Chapter 8 — Independent review and defense
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Independent review"]
N2["8.2 The defense"]
N3["8.3 Follow-up with Brookfield"]
N4["8.4 Reflection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Independent review"]
N2["8.2 The defense"]
N3["8.3 Follow-up with Brookfield"]
N4["8.4 Reflection"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 Independent review]
|
v
[8.2 The defense]
|
v
[8.3 Follow-up with Brookfield]
|
v
[8.4 Reflection]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) respond to an independent reviewer; (2) defend design choices; (3) agree follow-up actions with the organisation.
8.1 Independent review
Before the defense, an independent reviewer from another university reads the dissertation. She raises three points: the bootstrap ignores repeat requesters, the completeness sample is small, and the dissertation does not discuss requests refused as manifestly unfounded or excessive under Article 12(5). Hana checks the data: repeat requesters are 3% of requests, so she reruns the analysis without them and the result barely changes. She adds a sentence about the completeness sample and a short section on refusals, which turn out to be rare, two in each period, and documented in both periods.
8.2 The defense
At the defense, the examiners ask why Hana did not wait a year to separate the website redesign. She answers that Brookfield needed a decision within the year and that her design makes the remaining rival explicit, so the decision can be revisited. They ask whether the portal's login-based identity check could exclude customers without accounts. She explains that such requests still go to staff with proportionate checks, and that their on-time rate is reported separately in an appendix. The examiners accept both answers and recommend minor corrections focused on clearer tables.
8.3 Follow-up with Brookfield
After the defense, Hana meets Brookfield's data protection officer to agree follow-up. Brookfield will retire the email route for access requests, keep the postal route for people who prefer it and add a monthly report on on-time completion, completeness and misdirected disclosures. A second review in a year will test whether the improvement persists after the website redesign settles. Hana hands over her analysis script so that Brookfield can produce the monthly report itself, and she confirms that the script runs only on pseudonymised metadata inside the company's environment.
8.4 Reflection
Hana reflects that the most useful parts of her study were decided early: an outcome defined by law, rivals listed before data, and a rule for what counts as improvement. The statistical analysis mattered, but it was the design that made the result believable. She also learned that privacy research must respect privacy itself, which shaped every data decision. Dr. Pritchard asks her to write these lessons as advice for next year's students, and she includes them in the dissertation's final pages as practical guidance for anyone studying a compliance process.
Worked example
Hana answers a reviewer by rerunning without repeat requesters and adding refusals, defends her timing choice and agrees monthly monitoring and a second review with Brookfield.
Synthetic case. The reviewer, examiners and follow-up are synthetic; GDPR Article 12(5) is real.
Errors and limits
Handing over a script does not guarantee correct use; Brookfield needs an owner who understands it.
Exercises
- EX045 — Repeat requesters. How did Hana address repeat requesters? Rubric: 3 = reran without them (3%), result barely changed;; 2 = mentions rerun;; 1 = ignores;; 0 = none.
- EX046 — Article 12(5). What does Article 12(5) allow? Rubric: 3 = refusing or charging for manifestly unfounded or excessive requests;; 2 = mentions refusal;; 1 = wrong;; 0 = none.
- EX047 — Timing defense. Why did Hana not wait a year for the redesign to settle? Rubric: 3 = Brookfield needed a decision, and the rival is explicit for later review;; 2 = mentions deadline;; 1 = says it was unnecessary;; 0 = none.
- EX048 — No-account requests. How are requests from people without accounts handled? Rubric: 3 = routed to staff with proportionate checks and reported separately;; 2 = mentions staff;; 1 = excluded;; 0 = none.
- EX049 — Monitoring set. What will Brookfield's monthly report include? Rubric: 3 = on-time completion, completeness and misdirected disclosures;; 2 = two;; 1 = one;; 0 = none.
- EX050 — Design lesson. What does Hana say made the result believable? Rubric: 3 = the design decided early: legal outcome, rivals, improvement rule;; 2 = mentions design;; 1 = says statistics;; 0 = none.
Synthesis
Chapter 8 completes the master's route with a defended result and monitored follow-up. The worked results follow, then the references.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →