The Matrix
The article establishes the asymmetry principle — institutions must be transparent; persons must be opaque — and defines three tiers of institutional transparency: public by default, auditable on request, and protected by design. This sidebar maps those categories against information types to produce a reference matrix that readers can use to evaluate any system's privacy architecture.
The matrix answers a practical question: for a given type of information, what is the appropriate default? The answer depends on two variables — who the information is about (the institution or a person) and what kind of information it is (operational, relational, or personal).
Institutional Information
Institutional information describes how an institution operates, decides, and allocates resources. It is subject to the transparency side of the asymmetry principle.
| Information Type | Default | Examples | Governing Principle |
|---|---|---|---|
| Rules and decision logic | Public by default | Policies, algorithms used for consequential decisions, enforcement criteria, eligibility rules | Persons subject to rules must be able to evaluate them |
| Budgets and resource allocation | Public by default | Revenue sources, expenditure categories, compensation structures, funding priorities | Financial accountability requires visibility |
| Authority structures | Public by default | Governance charts, decision-making authority, escalation paths, oversight relationships | Power must be traceable |
| Operational processes | Auditable on request | Internal workflows, staffing decisions, vendor relationships, internal communications about operations | Not routinely disclosed, but accessible to authorized auditors |
| Enforcement records | Auditable on request | Disciplinary actions (anonymized), compliance reports, audit findings, exception logs | Patterns of enforcement must be examinable without exposing individuals |
| Internal deliberations | Auditable on request | Draft analyses, internal debates, preliminary assessments | Protected during process; auditable after decisions are finalized |
The principle governing institutional information: the default is legibility. What the institution does with its power must be knowable to the people subject to that power. Restrictions on institutional transparency require justification — and the justification must be specific, bounded, and temporary (e.g., protecting a deliberation in progress, not shielding a decision from review after it has been made).
Personal Information
Personal information describes who a person is, what they do, and how they live. It is subject to the opacity side of the asymmetry principle.
| Information Type | Default | Examples | Governing Principle |
|---|---|---|---|
| Identity data | Protected by design | Name, address, date of birth, government identifiers, biometric data | Identity is disclosed only when structurally necessary and through selective disclosure mechanisms |
| Behavioral data | Protected by design | Purchase history, browsing patterns, location history, communication metadata, movement patterns | Behavioral data is not collected unless a specific, bounded purpose requires it — and is not retained beyond that purpose |
| Associational data | Protected by design | Group memberships, political affiliations, religious associations, social connections | Associations are among the most sensitive categories; exposure enables profiling, discrimination, and coercion |
| Financial data | Protected by design | Income, account balances, transaction history, credit records | Financial data is disclosed through attestation (creditworthiness verified without balance exposure) whenever possible |
| Health data | Protected by design | Medical records, prescriptions, diagnoses, treatment history, genetic information | Health data carries the highest re-identification risk and the most severe consequences of exposure |
| Communications content | Protected by design | Messages, emails, voice recordings, written correspondence | The content of communications is protected by encryption; metadata protection (sidebar note: this is the harder problem) requires architectural design |
The principle governing personal information: the default is opacity. The person's information is hidden, attested, or selectively disclosed — never collected or exposed as a condition of participation unless the Privacy Decision Flow's requirements are met in full.
Relational Information
Relational information sits at the boundary — it describes the interaction between an institution and a person. This is where privacy design is most difficult, because the information is simultaneously institutional (relevant to the institution's operations) and personal (identifiable to the specific person).
| Information Type | Default | Handling Principle |
|---|---|---|
| Transaction records | Compartmentalized | The institution retains what it needs for operational and legal purposes; the person's identity is separated from the transaction where possible (anonymization, pseudonymization, or attestation) |
| Service history | Compartmentalized | The institution may retain aggregated service patterns for operational improvement; individual service histories are protected and accessible only to the specific person and the specific function that requires them |
| Complaint and dispute records | Compartmentalized | The institution tracks patterns (for the enforcement records in the institutional table above, anonymized); individual records are protected and accessible to the parties involved |
| Employment records | Compartmentalized | The employment relationship generates information that is both institutional and personal; compartmentalization ensures that the institution's legitimate operational needs are met without making the full employment record available to functions that do not require it |
The principle governing relational information: compartmentalize by function. The institution accesses what its specific function requires. The person's full profile is never assembled unless the person chooses to assemble it. Cross-function access requires fresh justification under the Privacy Decision Flow.
Using the Matrix
The matrix is a reference, not a regulation. It specifies defaults — the structural starting point for any system's privacy design. Departures from the default are possible but must satisfy the Privacy Decision Flow: a specific purpose, bounded scope, informed consent, and structural enforcement of the boundary.
The matrix also serves as a diagnostic. When evaluating an existing system, the designer can ask: for each category of information this system handles, does the system's treatment match the default? Where it departs, is the departure justified, bounded, and structurally enforced? Where the departure is unjustified — where personal information is treated with institutional-level transparency, or where institutional information is treated with personal-level opacity — the system has a privacy design gap that requires structural correction.
The institutional specification of selective transparency — the operational rules governing who can audit what, under what conditions, and with what recourse — is constructed in (1.2.7-2). This sidebar establishes the structural logic; that sidebar will address the institutional machinery.