At the neighbourhood association, Leila signed up for an alert about grants for adapting homes. Months later, she booked a room for a teenagers’ chess club. Each form had a simple purpose: receive accessibility information, arrange a key, and prepare the space. When a new system joined both lists, a dashboard displayed a label beside her name: “household likely to need support; indirect contact with minors.” No one had written it. No conversation had explained her circumstances. Yet the label could determine which campaign she received, which call was prioritized, or which suspicion followed her record.
The problem with joining data is not only that more becomes known. It is that a third story appears, made from fragments that made sense separately. One list records an administrative task; another records participation. When they are connected, an organization can turn probabilities into a portrait and use it to guide offers, checks, services, or decisions. The step deserves attention because it is quiet: it does not happen in the visible moment of completing a form, but later, in a query, spreadsheet, or model that appears merely efficient.
A connection is also a decision#
We often talk about data as if it were an object that is stored or shared. But the relationships that are authorized between data also matter. An email address may be used to send a purchase receipt. That same address, used as a shared key, can join purchases, access times, customer-service queries, and survey responses. The connection is not a technical accident. Someone selects an identifier, decides that two tables correspond, and permits a result in one to interpret the other.
We often talk about data as if it were an object that is stored or shared. But the relationships that are authorized between data also matter.
It is worth naming that act because otherwise responsibility dissolves. The team that collected the first item can say it acted for a specific purpose. The team that collected the second can say the same. And the person who performs the join can present it as improved analysis rather than a new form of processing that changes what the information means. Yet, for the person being portrayed, the join is the relevant event: it creates an inference they may never have supplied, expected, or recognized when it appears.
Not every connection is unjustified. A hospital may need to connect an appointment to a test to avoid mistakes. A cooperative may join a payment and a request to confirm that a service has been activated. The question is not whether to ban every relationship, but whether to require an understandable reason, a proportion to the purpose, and a barrier against uses that drift away from it. The more sensitive the possible conclusion, the more explicit that justification should be.
Inspect the leap from data to consequence#
An organization can make the mistake of examining only the quality of its source lists. It checks that emails are spelled correctly, amounts balance, and consent was recorded. But the greatest unfairness may arrive later, when a join turns accurate data into a fragile conclusion. A person who repeatedly visits an aid calculator is not necessarily in crisis. Someone who buys children’s items is not necessarily a parent. Someone who uses an address in two forms is not necessarily the same person who made each decision.
Before using a combined portrait, it helps to ask four questions. What precise relationship is being assumed between the lists? What other plausible explanations exist? What consequence will the person receive if the inference is wrong? Can they see it and correct it without having to disclose more intimate information? These questions move attention from the volume of data to the human cost of a conclusion.
Consider an organization offering reduced transit fares. It connects addresses, payment incidents, and information requests to prioritize calls. The intention may be to help, but an address match may link a former tenant’s debts to someone who just moved in. If that combined profile leads to extra document requests or a delayed benefit, the harm is not resolved by saying every list was accurate. The bridge built between the lists needs review.
A join register, not a convenient black box#
Organizations often inventory fields and systems, yet few clearly describe which tables are routinely joined. A join register can be a practical tool. It does not have to contain incomprehensible technical secrets. It can state which datasets are connected, through which identifier, for which decision, how often, who may run the query, and how long the result is retained. It should also state whether the result creates a recommendation, exclusion, score, or human intervention.
Such a register forces distinctions that otherwise remain blurred. Joining a booking to a payment to resolve an error is not the same as combining workshop attendance, browsing history, and postcode to predict vulnerability. The first case has a direct, limited relationship. The second can produce a far-reaching social label. Writing both down makes it possible to debate whether the purpose justifies the connection instead of accepting that every technical capability deserves use.
The register also supports review before a portrait circulates. A legal, service, technical, and social-impact group can examine a high-risk join from different perspectives. The person building the query knows which fields are stable; the person handling complaints knows frequent errors; the person working with the community understands which labels can stigmatize. The decision improves when it is not left solely to the person who can write the query fastest.
Give the person a way in#
Saying that someone can “exercise their rights” is inadequate if they cannot discover which combined portrait operates about them. Leila does not need to see the entire database or other people’s information. She needs a useful explanation: which sources were related, what conclusion was reached, what it was used for, and what to do if it does not reflect her reality. A useful explanation is not limited to naming an algorithm; it offers a route to request review.
Correction must be prepared for inferences as well. It is relatively simple to correct a mistyped phone number. It is harder to challenge a category such as “probable financial need” or “risk contact.” The organization should let someone respond: “this association is not correct,” “these data belong to another person,” or “I do not want this join used for that purpose.” It must have a process to stop or limit the use while it is reviewed, especially where access to a service, price, selection, or surveillance is affected.
It matters not to shift the entire burden to the person who complains. Requiring someone to produce exhaustive proof to dismantle a conjecture created by the organization reverses responsibility. If the system cannot explain its link or assess reasonable alternatives, it may not be fit to use it for a decision. Dignity is not only keeping information secret; it is not forcing someone to live under a story they cannot contest.
Test the portrait with confusion cases#
Before deploying a join, a team can do a simple exercise: invent cases in which the apparent relationship is false. Two people share an address; one account is used for a relative; an email is recycled; names match; a purchase was a gift; a query was made for somebody else. These cases are not oddities that spoil a perfect system. They are normal parts of social life, and they show why an identifier is not always the same as an identity.
Then look at the decision, not just the model. Would the person receive an irrelevant offer, an intrusive call, a delay, or a denial? Can an employee acknowledge uncertainty, or does the dashboard present the label as truth? Is there a way to undo the effect? The test helps choose concrete measures: remove a join, reduce fields, require human confirmation, put an expiry on the profile, or prohibit its use in decisions with serious consequences.
Prudence does not mean paralysis. Sometimes a data connection reveals that several people are requesting the same support and prevents them from repeating paperwork. The difference lies in designing it to serve the person rather than classify them without an exit. A responsible connection minimizes what it carries forward, explains the benefit it offers, and does not turn a coincidence into a fixed identity.
Assign responsibility before a complaint arrives#
When a combined portrait causes a problem, it is common for no one to feel responsible. The data team says it only provided a list; the product team says it only used a recommendation; the service team says it only followed a screen. A responsibility map prevents that diffusion. It should state who proposes the join, who approves its purpose, who verifies identifier quality, who receives challenges, and who can stop it.
It also needs dates. Joins created for a one-off campaign should not become permanent infrastructure by inertia. An expiry review asks whether the purpose remains current, whether the benefit has been shown, and whether unforeseen harms appeared. Deleting results that are no longer necessary matters as much as limiting initial access. The most accurate portrait can become prejudice if it continues to follow a person after their context has changed.
Leila’s association could start modestly: publish its main data connections, prohibit sensitive labels without human review, and offer an accessible review email or phone number. It could also inspect quarterly examples of combined profiles that ended in a decision. That would not solve every problem in the data economy, but it would change a crucial question: from “can we join these lists?” to “what right, benefit, and risk arise for a person when we join them?”
That change is practical. The next time a team proposes a more complete dashboard, it can trace the line from every list to every consequence. If it cannot explain that line to the affected person, it should stop. The portrait that emerges when two lists meet is never just an analytical convenience. It is an intervention in someone’s life, and it deserves the limits, testing, and opportunity to reply that we would demand of any other decision.
