How the Operational Transparency Stack works

Digital Public Transparency: From Principle to Practice. Part 2 of 3.

In this series:

1. Digital Public Transparency Opens New Possibilities
2. How the Operational Transparency Stack works
3. TCIEG’s Two Pillars: Standards and Common Public Practice

Transparency becomes useful when its meaning survives the move between people, organisations, and systems. A notice should not say one thing to an individual while a technical system applies something different.

The proposed approach connects four components: the Internet Transparency Code of Practice, Co-Regulated Digital Identification, semantic notice standards, and a Digital Privacy Control Vocabulary.

Each answers a different question.

1. Common practice: what should happen?

The Internet Transparency Code of Practice (ITCoP) sets out proposed expectations for transparency at the point of interaction.

The principle is straightforward: disclose who is accountable, the intended purpose, the applicable authority, and an accessible privacy contact or rights access point before personal identification is demanded or personal data processing begins.

A code of practice describes the conduct expected. The Operational Transparency Stack provides the technical means to express, exchange, and check relevant evidence.

2. Co-Regulated Digital Identification: who is accountable?

Co-Regulated Digital Identification places controller accountability before demands for personal identification.

The proposed model connects public accountability records with defined oversight, responsibilities, and evidence. The individual should not have to rely only on a service's unsupported assertion that it is trustworthy.

This does not mean publishing personal identifiers. The objective is to make the accountable organisation inspectable while avoiding unnecessary exposure of the individual.

3. Semantic notice standards: what does the disclosure mean?

Matching file formats is not enough. Systems also need consistent meaning.

Semantic notice standards provide a shared way to express concepts such as purpose, authority, recipients, retention, and rights. They help distinguish a disclosure from an authorisation, and human consent from a technical permission.

The aim is not to replace readable explanations with technical terms. It is to make the explanation and its digital representation correspond, so different systems can interpret the same notice consistently.

4. Digital Privacy Control Vocabulary: how can systems use that meaning?

A proposed Digital Privacy Control Vocabulary would supply shared terms for expressing the choices, constraints, and states relevant to digital privacy control.

For example, it could distinguish a stated purpose, the authority relied upon, a human decision where consent applies, a system permission, and a later change or withdrawal.

A vocabulary does not itself enforce a rule. Implementation requires mappings to notice records, decision logic, and evidence, with tests showing that systems interpret the terms correctly.

A practical example: an AI service

Consider an AI service proposing to use personal information for a particular task.

1. The service makes the accountable organisation and intended use inspectable.
2. The individual receives understandable notice, with corresponding structured information.
3. Where consent is the legal basis, the individual decides whether to authorise that purpose. Other legal bases must be stated and assessed on their own terms.
4. The system checks the proposed operation against the applicable purpose, authority, and constraints. Technical permission is not treated as a substitute for consent.
5. Records preserve evidence of the notice and relevant decisions. Material changes can be detected and addressed.

A Notice Receipt evidences what notice was provided. It does not, by itself, establish valid consent or lawful processing.

Connecting disclosure to operation

The relationship is simple: common practice sets expectations; accountable identification makes responsibility visible; semantic standards preserve meaning; a control vocabulary helps systems interpret relevant conditions.

Together, implemented and tested, these can support Operational Transparency. They do not automatically prove legal compliance or guarantee correct AI behaviour.

Learn more

Next: TCIEG’s Two Pillars: Standards and Common Public Practice. See how technical development and the Code of Practice can advance together.