OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 From complaint to question"]
N2["1.2 Why a measurable outcome"]
N3["1.3 Literature method"]
N4["1.4 Baseline performance"]
N5["Lab — Baseline completion times by channel"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 From complaint to question"]
N2["1.2 Why a measurable outcome"]
N3["1.3 Literature method"]
N4["1.4 Baseline performance"]
N5["Lab — Baseline completion times by channel"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 From complaint to question]
|
v
[1.2 Why a measurable outcome]
|
v
[1.3 Literature method]
|
v
[1.4 Baseline performance]
|
v
[Lab — Baseline completion times by channel]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn a compliance problem into a researchable question; (2) run a structured literature search; (3) describe the baseline performance of a data subject rights process.
1.1 From complaint to question
Hana Kobayashi is a master's student at the fictional Ellery Institute of Technology, supervised by Dr. Owen Pritchard. Her placement is with the fictional Brookfield Online Retail, which sells household goods to customers across the European Union and Brazil. Customers have complained that requests to see their personal data take too long. Article 15 of the GDPR gives people a right of access, and Article 12(3) requires a response without undue delay and in any event within one month, extendable by two further months for complex or numerous requests. Hana's question is whether a self-service access portal raises the share of requests answered on time.
1.2 Why a measurable outcome
Hana chooses on-time completion as her main outcome because it is defined by law, already recorded in Brookfield's ticket system and meaningful to customers. She also records days to completion, because a portal could move requests from day twenty-nine to day twenty-five without changing the on-time share. She writes both outcomes down before collecting any data. Dr. Pritchard reminds her that an outcome chosen because it is easy to count can still be the wrong one, so she adds a short justification that links each outcome to the interest of the person making the request.
1.3 Literature method
Hana searches legal, regulatory and empirical sources separately, because they answer different questions. For law she reads the GDPR articles directly and the LGPD, Lei 13.709/2018, whose Article 19 requires a full access response within fifteen days. For regulatory interpretation she reads the EDPB Guidelines 01/2022 on the right of access, which explain timing, identity checks and the format of answers. For empirical evidence she searches for studies of rights-request handling and records every search string, database and date, so that her review can be repeated by an examiner and later updated.
1.4 Baseline performance
Before any change, Hana describes the current process using 200 synthetic requests modelled on Brookfield's ticket statistics. Requests through the web form have a median of 18 days and 94.8% are completed within thirty days. Email requests have a median of 28 days with 62.5% on time, and postal requests a median of 46 days with only 29.2% on time. Overall, 74.0% of requests meet the thirty-day mark. Hana notes that the channel mix matters as much as speed, because most late requests arrive by email or post, where staff must re-key information by hand.
Lab — Baseline completion times by channel
# 200 synthetic subject access requests: days to complete and share within one month (30 days), by channel.
import random, statistics
r = random.Random(5)
ch = {"web form": (18, 9), "email": (27, 12), "post": (36, 14)}
rows = []
for _ in range(200):
c = r.choices(list(ch), weights=[5, 4, 1])[0]
rows.append((c, max(1, round(r.gauss(*ch[c])))))
for c in ch:
d = [x for k, x in rows if k == c]
print(f"{c:9s} n={len(d):3d} median {statistics.median(d):4.0f} days within 30: {sum(x <= 30 for x in d)/len(d):5.1%}")
d = [x for _, x in rows]
print(f"all n={len(d):3d} median {statistics.median(d):4.0f} days within 30: {sum(x <= 30 for x in d)/len(d):5.1%}")
Run with python3 lab_deadline.py. Verified output:
web form n= 96 median 18 days within 30: 94.8%
email n= 80 median 28 days within 30: 62.5%
post n= 24 median 46 days within 30: 29.2%
all n=200 median 23 days within 30: 74.0%
Worked example
Hana frames the question "does a self-service portal raise on-time completion of access requests?", fixes two outcomes and finds a baseline of 74.0% within thirty days, with postal requests worst at 29.2%.
Synthetic case. Ellery, Brookfield and all requests are synthetic; GDPR Articles 12 and 15, LGPD Article 19 and EDPB Guidelines 01/2022 are real.
Errors and limits
Thirty days approximates "one month", which varies by calendar. A synthetic baseline is only as good as the statistics it was built from.
Exercises
- EX001 — Legal deadline. What deadline does GDPR Article 12(3) set for answering an access request?
Show marking criteria
Rubric: 3 = without undue delay and within one month, extendable by two months for complexity or volume;; 2 = one month only;; 1 = no deadline;; 0 = none. - EX002 — LGPD timing. How long does LGPD Article 19 allow for a full access response?
Show marking criteria
Rubric: 3 = fifteen days for a clear and complete declaration;; 2 = about two weeks;; 1 = one month;; 0 = none. - EX003 — Second outcome. Why does Hana also record days to completion?
Show marking criteria
Rubric: 3 = on-time share can hide improvements or delays within the month;; 2 = mentions detail;; 1 = ignores it;; 0 = none. - EX004 — Search records. Why record search strings, databases and dates?
Show marking criteria
Rubric: 3 = so the review can be repeated and updated;; 2 = mentions transparency;; 1 = omits;; 0 = none. - EX005 — Worst channel. Which channel performs worst at baseline, and how badly?
Show marking criteria
Rubric: 3 = post: median 46 days, 29.2% on time;; 2 = names post;; 1 = names email;; 0 = none. - EX006 — Overall baseline. What share of all baseline requests is on time?
Show marking criteria
Rubric: 3 = 74.0%;; 2 = about three quarters;; 1 = wrong;; 0 = none. - EX007 — Outcome justification. Why link each outcome to the requester's interest?
Show marking criteria
Rubric: 3 = an easy metric can miss what matters to the person exercising the right;; 2 = mentions relevance;; 1 = says counting is enough;; 0 = none.
Synthesis
Chapter 1 frames the question and baseline. Chapter 2 holds an advanced seminar on what access rights are for.