Chapter 17 — Privacy and data protection: tooling
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 The scanner"]
N2["17.2 Results"]
N3["17.4 Actions"]
N4["Lab — Pattern scan of shared files"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 The scanner"]
N2["17.2 Results"]
N3["17.4 Actions"]
N4["Lab — Pattern scan of shared files"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 The scanner]
|
v
[17.2 Results]
|
v
[17.4 Actions]
|
v
[Lab — Pattern scan of shared files]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) use a simple scanner to find personal data in files; (2) interpret its limits; (3) act on results.
17.1 The scanner
Aisha writes a stdlib Python scanner using regular expressions for email addresses, phone numbers and card numbers. She runs it on five synthetic files from a shared drive. The scanner reads each file line by line, applies three patterns and counts matches without printing the matched values, so the report itself does not spread personal data. Card numbers are checked with a simple digit pattern; she notes that a production tool would add a checksum test. The files are synthetic copies modelled on real types found on the shared drive.
17.2 Results
The lab finds patterns in three of five files: an old member export with two emails and two phone numbers, trainer notes with one phone number and a refunds file with one card number. The trainer notes also mention a knee injury, which the regex does not detect. The old export was created for a promotion three years ago and forgotten. The refunds file was saved by a finance assistant to work offline. The trainer notes were shared to cover classes. Each file has a plausible story, which shows that personal data spread through ordinary work rather than carelessness, and that fixing the work pattern matters as much as deleting files.
17.3 Limits
Aisha explains that pattern scanners miss free-text health information and may produce false positives. Human review is needed for files flagged and for notes in general. Regular expressions find structured patterns such as email addresses, but health information appears in ordinary words: knee injury, asthma, pregnant. A keyword list could help but would produce many false alarms in a fitness business, where words like heart and injury appear in class descriptions. Aisha recommends using the scanner to prioritise human review, not to declare files clean.
17.4 Actions
The old export is deleted, the refunds file is moved to the payment system and trainer notes are moved into the app with access controls. Mr. Reilly notes that tools help but do not replace judgement. Before deleting the old export, she checks with the data protection officer that no legal hold applies. She asks the finance team why they needed an offline copy and finds that the payment system lacked a refunds report, which IT adds. Trainers get a notes field in the app that only the member's own trainers can read, replacing the shared document.
Lab — Pattern scan of shared files
# Scan synthetic shared-drive files for personal data patterns (email, phone, card-like numbers).
import re
files = {"class_timetable.csv": "Mon,Spin,Studio 2\nTue,Yoga,Studio 1",
"member_export_old.csv": "name,email,phone\nAna Lima,ana@example.org,+44 7700 900123\nRui Sousa,rui@example.org,+44 7700 900456",
"trainer_notes.txt": "Client J. knee injury, avoid squats. Call 07700 900789.",
"refunds_march.txt": "Refund to card 4111 1111 1111 1111 approved",
"poster.txt": "Summer challenge! Join at the front desk."}
pat = {"email": r"[\w.]+@[\w.]+", "phone": r"(?:\+44 ?|0)7700 ?\d{6}", "card": r"\b(?:\d{4} ?){3}\d{4}\b"}
hits = 0
for f, t in files.items():
found = {k: len(re.findall(p, t)) for k, p in pat.items() if re.findall(p, t)}
hits += bool(found); print(f"{f:22s} {found if found else '-'}")
print(f"files with personal data patterns: {hits} of {len(files)}")
Run with python3 lab_scan.py. Verified output:
class_timetable.csv -
member_export_old.csv {'email': 2, 'phone': 2}
trainer_notes.txt {'phone': 1}
refunds_march.txt {'card': 1}
poster.txt -
files with personal data patterns: 3 of 5
Worked example
Aisha's scanner flags three of five files, misses the knee-injury note, and she deletes, moves and secures the files.
Synthetic case. Files are synthetic.
Errors and limits
Regex scanners miss context and unusual formats.
Exercises
- EX049 — Files flagged. How many files contained patterns? Rubric: 3 = 3 of 5;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX050 — Missed data. What did the scanner miss? Rubric: 3 = the knee-injury health note;; 2 = mentions health;; 1 = vague;; 0 = none.
- EX051 — Card file action. What happened to the refunds file? Rubric: 3 = moved to the payment system;; 2 = mentions moved;; 1 = kept;; 0 = none.
Continue studying — lesson 17 (chapter 17 of 30)
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.