As we approach the computer age in this brief survey of record keeping, we need to define the three main types of records that have been distinguished historically4.
Administrative Records. The administrative record is often generated in the process of a transaction-marriage, graduation, obtaining a license or permit, buying on credit, or investing money. Usually a record that refers to an individual includes an address or other data sufficient for identification. Personal data- in an administrative record tends to be self-reported of gathered through open inspection of the subject's ,affairs. Private firms usually treat administrative records pertaining to individuals as proprietary information, while administrative records held by the government are normally accessible to the public and may be shared for administrative purposes among various agencies. Administrative records sometimes serve as credentials for an individual; birth certificates, naturalization papers, bank records, and diplomas all serve to define a person's status.
Intelligence Records. The intelligence record may take a variety of forms. Familiar examples are the security clearance file, the police investigative file, and the consumer credit report. Some of the information in an intelligence record may be drawn from administrative records, but :much of it is the testimony of informants and the observations of investigators. Intelligence records tend to circulate among intelligence-gathering organizations and to be shared selectively with organizations that make administrative determinations about individuals. Intelligence records are seldom deliberately made public, except as evidence in legal proceedings.
Statistical Records. A statistical record is typically created in a population census or sample survey. The data in it are usually gathered through a questionnaire, or by some other method designed to assure the comparability of individual responses. In nearly all cases, the identity of the record subject is eventually separated from the data in the record. If a survey must follow a given individual for a long time, his identity is often encoded, with the key to the code entrusted to a separate record to guard anonymity. Data from administrative records are sometimes used for statistical purposes, but statistical records about identifiable individuals are generally not used for administrative or intelligence purposes.
Not every record falls clearly into one of these three categories. The contemporary personnel record combines features of bath administrative and intelligence records, and the records in the modern "management information system" have both administrative and statistical uses. Many records share characteristics of all three types to some degree. Yet whether one looks at the relationships among records of different types historically, from the perspective of present-day public policy, or from the point of view of the individuals who are the subjects of records, it is apparent that, by and large, administrative records are considered public; intelligence records, secret; and statistical records, anonymous. Moreover, democratic traditions with respect to the maintenance of government records about people have deep historical roots in a number of countries,5 and appear to be dominated by three major principles.
- An organization should record only information that has a clear-cut relevance to its concerns. Religious data, for example, should not be recorded where there is no state supported church, and citizens should not be required to furnish extraneous data as the price of obtaining a benefit.
- As much as possible, information that has been collected should be held in public files so that public scrutiny can act as a check on the arbitrary exercise. of administrative authority. Closed files in government sould be the exception, and their content and use should be regulated by specific laws, both to limit their extent and to assure their confidentiality.6
- The three types of records described above should be held separately, and each should be used only for its nominal purpose. The transfer of data from one type of record to another should take place only under controlled conditions. Records that do not fall neatly into one category, and record systems whose structure or use blurs the boundaries between types of records, demand special safeguards to protect personal privacy.