What if a customer asks for their data?
A person can ask an organisation what personal data it holds about them. They can ask for mistakes to be fixed, and often for the data to be deleted. These are access and deletion requests.
You must be able to find one person's data in every table. You must also act fast in a data breach. That is when personal data is lost or seen by someone who should not see it.
By the end of this lesson
Note
I can collect one person's data for a request and list the steps of a breach.
Key words
| Word | What it means |
|---|---|
| Access request | a person asks what data you hold about them |
| Deletion request | a person asks you to erase their data |
| Data breach | personal data lost, stolen or seen by the wrong people |
| Contain | stop a breach from getting worse |
| Notify | tell the people affected and the body that oversees data protection |
The cells students fill in are left blank in this preview.
Answer a request in four steps
First, check the person is who they say. Handing data to the wrong person is itself a breach.
Second, find every place their data lives. Third, answer within the time that data protection law sets. Fourth, write down what you did.
The second step is the hard one, because data hides in tables nobody thought of.
Worked example: where one customer's data hides
| Place | Link to the person | What it holds |
|---|---|---|
| Customers table | The customer id | Name, email, phone, city |
| Orders table | The customer id | What they bought and when |
| Reviews table | The customer id | Their opinions |
| Support tickets | Their email address | Their complaints |
| Mail provider and backups | Their email address | Copies of messages |
The cells students fill in are left blank in this preview.
Accept the server's certificate
printf '[client]\nssl-verify-server-cert=0\n' > ~/.my.cnfShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Make a short name for the shop
alias sql='mariadb -h db -u student -pstudent shop -t -e'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read one customer's profile row
sql "SELECT first_name, last_name, email, phone, city FROM customers WHERE id = 7"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Count the rows that link to them
sql "SELECT (SELECT COUNT(*) FROM orders WHERE customer_id = 7) AS orders, (SELECT COUNT(*) FROM reviews WHERE customer_id = 7) AS reviews"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
One customer, three places
The profile Run prints Elena Taylor, her email, her phone number and the city Seville. The second Run prints 4 orders and 3 reviews.
A full answer to an access request would list all of it. Customer 7 is invented, as is every row in the lab.
Try it: gather rows from two tables
-- Everything one email address has done, from two tables.
SELECT 'order' AS kind, ordered_on AS happened_on
FROM orders WHERE customer_id = 3
UNION ALL
SELECT 'review', written_on
FROM reviews WHERE customer_id = 3
ORDER BY happened_on;
-- Change both 3s to 2. Whose data do you see now?
A deletion request may mean delete or de-identify
Orders belong to a customer, so a database often refuses to delete the customer while orders point at them.
A shop may also have a duty to keep an invoice. In that case you keep the order, remove the details that name the person, and write down why.
Delete or de-identify in every place from the table above, and check backups expire on schedule.
A common mistake
Warning
Many people think a data breach means a hacker. A lost laptop, an email sent to the wrong person and a database left open to the internet are all breaches. If personal data reached someone who should not have it, it counts.
Contain first, then assess the harm
Act in this order. Contain the breach: cut access, change passwords, take the file offline. Assess what data, whose, and how sensitive.
Notify the people at risk, and the body that oversees data protection if the law asks for it. The deadline is short, measured in days. Then fix the cause and record what you learned.