Purpose Specification

This principle builds upon the transparency principle. Agencies should clearly and specifically state why they are capturing information, and under what authority they are using the information, when providing notices of data collection activities. Identifying the “purpose” creates a guiding framework for balancing data needs and privacy/security, and the documentation can be helpful for those who must answer the public’s or media’s questions about risk. If the agency adopts new purposes, or changes the original purpose(s) for data capture, these should be documented and clearly communicated to their constituencies as well. The actual data collection practices and technologies being used should be consistent with the commitments made to individuals in the jurisdiction and comply with evolving regulatory requirements. The notices should also state any data sharing that will be done with third parties. This principle can apply to collecting identifying or non-identifying data, but is perhaps most critical when agencies collect sensitive and PII data.

Washington DOT’s website web privacy notice page that explains what it does with data collected as a result of persons’ visits to the website. It also describes several state and federal laws that apply to PII that that is captured in the course of navigating the web site. Alaska DOT’s website has a page that explains what it does with data collected via its Road Weather Information System (RWIS) that are comprised of various sensors as well as computer vision systems. The information also identifies with what entities Alaska DOT shares the RWIS data.