# Part 1 · Requests, copies, erasure, consents

## 1.1 Logging a request

**Who** · Owner: anyone whose role holds *Answer personal-data requests*.

**Where** · **Privacy** › **Log a request** (`/privacy/request/create`).

**Before you start** · Someone asked, by e-mail, letter or in person. (Asked in the app, it's logged for you.)

**The steps**
1. **Whose data**: find them among the people here.
2. **What they ask**: a copy of their data, a correction, to be erased, or to stop a use.
3. **Received on** (the due date follows: 30 days later, a setting) and **how it came**.
4. **How you know it's them**: from their own account, we saw an ID (say which; don't keep a copy), or not yet (the
   clock still runs: ask them to confirm first). Then what they said.
5. **Log the request**.

**What the record shows** · The request on **Privacy**, with its countdown (rose within a week, amber within two). Each
step in *What happened*; *Personal-data request logged* in the audit log.

**Who is told** · Everyone who may answer requests, on the bell (and by e-mail as they chose), never with the person's
name; and again a week before it's due, if it isn't answered.

**What can go wrong**
- *Someone isn't in the list.* They aren't in this workspace (or were erased). Each workspace answers for its own.

## 1.2 Sending someone a copy of their data

**Who** · Owner.

**Where** · The request's page (a request for *A copy*).

**Before you start** · The request is open. To send a link, they need an e-mail address.

**The steps**
1. **What goes in the copy** lists each kind of data held on them here, with how much.
2. **Prepare the copy**. It's made in the background: one file, with their data as data (JSON) and to read (PDF), named
   by a code, never by their name. **Prepare it again** if something changed.
3. **Send the link**: an e-mail to them with a link that works 7 days. When they open it, a code goes to the same
   address; only then can they download. Or download the file yourself and give it another way.
4. **Mark it answered**, saying what was done.

**What the record shows** · Each step in *What happened*: prepared, the link sent, downloaded, answered. Each download is
in the file access log.

**Who is told** · They get the link, and the code when they open it.

**What can go wrong**
- *"Prepare the copy first; and they need an e-mail address for the link."* Prepare it, or give it another way.
- *They say the link doesn't work.* It ran out after 7 days, or a newer copy replaced it. Prepare and send again.

## 1.3 Deciding an erasure

**Who** · Owner.

**Where** · The request's page (a request *To be erased*).

**Before you start** · Be sure no law makes you keep their records (a product lists its own), and that it's them.

**The steps**
1. **What erasing does** shows each kind of data and its fate: *erased*, *ended, then erased*, *emptied* (e-mails: the
   log keeps that one went), *anonymised* (sign-ins: the count stays), *kept, unreadable* (the audit log can't be
   rewritten; the key that reads their name is destroyed), *kept* (their requests, by code).
2. **Erase** *name*. Your password again, then type their name exactly.
3. It runs in the background. The request is answered and says whether the platform record went too (it does when no
   other workspace holds them).

**What the record shows** · The request now names them "Former member" and a code. In the audit log, every change about
them reads the same way; *Personal data erased*.

**Who is told** · Nobody: their e-mail address is gone too.

**What can go wrong**
- *"Type the name exactly as it is shown."* Check its spelling and capitals.
- *They still exist elsewhere.* Another workspace holds them and keeps its own; only this one's data went.
- *To refuse instead*: **Refuse, with a reason** (1.4).

## 1.4 Answering a correction, or refusing

**Who** · Owner.

**Where** · The request's page.

**Before you start** · For a correction, change what's wrong first (their page, or wherever it is held).

**The steps**
1. **Mark it answered**, saying what was done ("date of birth corrected to 4 May 1990").
2. Or **Refuse, with a reason** they can read.

**What the record shows** · *Answered* or *Refused*, with your words and the date.

**Who is told** · A refusal: they get an e-mail with your reason and that they may complain to the Data Protection
Commission.

**What can go wrong**
- *"This request is already answered."* It was answered or refused before.

## 1.5 Recording a withdrawn consent

**Who** · Owner.

**Where** · Their page (**People** › them) › **Consents**.

**Before you start** · They told you they withdraw (by e-mail, in person…). Only they can give a consent.

**The steps**
1. Each purpose shows when it was given, how, and to which wording.
2. The switch on one given: **Record that they withdrew it**, and say how they told you.

**What the record shows** · A new row: withdrawn, *they told us*, your note. The consent stops now. *Consent withdrawn*
in the audit log.

**Who is told** · Nobody.

**What can go wrong**
- *No switch.* It isn't given; only they can give it.

## 1.6 My data

**Who** · Anyone signed in, for themselves.

**Where** · Your menu › **My data** (`/me/data`).

**Before you start** · Nothing.

**The steps**
1. **Your consents**: the switch gives or withdraws each, at once.
2. **A copy of your data** › **Ask for a copy**: you'll get a link by e-mail.
3. **Something's wrong?** › **Ask for a correction**: say what's wrong and what it should be.
4. **Erase my data** › **Ask to be erased**. The workspace decides within 30 days and tells you.
5. **Your requests** show each, with its countdown.

**What the record shows** · Your consents, with when and the words you agreed to. Each request, asked from your own
account.

**Who is told** · Whoever answers requests here.

**What can go wrong**
- *Nothing to agree to here.* The workspace has no consent purposes.