Who can see my data in My Vote Forward?

On the My Vote Forward demo, your account details and your saved priorities and opinions are private to you and to the limited administrative access needed to run the service; they are not shown to other visitors, not included in public statistics, and not sold. An opinion becomes visible to others only if you choose to publish that specific opinion, and a ballot choice can never be published through the system; the demo stores none. The educational website collects no political preferences at all. Protected data is still not anonymous data, and the framework says so.

The objection in its strongest form

The objection is that any system collecting political opinions builds a database that someone will eventually want. Governments may want to know who holds dissenting views. Campaigns want to target persuadable voters. Employers, insurers, and data brokers want profiles. Hackers want anything they can sell or leak. The operator itself may change hands. Promises about privacy last only as long as the organization keeping them, and political data, once leaked, cannot be made private again.

The strongest version adds that “aggregate only” is not a guarantee either. Published statistics can sometimes be combined to reconstruct information about individuals, especially in small groups. Account systems link opinions to identities by design, so the operator can always, in principle, connect a person to what they said. And people are poor at predicting how their data will be used years later. A framework that collects political views should, on this argument, collect as little as possible and assume that anything collected may one day be exposed.

Why the objection matters

The objection matters because My Vote Forward asks people to record priorities and opinions over time. That record is more revealing than a single answer, because it shows how a person’s views change. If it leaked or were misused, the harm would fall on the people who trusted the framework most. Privacy failures also damage participation generally: people who believe their views are being collected for other purposes will stop sharing them, or will share only what they think is safe.

Defined terms

• Personal data: information relating to an identified or identifiable person.
• Special category data: under EU law, types of personal data that receive extra protection, including data revealing political opinions.
• Aggregate: a combined result about a group, such as a ranking of priorities.
• Reconstruction attack: a method that uses published statistics to rebuild records about individuals.
• Differential privacy: a mathematical framework for measuring and limiting disclosure risk in published statistics. See privacy.
• Vote history: whether a person voted in an election, as distinct from how they voted.

Evidence

Political opinions are treated as sensitive in law. The EU General Data Protection Regulation, Article 9(1), lists “Processing of personal data revealing racial or ethnic origin, political opinions” among special categories whose processing is prohibited unless an exception in Article 9(2) applies.⁠¹ My Vote Forward does not claim GDPR compliance; the article is cited to show how seriously one major legal system treats political opinion data.

Political data has been misused at scale. In July 2019 the U.S. Federal Trade Commission alleged that Cambridge Analytica, its former chief executive, and an app developer used deceptive tactics to “harvest personal information from tens of millions of Facebook users” for voter profiling and targeted advertising.⁠² The two individuals agreed to orders requiring them to delete or destroy the personal information they collected; Cambridge Analytica had filed for bankruptcy and did not settle.⁠²

Published statistics can expose individuals. The U.S. Census Bureau reported that a simulated attack on its own 2010 Census publications “perfectly reconstruct[ed]” records for 97 million people and correctly inferred race and ethnicity for 3.4 million people the Bureau describes as vulnerable population uniques.⁠³ The Bureau adopted a disclosure avoidance system based on differential privacy for the 2020 Census, describing it as “a framework for measuring the precise disclosure risk associated with each release of confidential data”.⁠³ The same page now states that its information is no longer current, because the Bureau is evaluating alternatives to comply with a Department of Commerce order prohibiting noise infusion.⁠³ The method’s future use is therefore in flux, but the reconstruction finding stands as evidence that aggregates are not automatically safe.

What is public about voters already, United States. Voter registration lists are available to the public or to defined groups in many states, with access rules that vary by state.⁠⁴ According to the National Conference of State Legislatures, Colorado’s list includes “Full name, address, year of birth, political party, vote history,” and Ohio’s includes “Name, address, precinct number, voting history”.⁠⁴ Vote history records whether a person voted, not how. International standards take a stricter view in one respect: the Venice Commission’s code says “The list of persons actually voting should not be published,” because abstention may itself indicate a political choice.⁠⁵

How comparable systems have handled it

Comparable systems separate data by purpose. Official statistics treat individual data as “strictly confidential and used exclusively for statistical purposes”.⁠⁶ Elections keep ballot content secret while, in many U.S. states, making participation records available.⁠⁴ The Census Bureau’s shift to differential privacy, and its later reconsideration, shows that even well-resourced agencies are still working out how to publish useful statistics without exposing individuals.⁠³

Competing interpretations

One interpretation holds that strong access controls, encryption, and minimal collection make a political opinion database acceptable, as with any sensitive service such as banking or health care. On this view, the risks are manageable and the benefits of ongoing participation outweigh them.

A second interpretation holds that political opinion data is different in kind, because its misuse can affect democratic processes and personal safety, and because governments themselves may be the threat. On this view, the only safe design keeps opinions on the person’s own device or does not store them at all.

A third interpretation focuses on publication rather than storage: the greatest risk comes from what is released and how it can be combined. On this view, rigorous release review, minimum group sizes, and formal privacy methods matter more than storage design.

What the framework answers

My Vote Forward’s design rules, set out in the privacy, consent, and published releases chapters, are:

• Identity: visible to the person and to restricted operators for account support; never placed in share cards, URLs, or analytics.
• Priorities and opinions: private by default; a person can publish a chosen selection or a specific previewed opinion snapshot. Routine administrators cannot browse individual political responses (see governance).
• Published aggregates: only reviewed, scheduled releases. Before any real respondent release, a documented privacy design must set statistical methods and minimum group sizes.
• Ballots: no one may see a ballot linked to a person. The demo stores no ballot choices, and there is no share button, vote history, or person-to-ballot research product.
• No raw-data API: no live polling endpoint, no arbitrary demographic query service, no individual records.
• Not a data business: no data sale, no campaign targeting, and no political preferences sent to analytics, social, or AI services (see security).
• Protected is not anonymous: stored opinions in an authenticated account are protected account data, not anonymous data, because the operator of an authenticated database can in principle connect records to accounts.

Public community priorities on the demo are simulated, not built from real accounts. Any future research release would require separate, purpose-specific consent and a privacy review.

Where the objection still wins

The objection wins on several points. The operator can, in principle, connect stored opinions to accounts, and the framework does not claim otherwise. A breach, insider misuse, legal demand, or change of ownership could expose stored data, and no design rule eliminates those risks. The minimum group sizes and statistical methods for real releases have not been set. And anything a person publishes can be copied beyond recall.

Unresolved questions

• Should opinions be stored only on the person’s own device, at the cost of features like revision across devices?
• What minimum group size and statistical method should apply to the first real release?
• How should the framework respond to a lawful demand for individual data, and how would it tell the people affected?
• What happens to stored data if the operator closes or changes hands?

Related

• Privacy
• Consent
• Published releases
• Security
• Can someone be punished for an opinion?
• Hard questions