## Chapter 1 — Computing systems ### Learning outcomes You will (1) describe the systems that handle member data in a fitness business; (2) distinguish servers, cloud services, apps and devices; (3) start a system inventory. ### 1.1 The course and the case Aisha Bello begins a three-year technologist course at the fictional Lindon Technical Institute, supervised by Mr. Tom Reilly. Her work placement is with the fictional Quayside Fitness, a chain of forty gyms with about 60,000 members, a mobile app and wearable heart-rate straps used in classes. Quayside holds names, contact details, payment data, workout histories, heart-rate readings and CCTV footage. Mr. Reilly explains that privacy and data protection will be her specialism, and that each technical course will be applied to Quayside's systems. ### 1.2 Kinds of systems Aisha lists Quayside's systems. A membership system in the cloud stores contracts and payments. The app stores profiles and workout history. Club computers run door access and class booking. Wearable straps send heart-rate data to class screens and to the app. CCTV recorders sit in each club. She notes that some systems are run by Quayside and some by vendors, and that member data move between them. Understanding the kinds of systems helps her see where data are stored and who controls them. ### 1.3 Starting an inventory Mr. Reilly asks Aisha to start an inventory. For each system she records its purpose, the data it holds, where it runs, who owns it and which vendor supports it. The inventory reveals that nobody owns the CCTV recorders centrally; each club manager manages their own. She notes this as a governance gap. She learns that Article 30 of the GDPR requires a record of processing activities, and that her technical inventory will feed that record. The record must list purposes, categories of data and recipients, so her columns use the same headings. ### 1.4 Why systems matter for privacy Aisha reflects that privacy depends on systems behaving correctly. A policy may say heart-rate data are deleted after a year, but if the app keeps them forever, the policy is false. She concludes that technologists have a key role: they know how systems actually behave and can check that practice matches policy. Mr. Reilly agrees and adds that technologists often discover privacy problems first, because they see the data every day. Her first example is the app's export button, which the written policy never mentions but which lets any manager download every member in seconds. ### Worked example Aisha lists Quayside's membership, app, club, wearable and CCTV systems, starts an inventory that reveals no central CCTV owner and links it to Article 30. > **Synthetic case.** Lindon, Quayside and all people are synthetic; GDPR Article 30 is real. ### Errors and limits A first inventory is incomplete; plan to revisit it. ### Exercises - **EX001 — Systems list.** Name four systems holding Quayside member data. *Rubric:* 3 = membership, app, club door/booking, wearables, CCTV;; 2 = three;; 1 = one;; 0 = none. - **EX002 — CCTV gap.** What governance gap did the inventory show? *Rubric:* 3 = no central owner for CCTV recorders;; 2 = mentions CCTV;; 1 = vague;; 0 = none. - **EX003 — Practice versus policy.** Why do technologists matter for privacy? *Rubric:* 3 = they see how systems behave and can check practice against policy;; 2 = mentions systems;; 1 = vague;; 0 = none. ### Continue studying — lesson 01 (chapter 01 of 30) [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 →](#ch-02) Continue to the next authored lesson. ## Worked answers **EX001.** Membership system, app, wearables and CCTV (club door and booking systems too). **EX002.** Each club manages its own CCTV with no central owner. **EX003.** They know whether systems actually follow the policies written about them.