Skip to content
allanninal.dev/build
Collaborate

Part 5 of 7 · Data request handler series ~5 min read

How a package gets reviewed

The review is the only part of this system that genuinely requires a person, and it is the part where the whole thing can go wrong in a way nothing else can fix: a package sent containing somebody else’s personal data is a breach caused by responding to a request about privacy.

Key takeaways

  • Third-party personal data comes out. That is the main reason a person reviews.
  • Internal notes are usually disclosable and frequently uncomfortable, which is not a reason to withhold.
  • Deletion is a plan naming every record, executed by a person, and recorded.
  • The response says what was found, what was withheld and why, and what happens next.
  • The number to watch is days used, and it should be well under the limit.

What comes out

How a data request package is reviewed before releaseA vertical chain of five steps entered by a box labelled The assembled package, containing everything held. Step one asks whether there is third-party data naming another person; if so it exits to Redact and note that you did. Step two asks whether something would reveal somebody even without a name; a maybe exits to Consider carefully, as a recorded judgement. Step three asks whether there is an internal note about the requester, uncomfortable but theirs; if so it exits to Usually include it, because awkward is not exempt. Step four asks whether anything is genuinely legally privileged rather than conveniently so; if so it exits to Withhold and say so, with the reason. Step five releases with a covering note. A note says every withholding is recorded with a reason and silent omission is the thing to avoid.AWS ACCOUNTThe assembled packageeverything heldThird-party data?another person namedRedactand note that you didyesWould it reveal somebody?even without a nameConsider carefullya judgement, recordedmaybeAn internal note about them?uncomfortable but theirsUsually include itawkward is not exemptyesLegally privileged?genuinely, not convenientlyWithhold and say sowith the reasonyesReleasewith a covering noteEvery withholding is recorded with a reason. Silent omission is the thing to avoid.
Fig 1. What the review is actually deciding. Three of the four branches lead to inclusion or a recorded decision, which is the correct balance.
  • App integration
  • Machine learning
  • Security & identity
  • People

Internal notes

The most common source of discomfort and the one where the answer is usually clear. A support note saying “customer was extremely rude on the phone” is personal data about that customer, they are generally entitled to it, and finding it embarrassing is not an exemption.

The useful side effect is cultural rather than technical: businesses that run this process for a while write internal notes differently, because everybody understands that the customer may read them. That is a better outcome than any redaction policy.

Third-party data

The genuine reason a person reviews. A message thread where two customers were both discussed, a delivery note listing a neighbour who took the parcel, an internal note naming another employee — all of those contain somebody else’s personal data, and sending them is a breach committed while responding to a privacy request.

The redaction is recorded rather than silent: “parts of two messages have been redacted because they contain information about another person” is a sentence the response letter carries, and it is both more honest and more defensible than a package with unexplained gaps.

Deletion is a plan

How a deletion request is planned and executedA horizontal row of five boxes. The plan: every record in every system. What must be kept: invoices and suppression records. Executed by a person: system by system. Confirmed: read back where possible. Recorded: what went, what stayed, and why. A note says the second box is where most of the thinking is, because some things genuinely must be kept.DELETION IS NOT A BUTTONThe planevery record, every systemWhat must be keptinvoices, suppressionExecuted by a personsystem by systemConfirmedread back where possibleRecordedwhat went, what stayed, whyThe second box is where most of the thinking is: some things genuinely must be kept.
Fig 2. How a deletion request is executed. The plan is generated; the execution is human, and the record of what was kept is as important as the record of what went.
  • Machine learning
  • Security & identity
  • Management
  • People

The retention exceptions are the substantive part. Invoices usually have to be kept for tax purposes for years. The suppression record from the consent keeper has to survive or the person will be emailed again. Neither of those is a refusal to delete; both are specific, statable reasons that belong in the response.

The response and the numbers

What the response letter says

  • What we found, listed by source, in plain terms.
  • What we checked and found nothing in, named, so the scope is visible.
  • What we redacted and why — not what it said, but that it was removed and the reason.
  • What we are keeping and why, for a deletion request, with the specific obligation.
  • What happens next, and how to complain if they are unhappy with the response.
One year of data requests summarised in five numbersA horizontal row of five boxes. Requests: six this year. Median recognition: under an hour. Median days used: nine of thirty. Late: none. Systems with no API: five of eleven. A note says the last number is the one to work on, because it is what makes the middle number nine.ONE YEAR OF REQUESTSRequests6 this yearMedian recognitionunder an hourMedian days used9 of 30Late0Systems with no API5 of 11The last number is the one to work on. It is what makes the middle number nine.
Fig 3. A year of requests in five numbers. The manual-system count is the lever: reducing it is what reduces days used, which is what preserves review time.
  • App integration
  • Machine learning
  • Management
  • Analytics

Days used is the headline and nine out of thirty is comfortable. The interesting relationship is with the last number: each manual system adds days, and a business that moves two of those five onto an export path will see the median drop by several days without anybody trying harder.

Next: what all of this costs to run.

All posts