Part III — The public power that serves it
19. What May Be Kept About You
A record kept to provide a service is not permission to watch its recipient, combine their files or let a machine decide their rights. Each further use needs its own authority tied to the exact holding that was reviewed.
What happens to those permissions when the holding itself is defective? The chapter follows an authorised use through that failure, then asks how a state can count conditions without ranking people. A person's rights must survive both the presence of a file and its absence.
Keeping, watching, and letting a machine help
The chapter's positive case completes a holding, processing of that same record and automated decision support tied to both. The holder owes accuracy, security, protection from retaliation and an explanation; an independent reviewer owes a human decision, and the subject may contest the support. A holding about one subject cannot license processing about another.
Why the permissions are separate
The rules cover identity, health, care, schooling, employment, housing, money, policing and public-decision records. A holding needs a declared purpose and may be used only within it. The inputs must come from named lawful sources. The collection must be no more than the purpose needs. It must be private, secure and access-controlled, accurate and correctable on request, held only to a stated end and then deleted or narrowed, and open to the person it is about. It may not be transferred, sold or linked outside the purpose it was kept for. Food, care, schooling and access to a court must not become routes into enforcement records. A service may not enrol a person in such a record as the price of access.
Watching is a separate permission, and it points at the exact holding that was reviewed — the same person, the same domain, the same purpose, the same version, the same end. A permission to keep a housing record does not license watching somebody's finances, and one reviewed about one person licenses nothing about another. Covert or biometric use needs its own prior individualised authorisation, the least intrusive means, a defined scope and duration, a fresh authorisation for each renewal, and notice to the person afterwards. Bulk, suspicionless or population-scale collection is refused, and so is buying or trading what could not have been collected.
Automated decision support needs separate permission. It requires an explanation of its inputs and reasoning, a real chance to contest before anything takes effect, and a human and independent review that decides the matter — the reviewer cannot be the body holding the record. A consequential decision made by the machine alone is refused. So is putting a risk, threat, loyalty or dangerousness product into the record that reaches a person's rights. The exclusion applies where a computed score would enter; these rules read no computed value and draw no conclusion from one.
A person may seek inspection, correction, lawful deletion or review of the use of their own record, without being handed a reusable classification in return, and without anyone else's private record being exposed. Asking creates a duty to review the request; it does not decide it. When the reviewer is independently established to have failed to answer, the duty moves to an independent alternate, and silence still proves nothing about the person who asked. When the stated end arrives or the purpose runs out, what is held must be deleted or narrowed, with a record of what was done, no quiet extension and no rebuilding it from copies.
When the input is unlawful
The defect sequence then introduces an independently reviewed finding of an unauthorised input. The holding and its dependent permissions for processing and automated support cease to derive. The duties attached to those records continue: accuracy, security, protection from retaliation, later notification, explanation and human review. The subject keeps the right to contest the automated support. Withdrawing permission cannot discharge those obligations while the record of the undertaking remains. The defect finding also creates duties to review and correct the unsupported use and publish the correction. An unrelated defect does not withdraw an unaffected use.
Other recognised defects include purpose drift, bulk or purchased data, unexplained automated effects, machine-only decisions, uncorrected inaccuracy, retention past its end, blocked access, retaliation and breached separation between records. Withdrawal concerns the specified authority and the permissions that depend on it. It does not itself delete data, explain a past decision or perform a remedy.
The record can name its subject without supplying a personhood entry. The case completes without creating personhood, a void, confinement or recognition loss for that name. Hano's floor and ballot conclusions remain. The legal standing routes are separate from permission to hold or process records; a file is not a source of human worth or a licence to reduce rights.
Counting without ranking people
A file used for a decision about one person and a dataset used to describe conditions have different purposes. Population evidence needs a route that does not turn a group pattern into a judgment about an individual.
A public institution needs to know what is happening without turning the people it counts into a ranked list. Censuses, representative samples, administrative statistics and planning data have permission only for a declared purpose, with necessary and minimised collection, accessible participation, privacy, correction and limits on retention and deletion. The method must be independently reviewed. Publication must explain the method, uncertainty, exclusions and known undercount without exposing people.
The statistical record stays apart from the record that decides a person's rights, and from records used for eligibility or enforcement. Small groups and unusual intersections need protection against being identified through an aggregate. Permission for one dataset, purpose, method version and evidence period does not license another use. Refusing to participate does not reduce any right.
A credible group pattern can open an independent equality audit and require a respondent to explain and justify a challenged measure. The presumption can be answered and corrected. It belongs to a remedial proceeding, never a criminal burden, and supplies no verdict about what one person deserves, is owed, risks or has done.
A person can seek access to their own lawfully held evidence, correction, lawful deletion and independent challenge without receiving a reusable identity classification. A request creates a duty to review it, not permission to expose somebody else's private record. A separately established failure to respond creates a duty on an independent alternate; silence alone proves neither approval nor misconduct by the person who asked.
A current reviewed defect can stop the affected use and require correction. Undercount is not disqualifying merely because it exists: the finding must establish why it makes that use unsupported. Classification harm, political manipulation, stale data, method drift, suppression and identity reuse are open to the same challenge. No statistical finding takes anyone's standing, floor, liberty, ballot or permanent public answerability.
These rules use supplied statistics and findings. They neither count a population nor calculate a disparity, authenticate an identity or observe a deadline. Publication and response remain duties to perform.
The child with nobody
Nell's birth entry establishes personhood and the health debt. The case requires no health, school or administrative file and no enrolment through a service.
The firewall forbids making service access a route into enforcement records. An appointment to assist Nell uses only information needed for that matter, with no reusable classification or enrolment. The advocate must begin without a request. Nell's record supplies no personal access or correction request or finding of a reviewer's nonresponse to activate those separate routes.
Giving the limits effect
The model tests authority and duties over supplied evidence. It authenticates no input, stores no file, evaluates no deployed model and performs no deletion. Storage, security, retention engineering and case administration must give practical effect to the legal limits.
The permission to keep a record stays bounded by its purpose even when another use would be convenient. The next chapter puts that discipline under a more urgent claim: that a crisis requires the ordinary limits to give way.