## Chapter 1 — Research question and literature method ### Learning outcomes You will (1) turn a compliance problem into a researchable question; (2) run a structured literature search; (3) describe the baseline performance of a data subject rights process. ### 1.1 From complaint to question Hana Kobayashi is a master's student at the fictional Ellery Institute of Technology, supervised by Dr. Owen Pritchard. Her placement is with the fictional Brookfield Online Retail, which sells household goods to customers across the European Union and Brazil. Customers have complained that requests to see their personal data take too long. Article 15 of the GDPR gives people a right of access, and Article 12(3) requires a response without undue delay and in any event within one month, extendable by two further months for complex or numerous requests. Hana's question is whether a self-service access portal raises the share of requests answered on time. ### 1.2 Why a measurable outcome Hana chooses on-time completion as her main outcome because it is defined by law, already recorded in Brookfield's ticket system and meaningful to customers. She also records days to completion, because a portal could move requests from day twenty-nine to day twenty-five without changing the on-time share. She writes both outcomes down before collecting any data. Dr. Pritchard reminds her that an outcome chosen because it is easy to count can still be the wrong one, so she adds a short justification that links each outcome to the interest of the person making the request. ### 1.3 Literature method Hana searches legal, regulatory and empirical sources separately, because they answer different questions. For law she reads the GDPR articles directly and the LGPD, Lei 13.709/2018, whose Article 19 requires a full access response within fifteen days. For regulatory interpretation she reads the EDPB Guidelines 01/2022 on the right of access, which explain timing, identity checks and the format of answers. For empirical evidence she searches for studies of rights-request handling and records every search string, database and date, so that her review can be repeated by an examiner and later updated. ### 1.4 Baseline performance Before any change, Hana describes the current process using 200 synthetic requests modelled on Brookfield's ticket statistics. Requests through the web form have a median of 18 days and 94.8% are completed within thirty days. Email requests have a median of 28 days with 62.5% on time, and postal requests a median of 46 days with only 29.2% on time. Overall, 74.0% of requests meet the thirty-day mark. Hana notes that the channel mix matters as much as speed, because most late requests arrive by email or post, where staff must re-key information by hand. ### Lab — Baseline completion times by channel ```python # 200 synthetic subject access requests: days to complete and share within one month (30 days), by channel. import random, statistics r = random.Random(5) ch = {"web form": (18, 9), "email": (27, 12), "post": (36, 14)} rows = [] for _ in range(200): c = r.choices(list(ch), weights=[5, 4, 1])[0] rows.append((c, max(1, round(r.gauss(*ch[c]))))) for c in ch: d = [x for k, x in rows if k == c] print(f"{c:9s} n={len(d):3d} median {statistics.median(d):4.0f} days within 30: {sum(x <= 30 for x in d)/len(d):5.1%}") d = [x for _, x in rows] print(f"all n={len(d):3d} median {statistics.median(d):4.0f} days within 30: {sum(x <= 30 for x in d)/len(d):5.1%}") ``` Run with `python3 lab_deadline.py`. Verified output: ```text web form n= 96 median 18 days within 30: 94.8% email n= 80 median 28 days within 30: 62.5% post n= 24 median 46 days within 30: 29.2% all n=200 median 23 days within 30: 74.0% ``` ### Worked example Hana frames the question "does a self-service portal raise on-time completion of access requests?", fixes two outcomes and finds a baseline of 74.0% within thirty days, with postal requests worst at 29.2%. > **Synthetic case.** Ellery, Brookfield and all requests are synthetic; GDPR Articles 12 and 15, LGPD Article 19 and EDPB Guidelines 01/2022 are real. ### Errors and limits Thirty days approximates "one month", which varies by calendar. A synthetic baseline is only as good as the statistics it was built from. ### Exercises - **EX001 — Legal deadline.** What deadline does GDPR Article 12(3) set for answering an access request? *Rubric:* 3 = without undue delay and within one month, extendable by two months for complexity or volume;; 2 = one month only;; 1 = no deadline;; 0 = none. - **EX002 — LGPD timing.** How long does LGPD Article 19 allow for a full access response? *Rubric:* 3 = fifteen days for a clear and complete declaration;; 2 = about two weeks;; 1 = one month;; 0 = none. - **EX003 — Second outcome.** Why does Hana also record days to completion? *Rubric:* 3 = on-time share can hide improvements or delays within the month;; 2 = mentions detail;; 1 = ignores it;; 0 = none. - **EX004 — Search records.** Why record search strings, databases and dates? *Rubric:* 3 = so the review can be repeated and updated;; 2 = mentions transparency;; 1 = omits;; 0 = none. - **EX005 — Worst channel.** Which channel performs worst at baseline, and how badly? *Rubric:* 3 = post: median 46 days, 29.2% on time;; 2 = names post;; 1 = names email;; 0 = none. - **EX006 — Overall baseline.** What share of all baseline requests is on time? *Rubric:* 3 = 74.0%;; 2 = about three quarters;; 1 = wrong;; 0 = none. - **EX007 — Outcome justification.** Why link each outcome to the requester's interest? *Rubric:* 3 = an easy metric can miss what matters to the person exercising the right;; 2 = mentions relevance;; 1 = says counting is enough;; 0 = none. ### Synthesis Chapter 1 frames the question and baseline. Chapter 2 holds an advanced seminar on what access rights are for. ### Continue studying — chapter 01 of 08 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Without undue delay and in any event within one month of receipt, extendable by two further months where necessary. **EX002.** Up to fifteen days for a clear and complete declaration. **EX003.** Days to completion show shifts that the binary on-time share would miss. **EX004.** Recorded searches make the review reproducible and easy to update. **EX005.** Post: median 46 days and only 29.2% completed within thirty days. **EX006.** 74.0% of the 200 requests are completed within thirty days. **EX007.** Linking outcomes to requesters' interests guards against choosing an outcome only because it is easy to count.