Institutions increasingly speak as if the person were waiting to be assembled from records. A school has attendance, assessments, and disciplinary notes. A hospital has diagnoses, medications, and measurements. A bank has transactions, addresses, and risk signals. A platform has messages, clicks, contacts, and inferred interests. Joined together, these records can produce an astonishingly detailed profile. The profile can predict something useful. It can also create the illusion that the institution now possesses the person.
It does not. No database contains the whole person, because a record is always a selection made for a purpose, from a perspective, under conditions that can change. Even a true entry is not the whole meaning of the event it describes. An address is not a home; a diagnosis is not a life; a purchase is not a desire; a disciplinary incident is not a character. Data can be accurate and still be radically incomplete.
Every Record Is a Window
A database does not begin with reality in its fullness. It begins with a question. A hospital asks which medication was prescribed and when. A tax office asks which income was declared. A university asks whether a requirement was completed. The resulting fields are useful because they leave much else outside the system. The same selectivity that makes a database manageable also makes it incapable of being a complete account.
Data becomes even narrower as it moves through institutions. A receptionist records a statement in a form. A clerk chooses a category. A software system converts a narrative into a code. A reporting pipeline removes context so that records can be compared. A model then turns selected fields into a probability. Each step may be reasonable for its local task. The final score can nevertheless conceal the judgments and omissions that produced it.
Missingness is not neutral. People with unstable housing may lack consistent addresses. Migrants may have records divided across jurisdictions. Informal caregivers may perform substantial work that employment databases do not see. A person who avoids a service because of fear will look different from a person who does not need it. Digital traces often measure access to institutions as much as they measure the underlying activity. An empty field may mean absence, exclusion, privacy, error, or simply that no one asked.
High Resolution Is Not Completeness
A model may predict that someone will miss an appointment, repay a loan, or respond to a treatment. Prediction can be valuable when its uncertainty and limits are understood. But prediction is not explanation, and explanation is not justification. A correlation between two records does not establish why the person acted or what a fair response would be. The profile can help a professional ask a better question. It should not end the questioning.
The Person Exceeds the Administrative View
Catholic anthropology makes this limit more than a warning about model calibration. The human person possesses a dignity that is not conferred by recognition from an institution. Gaudium et Spes14 speaks of the human person as a unity of body and soul, and Gaudium et Spes 16 treats conscience as the intimate place where a person encounters a moral obligation. These passages are not technical claims about data storage. They remind us that the deepest dimensions of human life are not administrative objects waiting for better measurement.
The claim should be qualified. “Mystery” does not mean that an institution may ignore evidence, that every self-description is decisive, or that public responsibilities disappear behind privacy. A hospital must act on incomplete information. A court must weigh evidence. A benefits office must apply a lawful rule. Epistemic humility is not refusal to know; it is accurate knowledge of the conditions under which one knows. It keeps a provisional record from becoming an idol.
The Catechism describes the dignity of conscience and moral responsibility in CCC 1776–1782, while CCC 1700 grounds human dignity in the image of God and the vocation to beatitude. These teachings do not imply that every inner reason should be disclosed to an administrator. They support the opposite discipline: a public authority should request evidence related to a legitimate task, not presume that accumulating more facts will entitle it to the interior person.
Objection: Institutions Need a Complete View
The strongest objection is operational. Fragmented records can harm people. A clinician who cannot see an allergy may prescribe dangerously. A lender that cannot verify income may be exposed to fraud. A child-protection agency that fails to connect warnings may miss abuse. A government that cannot coordinate disaster relief may leave people without help. If incompleteness is emphasized too much, the result may be careless administration disguised as humility.
The objection is correct that relevant information sometimes must be connected. But a complete view for one defined decision is not the same as a complete view of the person. A clinician may need the medication and allergy history relevant to immediate treatment, not every purchase or association. A benefits office may need verified household income under a stated rule, not a permanent behavioral dossier. A safeguarding team may need to share a specific risk through authorized channels, while still limiting unrelated information.
The responsible response to dangerous fragmentation is governed interoperability: clear schemas, provenance, access controls, emergency rules, and the ability to see when a record is missing or stale. It is not the creation of an unrestricted universal profile. Institutions should identify the information needed for a decision, connect that information for that purpose, and preserve the ability to say what remains unknown. Coordination and humility are not opposites.
