Managing Individual Objections to the Collection or Use of PI

West Virginia Executive Branch
Privacy Policy: Consent

QUESTION:

What if I have a concern about the use of my PII?

ANSWER:

The Consent Policy expresses our commitment to addressing any specific individual concerns that individuals have about the collection and use of their private information (PI). Rather than trying to develop one set of rules to cover every possible objection, each Department should take reasonable steps to respond to concerns as they are raised.

You can always refer privacy concerns to the Department Privacy Officer. You and your manager can also respond to objections in ways that make sense, given the situation. Some possible ways to address concerns include:

• Collecting less PI than was originally requested (e.g., allowing the individual the option of leaving certain data collection fields blank),
• Truncating or masking certain data elements (e.g., allowing the individual to provide the last 4 digits of his or her Social Security number, rather than the whole number),
• Collecting or using a different, less sensitive data element (e.g., if the individual objects to the inclusion of a home address in an employee directory, allow the individual to use a mailbox address instead),
• Replacing Social Security numbers or other government-issued identifiers with a random number,
• Limiting disclosure of the PI (e.g., storing the person’s PI in a separate secure location),
• Offering the individual a different option (e.g., if an individual does not wish to participate in a program that requires certain PI, enabling the individual to participate in a different program, if it exists), or
• Not collecting the PI, with the understanding that the individual may not be eligible for the program or benefit for which the PI was needed.

When dealing with a person who is objecting, keep in mind that the individual may have a very serious reason for the concern. For example, a person who has had an abusive spouse may not want to provide a physical address for fear of being located. A person who has been the victim of identity theft may have valid reasons for wanting to limit access to that data element. If you try to understand the root cause for the objection, it may help you and your manager to find a reasonable path to accommodate the concern.

Note: Your agency/bureau/department/division may have specific requirements – always check your policies and procedures. If you have questions, contact your Privacy Officer.