Policies guide action
Devise policies to guide balanced decisions about why, how, when and who uses information

Introduction
Information policies have been vital components of government for decades. Some policies are codified in law or regulations; others are official statements, executive orders, or agency directives. No matter their form, information policies guide action by specifying what and how information is used.

Today, rapid technological advancements challenge traditional policies and generate new questions. The Internet in particular has fueled policy debates that were unimagined a decade ago. While the World Wide Web contributes mightily to the free flow of information, it presents new dilemmas for protecting children and consumers, and for the competitive position of traditional businesses. These questions of appropriateness, privacy, ethics, and economic fairness all stem from this new information technology and the way we use it. More than ever, policies are needed to guide decisions about how, why, when, and who uses information in public organizations.

Policy principles
Information policy principles rest on fundamental democratic principles including:

• freedom of expression
• free flow of information in society
• right to privacy in your personal affairs
• right of public access to government records
• right to profit from your own inventions or ideas

These broad rights are not always complementary. One person’s right to privacy may conflict with someone else’s right of access. There is no single best way to balance these rights, so policies help guide public managers in handling specific situations.

Information policies address many different subjects, but they all fall into two main categories:

• policies that promote information stewardship
• polices that promote information use

Stewardship
Stewardship is a conservative principle that recognizes that government information is a public "good" like clean air and safe streets. It is concerned with accuracy, integrity, preservation, and protection of information.

The stewardship principle does not imply "ownership," but rather a trusted relationship in which information is handled with care regardless of its original source or collector. Policies that promote stewardship address:

• personal privacy
• confidential treatment of sensitive information
• records management and disposition
• information and system security
• data definition, quality, and integrity
• long term preservation of information with enduring social, legal, or historical value.

Some examples of stewardship policies:

• The US Privacy Act rests on principles of fair information use, including the right to know about and correct personal information in government records. Many states, like New York, have similar privacy laws.
• There are many specific confidentiality provisions in laws that authorize government programs, especially ones pertaining to health, human services, and education. One law that is the topic of much current attention is the Health Insurance Portability and Accountability Act, (HIPAA) which specifies stringent requirements that health care providers, insurers, and government agencies must follow in order to assure patient confidentiality and federal funding.
• The privacy notices included on government forms and Web sites attempt to put privacy policies into plain language for citizens. The CTG privacy notice is a simple example because we make very little use of personal information. The popular financial aid application at the US Department of Education Web site presents a much more detailed notice due to the nature of the program and the need for personal information to provide benefits.
• Data and meta data standards govern how data elements are described, defined, and represented in systems. These standards contribute to data quality and to the ability to use data for more than one purpose. They exist at government-wide, agency, and program levels. HIPAA also mandates stringent data standards for information exchange in the health care sector.
• Records management, retention, and disposition rules specify the reasons and manner in which public records are to be created, maintained for active use, and preserved for future generations. Both the National Archives and Records Administration and state and local governments have these policies.
• Security policies which help assure that both information and systems are protected from unauthorized use. They are becoming increasingly important as networks of all kinds are being put to use in government settings.

Usefulness
The usefulness principle recognizes that government information is a valuable government-wide asset that can generate real benefits through active use and innovation. These policies promote the use of information to improve the quality or lower the cost of services. They encourage agencies to use information to create new services or to devise better ways of doing traditional business.

Policies that promote usefulness often address:

• interagency and intergovernmental information sharing
• public access
• public-private information partnerships
• reuse of information for new purposes

Examples of these kinds of policies:

• There are government-wide policy foundations for information use and innovation. The United States, Canada, and a number of other countries have adopted such policies. New York and other states have done the same, especially with respect to e-government services.
• The US Freedom of Information Act and Electronic Freedom of Information Act and similar state laws guarantee citizens a right of access to government records. Several government and nonprofit organizations have a mission to promote the use of government information.
• Policies promote and guide interagency information sharing. New York State’s policy encourages sharing to support operations, better serve customers, avoid duplication, and improve accuracy. The Government Information Sharing Project at Oregon State University helps users find government information.
• US Digital Signature Legislation gives digital signatures the same legal basis as handwritten signatures. Similar state laws, such as New York’s Electronic Signature and Records Act, provide authority to use this new form of identity to conduct government business within New York State.

These two kinds of policies are complementary. Policies of stewardship help produce better, more reliable, more useable information and tested rules for using it in different situations. This leads to more use and more reliance on policies that promote use. These experiences then increase the demand for stewardship in the form of better information and clear, consistent rules.

The Center for Technology in Government (CTG) has studied the effect of information policies as part of our Using Information in Government (UIG) Program. The issues of stewardship and usefulness have played out in different ways in the seven projects that participated in the program, and in many other projects at CTG and elsewhere. We summarized information policy lessons in a seminar called "Rules for Using Information."

Practical Examples

Handling confidential information
Confidentiality of personal information was a major policy consideration in the effort to prototype an information system to help manage and evaluate services to homeless people. The concerns of direct service workers for the privacy of their client relationships had to be balanced against the State’s need for client information to understand the outcomes of program expenditures. The Bureau of Shelter Services handled this policy issue, and several others, in the Homeless Information Management System project.

Policy-driven information to support decisions
Investment decisions always require information. The kind of information you use, and the kinds of people who use it, make a big difference in the final choices. The NYS Department of Transportation made an important policy shift in both areas when looking at its IT investment process. The information used in its IT procurement process was once considered in isolation from overall agency strategies. Today DOT links this information process to key business goals of the agency, and the participants include program managers who work together with IT experts to make recommendations to a leadership council.

Laying the information groundwork for fast action
The more you rely on information for quick action, the more you need policies that ensure good quality and ready availability. That could not have been clearer during a severe ice storm when Geographic Information System (GIS) information from many organizations was used to re-establish communications, repair power grids, supply food and water, establish shelters, and direct National Guard troops to emergency areas. When there was an immediate need for the information, it was there and ready for use, thanks to New York State’s GIS Cooperative Program’s policies.

The GIS Cooperative illustrates well how stewardship and usefulness work together—it operates under policies of broad information sharing and reuse, supported by data sharing agreements and a readily accessible inventory of GIS data and meta data. This policy-driven resource allowed dozens of organizations to respond to the ice storm emergency in an informed and coordinated way.

Clear policies and strong governance for a shared information resource
In developing the Kids Well-being Indicators Clearinghouse (KWIC), the 13 member agencies of the NYS Council on Children and Families supplied child health and well-being data to a Web-based repository of information. Each agency has its own mission, goals, and operating structure. While the technical work is a big part of the job, the agencies know they must also come together and develop shared policies in order for the KWIC site to work.

Policies for management, operation, maintenance, and oversight will be essential to KWIC’s ability to provide timely information to program planners and decision makers in state and local agencies.

Security policy shapes technology choices
The New York City Department of Information Technology and Telecommunications stringent Internet security policy had a strong effect on its efforts to create a shared information resource for IT professionals. Since few workers are allowed direct access to the Internet, the project team made maximum use of the city’s secure intranet to bring useful information to the agencies.