This principle builds upon the transparency principle. Agencies should clearly and specifically state why they are capturing information, and under what authority they are using the information, when providing notices of data collection activities. Identifying the “purpose” creates a guiding framework for balancing data needs and privacy/security, and the documentation can be helpful for those who must answer the public’s or media’s questions about risk. If the agency adopts new purposes, or changes the original purpose(s) for data capture, these should be documented and clearly communicated to their constituencies as well. The actual data collection practices and technologies being used should be consistent with the commitments made to individuals in the jurisdiction and comply with evolving regulatory requirements. The notices should also state any data sharing that will be done with third parties. This principle can apply to collecting identifying or non-identifying data, but is perhaps most critical when agencies collect sensitive and PII data.
Washington DOT’s website web privacy notice page that explains what it does with data collected as a result of persons’ visits to the website. It also describes several state and federal laws that apply to PII that that is captured in the course of navigating the web site. Alaska DOT’s website has a page that explains what it does with data collected via its Road Weather Information System (RWIS) that are comprised of various sensors as well as computer vision systems. The information also identifies with what entities Alaska DOT shares the RWIS data.
- Does your agency have a clear specific purposes for the data it is collecting?
- Does your agency staff and the affected public understand the purpose or purposes for which emerging data are collected and maintained?
- Does your agency typically limit the collection of data to only those items that are necessary to the policy/planning purpose, and ensure they are not used in any manner incompatible with these purposes?
- Does your agency regularly audit the purposes for which data are used?
Answering these questions can help your agency understand if the principle of purpose specification applies to your data collection and use activity, and identify possible actions or tools to aid implementation. If answers to these any of these questions are “yes”, then the principle of purpose specification could apply to your agency.