Fable
Before the new water channel connected to households, the plumber first mapped where every drop of water would go
The city prepared to lay a metered water channel. It could adjust prices by water usage and also detect leaks. The plumber thought this was a good thing and wanted to lay it first before explaining to residents.
The privacy officer stopped him. The old canal only knew the total water volume; if the new canal measured down to each two-hour period, one could tell which household rose often at night, which ran a small workshop, whether an elderly person lived alone. Behind the convenience lay an extra map of life.
The pipe engineer said, "We just won't peek." The privacy officer made him write down: what water data is collected, why it is collected, whether it must be precise to every hour, who can see it, how long it is retained, whether outsourced canal repairers can touch it, and how residents can inspect, correct, and object.
They then listed the risks item by item. Over-collection would leave residents unable to refuse; price adjustments might be unfair to nighttime water users; ledger leaks would expose daily routines; erroneous inferences would make innocent people pay more. Each item needed a corresponding mitigation: collect less, shorten retention, tiered access, manual review, notification, and appeals.
After the evaluation was completed, the canal was not cancelled, but its design was changed. Ordinary billing kept only daily totals; leak alerts looked at fine-grained numbers only for short periods; canal repair workers could only see the faulty section, not browse the whole city's households; price changes required review. The pipe manager initially thought this looked like delay. The privacy officer took him to see an elderly person's household: if the water numbers were taken by outsiders, late-night water use habits might reveal illness, and lower daytime use might reveal that no one was home.
They revised the canal plan in three places: ordinary billing kept only daily totals, leak alerts looked at finer time intervals, and the outsourced canal repair crew could see only pipe segment numbers, not resident names. The canal was eventually laid, but only after mapping out the paths that could cause harm. Good engineering isn't just about whether water can flow—it's also about whose hands the water data will flow into.
This small incident made everyone stop and review. They did not rush to swap in a more impressive-sounding explanation, but instead wrote down clearly, one by one, the entry points that went wrong, the rules that were misunderstood, and the boundaries that needed to be preserved.
The engineer later understood that impact assessment is not an apology letter after completion, but putting people's rights, necessity, risks and remedies on the blueprint before construction begins. The more the canal observes life, the more it must first ask whether observation is worthwhile, whether it is restrained, and who is responsible when things go wrong.