Ethical data and community insight principles

Why this page exists

Community insight is one of the three outcomes we work towards. It is also the area with the most potential for harm if it is done carelessly. These principles govern any activity where we collect, hold or present information about what communities are experiencing, whether on paper, in a workshop or through software.

In short

Principles

• A clear reason to collect it. Every dataset has a written purpose, a partner who will act on it and a date by which we review whether it is still needed.
• Only what is needed. No names, addresses or exact locations unless the purpose cannot be met without them and a DPIA has been completed.
• Voluntary participation. People decide whether to contribute. No one loses access to a service for choosing not to.
• Honest limitations. Every figure carries its source, age, coverage, verification status and confidence. Community reports may be incomplete, delayed or unverified and are always presented that way.
• Findings returned to communities. People who contribute hear what was found and what changed. We publish “you said, we changed” records where partners agree.
• Personal data never sold. Not to advertisers, brokers, insurers or anyone else. This applies to derived and aggregated data that could be re-identified.

Provenance and presentation

• Official records, partner data, community reports and resource information are stored and labelled separately and never blended into a single score.
• Low-reporting areas are not presented as safer. We show coverage so that gaps are visible.
• We test for geographic and demographic bias before insight is shared and describe what we found.
• Human oversight is retained for any decision that materially affects safety or services.

Governance

Each community insight project has a written data governance note covering purpose, partner, lawful basis, minimisation, retention, access, moderation, escalation, bias testing, feedback to contributors and the review date. For anything touching children or location, a data protection impact assessment is completed first. A named lead is accountable; the partner’s data protection officer is involved from the start.

What we will not do

• Build profiles of individuals.
• Make automated decisions or predictive scores about individuals. Any automation or AI in a product is disclosed, reviewed by a person and covered in the DPIA.
• Infer characteristics about people from where they live.
• Publish anything that could identify a young person, a household or a small group.
• Present a prototype as if it held real community data. Prototypes use fictional data and are labelled.

Contact and review

Questions about this policy: hello@youngfuturesdigital.co.uk.

We keep this policy under regular review and update it whenever the law, guidance or our services change.