Levels of disclosure

[duncandewhurst]

I'm creating this discussion to log a couple of ideas shared by participants in the recent technical working group meeting.

One suggestion was to provide for different levels of disclosure, i.e. private, shared, public, for different fields. Which fields are private, shared or public would vary by publisher. We can use this thread to discuss how best to address this need, for example:

• one option could be to provide non-normative guidance on how to manage different disclosure levels as part of a data pipeline, for example by maintaining a list of disclosure levels for each field in whatever tool is used to store data and producing separate private, shared and public files.
• another option could be to somehow encode the disclosure level of each field in the JSON data itself

A related suggestion was to collectively determine a minimum set of fields to include in an open dataset. Only the fields that are technically mandatory for the integrity of the data are required in the schema so any such list would need to exist as separate non-normative guidance, ideally in a machine-readable format so that additional checks could be performed against it in validation tooling.

[duncandewhurst]

@lgs85 please share any thoughts you have, based on experience from the Beneficial Ownership Data Standard.

[lgs85]

This is an issue that comes up regularly in beneficial ownership transparency. We don't embed guidance around levels of disclosure directly in the standard, but Open Ownership have produced a number of technical/policy reports on the issue, with the most relevant ones being here, here and here. Briefly, the guidance boils down to:

1. Understanding the benefits and harms of publication
2. Adhering to the principle of data minimisation, with data collection clearly aligned to policy aims
3. Implementing a system of layered access, with some data only available to authorities
4. Implementing a system of exemptions under certain circumstances

Here, we're talking about layered access, but I think the broader context is useful. My initial reaction is that we would want to keep guidance about layered access general rather than specific, but we can definitely think this through some more.