Transparency and Openness

Transparency and openness are key principles. Agencies should notify individuals in their jurisdictions about the types of information they collect, including passive data collected using technologies identified in this study. Agencies should also explain how they collect the information, how it is used, disseminated, shared and protected. This principle encourages agencies to use plain language to explain their data practices, which helps individuals understand how their information is being used, and the risks these uses may create.

This principle is particularly significant if the information in question is personally identifiable. Personally identifiable information (PII) includes any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records. Data in isolation may not meet this standard, but when aggregated across multiple sources or matched with information from other databases, the data an agency collects or uses can meet the standard of personally identifiable. Explaining how data is collected and used can help individuals understand why their information is needed, and this transparency and openness can help legitimize these uses in the public’s mind. It may serve to mitigate public perceptions of government surveillance or tracking of personal mobility.

There is no one-size-fits-all approach to providing notices of data collection activities. An important aspect of this principle is that the communication should be clear and understandable, and devoid of legal jargon. Agencies often use their public-facing website to explain the rationale and process of data collection. Publically displaying a project website on a variable messaging sign, sending notices to an affected community, or using an existing online customer account portal are all potential options for informing the public. As an example, the Massachusetts Department of Transportation has placed a disclaimer on its website noting that social media communications will be recorded and may be subsequently disseminated: Please note that the Records Retention Law of the Commonwealth requires MassDOT to preserve records created or received by a state employee. Pursuant to this retention requirement comments posted or messages received via an official state agency page on a third party site will be considered public (Bregman and Watkins, 2014).

Notices need to specifically deal with the issue of obtaining consent and explicitly state how the agency will consider that consent was obtained. For example, the following are four common methods used to obtain consent. The method for obtaining consent should be customized to fit the needs of the data collection context.

• Explicit consent —an individual is clearly presented with an option to agree or disagree with the collection, use, or disclosure of personal information.
• Implicit consent — an individual’s consent is implied by his/ her behavior relative to the data collection activity.
• Opt-out consent — an individual is given the option to decline consent.

The method for obtaining consent should be customized to fit the needs of the data collection context, as well as the data collection location and the agency’s access to the individuals. In a passive data collection situation as is often the case with emerging technologies, individuals may not be aware that their behavior is being observed and recorded, and obtaining consent typically is not possible. In this situation, the agency should take all steps necessary to protect the privacy and security of that information as required by state law and professional practice. If PII cannot be de-identified, the agency should delete the personal data or seek informed consent from the individual for any further use.