Recruiting, compensating, and protecting users

What

Privacy controls prevent the inappropriate disclosure of sensitive information.

As digital practitioners, we often work with many different categories of information in different contexts — and we have an obligation to steward information in a way that respects people's privacy.

Why

People will not honestly participate in design processes or use products and services they do not trust.

How to do it

1. Familiarize yourself with the Fair Information Practice Principles. This is a set of precepts at the heart of the Privacy Act of 1974.
2. Understand the privacy requirements for agency websites.
3. Consult your organization's Senior Agency Official for Privacy and general counsel. They will help you plan to safely use information that could potentially identify specific individuals.
4. Inform and collect the voluntary consent of anyone who participates in moderated design research. Ensure an easy-to-access privacy policy covers your unmoderated forms of research.
5. Pay special attention to all categories of information used throughout the design process. Note contexts in which it is not okay to share certain categories of information.

Understand the policy framework

The federal government's use of information about people is subject to a number of laws and policies, including: the Privacy Act of 1974, the Federal Information Security Management Act of 2002, and the eGovernment Act of 2002.

Conduct a Privacy Threshold Analysis in collaboration with your agency's privacy office whenever a design process calls for the creation of a new data store (for example, a database).

Ensure all collections of personally identifiable information (PII) are accompanied by a Privacy Act Notice. See, for example, GSA's Privacy Act Notice for Design Research.

Phase

Fundamentals

Time required

5 to 10 days to consult with privacy officials and lawyers