Privacy: five kinds of data, five sets of rules

In plain words

My Vote Forward talks about three things people do: set priorities, share opinions, and cast a vote. Each one creates a different kind of information, and each kind needs a different rule.

Your identity (who you are) is needed to run an account. Your priorities (what matters most to you) can be shared if you want. Your opinions (what you think of a specific proposal) can be shared too, but only the exact one you choose, and only after you see what will be shown. Group totals of priorities can be published after review. Your ballot is different from all of these. Nobody should be able to link it to you, and you cannot turn that protection off, even if you want to.

This page explains why those lines exist, what can go wrong at each one, and what the framework does not yet know how to solve. It does not promise that any system is perfectly private. It explains what privacy has to mean before anyone could responsibly claim it.

Defined terms

• Data class. A category of information that carries its own purpose, access rule, retention rule, and publication rule. This framework uses five: identity, priorities, opinions, published aggregates, and ballots. See the glossary.
• Identity data. Information that identifies a person or an account, such as an email address, a display name, or an authentication credential. Identity is not eligibility; see identity and registration.
• Priority data. A person's ranking or allocation across subjects. See priorities.
• Opinion data. A person's answer to a specific, worded question about a specific proposal. See opinions.
• Aggregate. A statistic computed across many people, such as a ranked list of collective priorities. Aggregates can still reveal individuals; see Evidence below.
• Ballot secrecy. The property that no one can associate a voter's identity with that voter's choices. The U.S. federal voting system guidelines state it as a requirement that a system "does not contain nor produce records, notifications, information about the voter or other election artifacts that can be used to associate the voter's identity with the voter's intent, choices, or selections" ⁴.
• Protected account data. Data that access controls and encryption keep from the public and from most operators. Protected is not the same as anonymous: the operator of an authenticated service can, in principle, connect stored records to accounts unless a separately reviewed design prevents it.

Evidence

International standard: secrecy is not the voter's to waive

Article 25 of the International Covenant on Civil and Political Rights, adopted in 1966 and in force since 1976, provides that elections "shall be held by secret ballot, guaranteeing the free expression of the will of the electors" ¹. The UN Human Rights Committee's General Comment 25 (1996) explains what that requires. States "should take measures to guarantee the requirement of the secrecy of the vote during elections including absentee voting, where such a system exists." This "implies that voters should be protected from any form of coercion or compulsion to disclose how they intend to vote or how they voted." The Committee then adds: "Waiver of these rights is incompatible with article 25 of the Covenant" ².

The Council of Europe's Venice Commission reaches the same point from a different direction. Its Code of Good Practice in Electoral Matters (2002) says that "for the voter, secrecy of voting is not only a right but also a duty," and that "the list of persons actually voting should not be published" ³. Its explanatory report gives the reason: secrecy exists "to shield voters from pressures they might face if others learned how they had voted" ³.

This is the legal and historical basis for the framework's rule that a vote's privacy cannot be switched off. A voluntary disclosure feature would recreate the proof that a buyer or a coercer needs. The history behind that reasoning is in the secret ballot.

Voting system standards treat secrecy and privacy as separate requirements

The U.S. Election Assistance Commission's Voluntary Voting System Guidelines 2.0 (VVSG 2.0), adopted February 10, 2021, list voter privacy and ballot secrecy as two distinct principles ⁴. Principle 6, voter privacy, says voters "can mark, verify, and cast their ballot privately and independently." Principle 10, ballot secrecy, says the system "protects the secrecy of voters' ballot selections" and that "ballot secrecy is maintained throughout the voting process" ⁴. The distinction matters: privacy concerns the act of voting (no one watches), while secrecy concerns the record (nothing links the vote back). A system can fail one while passing the other.

Linking identity and ballot is the central remote risk

A 2020 joint risk assessment by CISA, the EAC, the FBI, and NIST, re-released publicly for the 2024 election cycle, explains why remote electronic voting strains this boundary. "Unlike traditional vote by mail where there is separation between the voter's information and their ballot, many remote voting systems link the two processes together digitally. This makes it difficult to implement strong controls that preserve the privacy of the voter while keeping the system accessible" ⁵. Paper mail voting separates the envelope from the ballot physically. A digital system has to achieve the same separation by design, and the assessment judged that hard.

