Selective Transparency — Public for Process, Private for Persons 1.2.7-2

Purpose

The article constructs selective transparency as the first component of answerability — the specification that operationalizes privacy by design's (1.2.4) asymmetry principle at the institutional level. This sidebar expands the three-tier framework with criteria for classification and the design discipline for boundary cases.

Three Tiers of Institutional Disclosure

Tier One — Public by Default

What belongs here: The institution's rules, governance structure, decision criteria, budget allocations, audit results, membership in the accountability ladder, and any standing commitments to external parties.

The structural test: If this information were concealed, would those affected by the institution's operations be unable to evaluate whether the institution is operating as designed? If yes, it belongs in Tier One.

Design discipline: Tier One information should be published proactively — not upon request, not in response to litigation, not after a crisis reveals that concealment was occurring. The proactive standard matters because the purpose of Tier One transparency is not to satisfy curiosity but to make the institution structurally legible. An institution that publishes its rules only when compelled to do so has already demonstrated that its default is opacity — and opacity at Tier One is a capture signal.

Tier Two — Auditable on Request

What belongs here: Operational details — how specific decisions were made, what evidence was considered, what alternatives were evaluated, what trade-offs were accepted, how resources were allocated to specific projects, and how performance was measured against stated criteria.

The structural test: If this information were concealed, would those responsible for holding the institution accountable be unable to evaluate whether specific institutional actions were consistent with its stated rules and purpose? If yes, it belongs in Tier Two.

Design discipline: Tier Two information is not public by default because it is typically voluminous, context-dependent, and may include commercially sensitive or strategically significant detail. But it must be accessible through defined audit processes to parties with legitimate accountability standing — oversight bodies, external auditors, affected persons pursuing recourse. The access process itself must be transparent: who can request it, under what conditions, within what timeline, and with what protections for the requester.

The boundary between Tier One and Tier Two is the distinction between structural legibility and operational detail. An institution's decision criteria (Tier One) must be public so that anyone can evaluate whether the institution's rules are fair. How those criteria were applied to a specific case (Tier Two) may involve detail that warrants controlled access — but it must be auditable by those with standing.

Tier Three — Protected by Design

What belongs here: Personal information that the institution custodies on behalf of the individuals it serves, employs, or governs. Employee records, client data, health information, financial details, and any information whose disclosure would expose a person rather than an institutional process.

The structural test: If this information were disclosed, would a specific person be exposed to risk, harm, or loss of autonomy? If yes, it belongs in Tier Three, subject to privacy by design's full requirements.

Design discipline: Transparency at Tiers One and Two does not override privacy at Tier Three. This is the structural commitment that distinguishes selective transparency from total transparency. An institution that publishes its decision criteria and makes its reasoning auditable has satisfied its accountability obligations. It does not need to expose the personal data of those affected to demonstrate that it is operating as designed.

The boundary between Tier Two and Tier Three is the distinction between institutional process and personal identity. An audit of how the institution applied its hiring criteria to a pool of candidates (Tier Two) does not require disclosing the candidates' personal data (Tier Three). The audit operates on the institution's process; the personal data belongs to the persons.

Boundary Cases

Some institutional information does not sort cleanly into a single tier. Three recurring boundary patterns require explicit design decisions.

Aggregated personal data. Individual records are Tier Three, but statistical summaries drawn from those records — demographic breakdowns, outcome distributions, pattern analyses — may serve Tier One or Tier Two accountability functions. The design discipline: aggregation must be sufficient to prevent re-identification, consistent with privacy by design's failure-mode analysis. If the population is small enough that aggregation does not protect identity, the data remains Tier Three.

Deliberative process. How an institution's governing body reached a decision may involve candid assessments, dissenting views, and preliminary analyses that participants shared in confidence. The design discipline: the existence and outcome of the deliberation belong in Tier Two (auditable); the specific content of confidential deliberations may be time-delayed or summarized to protect the deliberative function — but the delay must be bounded and the eventual disclosure must be guaranteed.

Whistleblower and challenger identity. Persons who challenge institutional decisions through public challenge mechanisms have a right to confidentiality — their identity is Tier Three even though their challenge is Tier Two. The design discipline: the institution must demonstrate that it can process challenges effectively without exposing challengers. If the institution claims it cannot investigate without identifying the challenger to the authority being challenged, the challenge mechanism is structurally compromised.