NPP 12 Blog: Developing Data Privacy Principles
In the January 2026 meeting, members of the Community Data Justice Collaborative made further progress toward development of data privacy principles.
The January meeting built on the November meeting, where Chief Data Officer Chris Belasco and Noble Reach Fellow, Will Tang, provided an overview of how the City of Pittsburgh has approached privacy, and shared information about roles the CDJC can play in developing privacy principles that will translate into robust privacy practices and policies through the city’s data governance committee.
Members were interested in learning more about situations where the absence of privacy policies could cause harm, Mr. Tang created several real-world “ripped from the headlines” scenarios and discussion prompts that prompted a rich conversation among participants. The discussion was so rich that we only made it through the first two (of six) scenarios. The full set of scenarios is available in the meeting slides, and a summary of the discussion for each of the two scenarios appears below.
Scenario 1: Outside Agency Requests on Immigration Status
A federal agency submits a formal request to the City of Pittsburgh for access to certain data related to residency, service usage, or identity verification. The stated purpose of the request is to ensure program integrity and compliance with federal requirements.
While the City does not directly collect immigration status, some data fields – such as race, ethnicity, address history, language access requests, records of benefits or services, could potentially serve as indirect indicators of immigration status.
Community members have expressed concern that these data points might be used as proxies, creating risks for immigrant families and other vulnerable populations. This raises important questions about what commitments the City should make when responding to external data requests and how to balance legal obligations with community trust.
In the discussion around this scenario, CDJC members:
- We’re concerned that sharing personal information about immigration status or even collecting it in an identifiable way could cause considerable harm to many people in the city.
- Believed that it was important for people to provide informed consent if their data is to be shared, especially with anyone outside the city.
- Felt that reporting information in aggregate could be a way to make it so that data could allow people from less-visible communities to be seen in data systems. This would also allow others to identify inequities, such as unequal distribution of public benefits.
- Saw a tension between positive use of data vs. uses of data that could cause great harm.
- Encouraged the city to have robust legal and data protection practices in place to prevent sensitive information from being revealed.
The second scenario discussed related to 311 systems, which have widespread use in a large number of cities around the country. 311 systems enable people to request non-emergency services without having to know which department is responsible for providing the service.
Scenario 2: Photo Attachment in a 311 report
A resident submits a 311 request about illegal dumping and uploads a photo to show the problem. The image also captures a child’s face, a license plate, and a visible house number; the report includes the resident’s contact information so staff can follow up.
The case is routed across multiple departments because the issue touches sanitation, public works, and law enforcement. The resident later worries that the photo or address could spread beyond the original purpose. (Pittsburgh’s 311 Response Center processes 100,000+ service requests annually, so even rare mistakes can happen at scale).
CDJC members raised the following points in their discussion of this scenario.
- They’d be interested in who has access to this data, and what the chain of custody looks like.
- They would like to learn more about how this data could be accessed and used, and how long they would be kept, as defined through a records retention policy.
- They worry that people making a complaint about someone else could be identified through the image. This could have consequences, including causing people not to want to report issues through 311, or retaliation against people submitting a request.
- The issue of photos also led to questions about how security cameras are being used in the city. Participants were eager to learn more about how images and other surveillance based datasets were captured and used, especially for public safety applications.
- It was clear that there could be beneficial uses of this data, and felt that rules could prevent improper data use.
Participants liked using scenarios to spark conversations about data privacy. They saw opportunities to use scenarios to engage a broader audience in conversations about data privacy.
They are also interested in learning more about current data use, data privacy and data protection practices in place at the city, and they also wanted to learn more about existing laws and policies designed to protect information held by government agencies or encourage transparency. These are topics that we hope to cover in the February meeting.
