the monetary costs, reputational damage, and resources needed to put things right after the fact.
Ethics in practice
The fact that so many laws exist already that apply to AI use in housing (as well as the plethora of data protection laws, we also have to consider intellectual property and other laws too), means that applying ethics to AI use in housing isn’t about inventing a new set of rules. It’s about applying the ones we already have, with discipline.
My approach with clients is simple but powerful:
- Here’s what the law says (and spoiler, it’s probably not what you think.)
- Here’s what compliance looks like (again, probably not what you think.)
- Here’s what could go wrong if you choose non-compliance (and if you think I’m going to say “fines, fines, fines” you might be surprised again…)
Notice the word “choose”; it’s up to the organisation’s leadership to decide how much risk they’re comfortable with. My role is to make sure those choices are informed, not blind.
At the moment, far too many Senior Management Teams and Boards are signing off on strategies and plans that are likely to break the law, but they just aren’t aware of it. It’s like signing off on driving down a road at 40mph, because it feels like that particular road should have a 40mph limit, without realising the speed limit on that road is actually 30mph. Even worse, in some cases, it’s like the decision-makers don’t even know there’s any speed limit in effect.
We can help highlight the hazards hidden in your AI plans: In the contracts you’re thinking of signing with your AI provider and consultants; in the re-using of data you already hold; in the predictions of tenant behaviour or “vulnerability”; in the automated decision-making with significant effects on people; or in the analysis of surveillance data. The list could go on. Because so many activities in housing organisations are already crossing into unlawful territory, often without leaders realising it, and AI will magnify the likelihood and speed of unlawful activities.
AI in housing is inevitable. But the good news is we already have a framework and rules to follow to make its use ethical- we just need to appreciate the breadth of how and when they actually apply. Ethics without law is just opinion, and opinion won’t protect anyone.”
About the author
Consultant, speaker, author
What began as my personal consultancy has since grown into a wider practice, supported by a small team of trusted associates who bring experience from social housing, third-sector, and commercial organisations.
Over the years we’ve worked with housing providers, charities, public bodies, and commercial organisations of all sizes. My time working in a respected law firm also gave me valuable insight into how data protection fits into the broader legal and regulatory landscape.
Working with CP Data Protection isn’t just about having access to our expertise, though. It’s also about becoming part of the community we’ve built together, through the Data in Social Housing (DiSH) Network, and the Hive Community, which includes the Hive Live Annual Data Conference and free monthly Hive Online sessions. These spaces connect people who face the same challenges to share knowledge and support one another in roles that can otherwise feel isolated.