Selective Disclosure, Plainly 1.2.4-2

What Selective Disclosure Means

The article constructs the Privacy Decision Flow — when to hide, when to attest, when to disclose — and defines selective transparency as the principle governing institutional information. This sidebar defines selective disclosure in plain terms, so the reader can carry the concept forward without needing to reconstruct it from the article's architectural vocabulary.

Selective disclosure is the practice of revealing only the information that a specific purpose requires — and nothing more. It is the operational expression of privacy by design's foundational commitment: that privacy is the default, and every departure from default must be justified, bounded, and enforced.

The concept has three structural elements.

The Three Elements

Selectivity. Not all information is treated the same way. The person chooses — or the system is designed so that — only the relevant piece of information reaches the recipient. A person proving their age does not reveal their birth date, address, and license number. A person proving employment does not reveal their salary, title, or performance reviews. The selection is governed by the purpose. What the purpose does not require, the recipient does not receive.

Purpose-binding. The information disclosed for one purpose cannot be repurposed. If a person discloses their address for a shipping transaction, the address cannot be used for marketing, sold to a data broker, or combined with other datasets for profiling. The binding is structural — enforced by the system's architecture, not by a policy that the recipient may or may not follow. When the purpose is fulfilled, the data's authorized use expires.

Verifiability without exposure. The recipient needs to trust that the disclosed information is accurate. But verification does not require access to the underlying data. A third-party attestation can confirm that the person meets the criterion. A zero-knowledge proof can demonstrate that the statement is true. A cryptographic commitment can be revealed when the conditions are met. In each case, the recipient gets confidence in the claim without access to the person behind it.

What Selective Disclosure Is Not

It is not full transparency with redactions. Redaction starts from total disclosure and removes pieces. Selective disclosure starts from total opacity and adds only what is justified. The difference is architectural: redaction assumes access and removes; selective disclosure assumes protection and grants. The default matters because it determines what happens when the system fails — a redaction system that fails exposes everything; a selective disclosure system that fails exposes nothing.

It is not secrecy. Selective disclosure is designed for contexts where information must flow — transactions, verifications, institutional processes. It does not refuse to participate. It participates on terms that protect the person while serving the purpose. Secrecy withdraws from the system. Selective disclosure operates within it — but with structural boundaries that the system must respect.

It is not a privacy policy. A privacy policy is a document. Selective disclosure is an architecture. The distinction tracks the one established by encoded objective law (1.2.2): declaring a commitment is not the same as encoding it. A privacy policy that promises selective disclosure but is implemented on a system that collects everything and restricts access by policy has not achieved selective disclosure. The architecture must enforce what the policy declares.

Why the Term Matters

privacy by design uses selective disclosure as the bridge between two commitments that can appear to be in tension: the person's right to opacity and the institution's need for verification. Selective disclosure resolves the tension structurally. The person does not need to choose between participating and being exposed. The institution does not need to choose between verifying and respecting privacy. The system is designed so that both commitments hold simultaneously — because the information flow is selective, purpose-bound, and verifiable without exposure.

This is why the Privacy Decision Flow asks "when to attest" before it asks "when to disclose." Attestation — proving a fact through a bounded channel that reveals nothing beyond the fact — is selective disclosure at its most rigorous. Full disclosure is the fallback when attestation is structurally insufficient. The preference order — hide, attest, disclose — reflects the innovation's commitment: privacy first, then the minimum departure required by the purpose.