Aggregates can reveal individuals

Publishing only totals does not automatically protect people. The U.S. Census Bureau, describing its move to a newer disclosure protection framework for 2020 Census data, cites its own research on a simulated attack: "We perfectly reconstruct 2010 Census records for 97 million people" ⁶. The same page now notes that its information "is no longer current" and that the Bureau "is evaluating alternative approaches to comply with the U.S. Department of Commerce's administrative order prohibiting the use of noise infusion" ⁶. Two lessons follow. First, many small tables can be combined to rebuild individual records. Second, the methods used to prevent that are themselves contested policy choices, not settled technical facts. This is why published releases require a documented privacy design before any real respondent data is released.

Political opinions are a sensitive category in some jurisdictions

In the European Union, the General Data Protection Regulation lists "personal data revealing ... political opinions" among the special categories whose processing "shall be prohibited" unless a listed exception applies, such as explicit consent ⁷. That is EU law, and its application to any particular operator depends on facts this page does not decide. It shows that treating opinion data as sensitive is not an idiosyncratic choice. Other jurisdictions treat the question differently; see jurisdictions.

Health privacy law is not election privacy

The HIPAA Security Rule applies to "a covered entity or business associate" and governs "electronic protected health information" ⁸. Covered entities are health plans, health care clearinghouses, and certain health care providers ⁹. A voting or civic participation system is none of these, so HIPAA is not a standard for it, and describing a civic system as "HIPAA-grade" says nothing verifiable about ballot secrecy.

Competing interpretations

Secrecy as an absolute versus secrecy as a default. General Comment 25 and the Venice Commission treat ballot secrecy as non-waivable ^{2 3}. A competing view, with roots in John Stuart Mill's argument that the vote is a public trust (discussed in the secret ballot), holds that some voters should be free to publish their vote as political speech. The framework sides with the non-waivable reading for the ballot itself, and moves voluntary expression to a separate place: the opinion, which is not a ballot.

Anonymity versus accountability for opinions. One view holds that opinions shared under a real name are more credible and less prone to manipulation. Another holds that named opinions invite retaliation and social desirability bias. The framework does not settle this. It makes naming a separate, optional choice for each shared opinion; see consent.

Can aggregates ever be safe? Some argue that any published statistic leaks something, so publication should be minimal. Others argue that useful public statistics justify a calibrated, documented risk. The Census Bureau's own shift in methods shows that informed institutions disagree ⁶.

Interpretation, this site's reading. Privacy failures usually happen at the seams: where an account record meets an opinion, where an opinion meets a published table, where a remote device meets a ballot. Naming the classes separately is a way to find the seams.

Application to this framework

The table below states the design rule for each class. These are framework requirements, not claims that any system already meets them.

Three further rules follow from the evidence above.

1. Protected is not anonymous. Stored opinions in an authenticated account are protected account data. The framework will not call them anonymous, because the operator of an authenticated database can in principle connect records to accounts unless an independently reviewed design prevents it.
2. No opinion to ballot inference. The framework never uses opinions to predict or prefill ballot choices, and never treats a difference between someone's opinion and their vote as evidence of anything. See opinion and choice.
3. Three layers, three privacy claims. The educational website collects no political preferences. The demo stores account preferences with access controls and uses simulated election state; it stores no ballot choices. A future official system would need jurisdiction-specific, independently evaluated secrecy, and nothing on this site claims that exists. See security.

Unresolved questions

• Can an authenticated system that stores opinions be designed so that operators cannot read them, and what would independent evidence of that look like? This is a research question, not a feature.
• What minimum group size or disclosure method is appropriate for publishing collective priorities when participants are few, as in a small district?
• How should a future remote voting design separate identity from ballot as well as paper envelopes do, given the 2020 federal assessment that digital systems tend to link them ⁵?
• How should privacy rules adapt across jurisdictions where political opinion data has different legal status ⁷?