Chapter 11 — Supervised laboratory
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 The lab task"]
N2["11.2 Lab results"]
N3["11.3 Balancing the referee"]
N4["11.4 Documenting decisions"]
N5["Lab — Third-party names in an access response"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 The lab task"]
N2["11.2 Lab results"]
N3["11.3 Balancing the referee"]
N4["11.4 Documenting decisions"]
N5["Lab — Third-party names in an access response"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 The lab task]
|
v
[11.2 Lab results]
|
v
[11.3 Balancing the referee]
|
v
[11.4 Documenting decisions]
|
v
[Lab — Third-party names in an access response]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) review an access request response for third-party data; (2) apply redaction correctly; (3) explain balancing decisions.
11.1 The lab task
Marta's supervised laboratory uses a synthetic access request response prepared for a rejected candidate, Rosa Lindqvist. The response includes interview notes, emails, an internal chat extract, a shortlist and a reference. Article 15(4) says the right to obtain a copy must not adversely affect the rights and freedoms of others, so Halden must consider third-party information before releasing documents. The lab checks which redactions were made and whether names of other people remain visible in the draft response. Visible names are the lab's focus, but she also reads every line in full for indirect clues.
11.2 Lab results
The lab finds six lines with four redactions already made and three third-party names still visible: a panel member, Tom Becker, in the interview notes; a referee, Ana Ruiz; and a colleague, Jon Patel, who compiled feedback. Marta does not simply redact all three. Ms. Lin asks her to consider each person's role. Staff acting in their professional capacity, like the panel member and colleague, can often be named, because candidates have a legitimate interest in knowing who assessed them. Context decides each case.
11.3 Balancing the referee
The referee is different. Ana Ruiz gave an opinion in confidence as a former manager. Marta considers whether the reference was given on the understanding that it would remain confidential, whether the candidate already knows who the referee is and whether the content can be shared without the name. She recommends disclosing the substance of the reference while asking the referee whether she objects to her name being shared, following the approach in EDPB Guidelines 01/2022 on balancing rights of others. Her answer is recorded.
11.4 Documenting decisions
Marta records each redaction decision with the reason: names of other candidates on the shortlist redacted because they are unrelated third parties, staff names left visible because they acted in professional roles, and the referee's name pending her response. She notes that blanket redaction can make responses useless and unfair to the candidate, while no redaction can harm others. Ms. Lin approves the reasoning and notes that documenting decisions allows the response to be defended if the candidate or the authority questions it.
Lab — Third-party names in an access response
"""Check a synthetic access-request export for unredacted third-party names (stdlib only)."""
import re
candidate = "Rosa Lindqvist"
third = ["Tom Becker", "Ana Ruiz", "Jon Patel"]
doc = [
"Interview notes: Rosa Lindqvist strong on scheduling; panel member Tom Becker agreed.",
"Email from [REDACTED] to Rosa Lindqvist confirming second interview.",
"Reference received from Ana Ruiz, former manager, positive.",
"Internal chat: [REDACTED] asked whether Rosa Lindqvist could start in May.",
"Shortlist: Rosa Lindqvist, [REDACTED], [REDACTED].",
"Feedback compiled by Jon Patel for the hiring manager.",
]
left = [(i + 1, n) for i, line in enumerate(doc) for n in third if n in line]
red = sum(line.count("[REDACTED]") for line in doc)
print(f"lines {len(doc)}; redactions made {red}; third-party names still visible {len(left)}")
for i, n in left: print(f" line {i}: {n}")
Run with python3 lab_redact.py. Verified output:
lines 6; redactions made 4; third-party names still visible 3
line 1: Tom Becker
line 3: Ana Ruiz
line 6: Jon Patel
Worked example
Marta finds three third-party names still visible in a six-line synthetic response, leaves professional staff names, redacts other candidates, seeks the referee's view and documents each decision.
Synthetic case. The response is synthetic; GDPR Article 15(4) and EDPB Guidelines 01/2022 are real.
Errors and limits
A name search misses indirect identifiers such as job titles; read documents in full.
Exercises
- EX051 — Visible names. How many third-party names remained visible? Rubric: 3 = three;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX052 — Staff names. Why may staff names often remain? Rubric: 3 = they acted in professional roles;; 2 = mentions role;; 1 = vague;; 0 = none.
- EX053 — Referee approach. What did Marta recommend for the referee? Rubric: 3 = disclose substance; ask about the name;; 2 = both;; 1 = one;; 0 = none.
- EX054 — Shortlist names. Why were other candidates redacted? Rubric: 3 = unrelated third parties;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX055 — Blanket redaction. Why avoid blanket redaction? Rubric: 3 = makes responses useless and unfair;; 2 = mentions fairness;; 1 = vague;; 0 = none.
Continue studying — lesson 11 (chapter 11 of 12)
← Chapter 10 · Course chapter index · Chapter 12 →
Continue to the next authored lesson.