Architecture That Remembers Its Limits
Record provenance and uncertainty
Every consequential field should carry more than a value. The system should preserve where the information came from, when it was collected, who entered or transformed it, what definition was used, and whether it was directly observed, reported, inferred, or predicted. A date without provenance can look more authoritative than it deserves. A risk score without a model version and confidence interval hides the conditions under which it was produced.
Uncertainty should be represented as part of the record rather than left to the imagination of the next user. “Unknown,” “not asked,” “self-reported,” “conflicting,” and “not applicable” should not be collapsed into one empty value. A system should be able to tell an operator that two sources disagree or that a conclusion depends on an assumption. This may make a dashboard less tidy. It makes institutional judgment more honest.
Purpose and access boundaries
Data minimization is not an aesthetic preference. The OECD Privacy Guidelines and the GDPR both articulate, in different legal settings, principles such as purpose specification, collection or data minimization, use limitation, data quality, security, and accountability. Their exact obligations depend on jurisdiction, controller, legal basis, and exceptions. The general architectural lesson is sound: an institution should be able to explain why a field exists, who may use it, and when it should be deleted or reviewed.
Time, correction, and context
Records need temporal discipline. A past address, diagnosis, debt, or disciplinary finding may be relevant to one question and misleading for another. Systems should record effective dates, expiration, supersession, and the difference between an allegation and a finding. Retention should follow the legitimate purpose and applicable law, not the vague possibility that information may someday be useful.
People need meaningful ways to see and contest consequential records. Correction is not the same as allowing someone to rewrite history: institutions can preserve an audit trail while marking an entry as disputed, amended, or contextualized. A person should be able to provide relevant circumstances that a structured field omitted. The process must reach a responsible human decision-maker when an error can affect housing, health, education, livelihood, liberty, or access to an essential service.
Governance for Epistemic Humility
A humble institution writes limits into its policy. Before collecting a new category, it identifies the decision it will support and the evidence that would count against using it. Before linking databases, it asks whether the joint view creates a new inference or risk that neither source could create alone. Before deploying a score, it tests not only accuracy but error costs, disparate exclusion, missingness, feedback loops, and the ability of a person to recover from a wrong result.
Governance should assign an owner for each consequential use, publish retention and access rules, and require review when a purpose changes. Independent audits should examine whether actual staff behavior matches the documented purpose. Procurement contracts should prohibit vendors from quietly reusing institutional data to train unrelated products unless that use has a lawful and publicly accountable basis. A database should have a steward responsible not only for uptime but also for truthful representation of its limits.
Objection: More Data Improves Fairness
A second objection says that sparse records are unfair because they force officials to rely on stereotypes or arbitrary discretion. More variables can reveal relevant circumstances and reduce the influence of a single crude proxy. This is often true. Refusing useful information can also produce injustice, especially for people whose needs were previously invisible.
But fairness is not identical to predictive performance. A model can become better at forecasting an outcome while making the institution more intrusive, less contestable, or more confident in a bad target. Additional variables can encode poverty, disability, race, or neighborhood disadvantage and then treat the resulting pattern as neutral evidence. The question is not simply whether the new field improves a metric. It is whether the field is relevant, lawfully obtained, proportionate to the decision, explainable to the affected person, and open to correction.
Human judgment is not automatically fair, either. It can be prejudiced, inconsistent, or corrupt. The proper alternative to reductive data is disciplined judgment: clear criteria, reasons, supervision, evidence standards, review, and attention to context. An institution should use records to support responsible deliberation, not to avoid responsibility by saying that the score made the choice.
A Decision-Specific Data Envelope
The distinction between harmful aggregation and necessary interoperability should be operational. Before linking records, an institution should define a decision-specific data envelope: the fields required, the authorized roles, their provenance and freshness, the emergency conditions for broader access, and when the temporary view closes. A clinician may need an allergy alert immediately; a safeguarding team may need to transmit a defined warning; neither need an unrestricted cross-institution biography. Emergency access should be logged and reviewed rather than treated as a permanent exception.
More data can improve a decision, especially for people whose needs were previously invisible, but that benefit must be demonstrated rather than presumed. For each proposed field, institutions should test outcomes for underserved and sparsely documented groups, not only aggregate accuracy: missed care, wrongful denial, time to service, correction burden, and the consequences of stale or conflicting data. Frontline staff also need a usable way to see provenance and uncertainty; a theoretically careful record that overwhelms the person making a time-sensitive decision is not a safe design.
The OECD guidelines and GDPR provide qualified, jurisdiction-dependent principles for purpose limitation, data quality, minimization, and access. They do not prove that a particular data envelope improves outcomes, and this essay supplies no such comparative study. Their value here is disciplinary: retain the institutional audit trail needed to explain a decision, while deleting or separating irrelevant personal history after the defined need ends.
Objection: Privacy Protects the Powerful
Privacy can sound like a privilege when marginalized people already struggle to be seen. A person denied assistance may need an institution to record disability, abuse, discrimination, or unsafe conditions. Communities harmed by official neglect may reasonably demand documentation and transparency. If records disappear in the name of humility, power can hide its own conduct.
This is why the goal is not institutional amnesia. Privacy should protect people from irrelevant exposure, while accountability should preserve evidence of institutional action and harm. The records needed to establish who made a decision, what rule was applied, and what evidence was considered may need stronger retention than an individual's unrelated personal history. Transparency about institutional power and restraint about personal exposure can coexist.
The allocation of privacy also matters. A person should not bear the entire burden of proving an injustice from records only an institution can access. Audit logs, independent oversight, aggregate reporting, protected disclosures, and access records can make power visible without publishing every vulnerable person's details. Data justice asks not only who is observed, but who can see, contest, and benefit from what has been recorded.
Humility as a Technical Competence
Epistemic humility is sometimes dismissed as a philosophical ornament. In operations, it is a form of competence. A system that knows its confidence, provenance, gaps, and scope is less likely to trigger an unjustified intervention. A professional who sees that a record is stale or inferred can ask a better question. A board that receives uncertainty and error costs can allocate resources more responsibly than one shown only a clean success rate.
Catholic thought adds a warning about power. The temptation to catalogue everything is not only a desire for convenience; it can be a desire to replace the difficult work of encounter and judgment with administrative command. Dignitas Infinita (2024) repeatedly frames technological power in relation to human dignity, while not prescribing a specific database design. Its relevance here is principled: technical capacity does not create a right to total knowledge of another person.
The Institutional Vocation to Listen
If no database contains the whole person, institutions must retain a capacity to listen. Listening does not mean accepting every claim without evidence. It means recognizing that the record may be incomplete and giving the affected person a meaningful opportunity to add context, correct facts, and explain circumstances that the schema cannot express. It means training officials to distinguish a data conflict from a moral judgment and an uncertainty from a refusal.
Synthesis: A Record Is a Witness, Not a Ruler
A record can witness something true about a person without becoming the ruler of that person. Institutions need memory, evidence, and carefully shared knowledge. They also need boundaries that prevent a useful representation from claiming total authority. Provenance, uncertainty, purpose limitation, access separation, retention, correction, and human responsibility are not obstacles placed around knowledge. They are the conditions that keep knowledge from becoming domination.
The person will always exceed the database—not because data is worthless, but because human life is temporal, relational, embodied, free, and open to change in ways no fixed schema can exhaust. A serious institution can honor that fact while still acting decisively on the evidence a real task requires. It can say, “This is what we know, this is how we know it, this is what we do not know, and this is how you may answer.” That is not weakness. It is truthful authority.
The final safeguard is therefore not a larger database. It is an institutional habit of proportion: collect for a reason, infer with caution, disclose with discipline, decide with accountability, and leave room for the person to speak beyond the record. No database contains the whole person. A just society does not need to pretend otherwise in order to remember what matters.
Source Notes
The council’s account of the embodied person, conscience, dignity, and social institutions that must remain ordered to human flourishing.
The Church’s teaching on human dignity, conscience, moral responsibility, truth, and the limits of treating a person as an object of administration.
International privacy principles for collection limitation, purpose specification, use limitation, data quality, safeguards, openness, participation, and accountability.
A jurisdiction-specific legal framework for purpose limitation, data minimization, accuracy, storage limitation, correction, and qualified rights concerning personal data.
A contemporary doctrinal declaration grounding the essay’s warning that technical capacity does not confer a right to total knowledge of another person.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.