Part III — The public power that serves it

19. What May Be Kept About You

Permission to keep a record for a service covers that service and nothing else. Processing the record, watching the person it describes and letting a machine help decide about them each need an authority of their own, tied to the exact holding that was reviewed.

The chapter's main case builds that chain for one subject. An office holds an identity-and-status record about the subject to deliver the service it records, processes it, and uses automated support resting on it; then a reviewed finding shows that the holding took an unlawful input. Further cases add the person's own requests, the end of retention, and the failures that keep each record from completing.

Keeping, watching, and letting a machine help

A holding bound to its purpose

A holding names one domain and one purpose from closed lists. The domains are identity and status, health, care, education, the workplace, housing, finance, policing and public decisions. The purposes are delivering the service recorded, administering a lawful decision, protecting the subject's own rights, and independent oversight of the holder. A record naming any other domain or purpose completes nothing.

A holding completes when three separate attesters record the same account of it: a source, an independent attester of the evidence and an independent reviewer, each of them someone other than the holder. The record also names an office to hear challenges and an independent alternate, separate from the holder, from the attesters and from each other. The shared account gives the subject, domain, holder, purpose, version, period, jurisdiction, scope and end. It states that the inputs come only from named lawful sources; that collection is necessary and minimised for the declared purpose; and that the record is private, secure and access-controlled, accurate and correctable on request, held to a stated end and then lawfully deleted, and open to its subject's access and challenge with protection from retaliation. It rules out transfer, sale or linkage outside the declared purpose, and enrolment in an enforcement record through access to the floor, care, schooling or the courts. It names its challenge, correction, remedy and final review, and it places standing, the floor, liberty, the ballot, sanctions, risk and worth outside its consequences.

In the case, the holder gains authority to keep the record for delivering the service. It owes the subject accuracy, correction and security, and it owes protection from retaliation to the subject and to anyone who objects.

A holding is power over the person it describes, so it waits for all three attesters: its source's record alone completes nothing and opens no review. It also fails if the holder signs as reviewer, if the source reviews its own record, or if one body is both the challenge office and the alternate. When its authorised attesters give it two different periods, the holding is ambiguous: the holder loses the authority to keep the record and still owes accuracy, security and protection from retaliation. The office that wants the record bears the cost. It must assemble five separate roles before it may keep anything, and a disagreement among them costs it the authority while the subject keeps the protections. What the person is owed follows from personhood and waits for none of this.

A use must rejoin the exact holding

Processing is a separate record with its own three attesters. It names its kind: ordinary record keeping, biometric processing, profiling, targeted surveillance, or an automated or assisted decision. It names the holding it rests on, and its attesters must record the same subject, domain, holder, purpose, version, period, jurisdiction, scope and end that the holding's source recorded. In the case, processing for ordinary record keeping matches every field, so the holder is permitted to process the record and the processing completes.

Change one field and the permission is gone. Processing about another subject rests on nothing, so a holding reviewed about one person licenses nothing about another. Processing that names a housing record finds no support in the identity-and-status holding. Processing for oversight of the holder finds none in a holding reviewed for delivering the service. A different version or period fails the same way, and processing with no holding behind it completes nothing.

The cost falls on an office that finds a second use for a record it already holds. It must have a holding reviewed for the new domain or purpose before the use begins, and anyone the second use would have helped waits with it.

Covert and biometric use

Every processing record, ordinary keeping included, must also state the terms for the most intrusive uses: prior individualised authorisation for covert or biometric use; the least intrusive means, with a defined scope and duration; a fresh authorisation for each renewal; and later notice to the subject. It must refuse bulk, suspicionless or population-scale collection, and the purchase or exchange of data that the office was barred from collecting. Without any one of these terms the processing completes nothing, whatever its kind.

On those terms biometric processing, profiling and targeted surveillance are permitted as ordinary keeping is, and the holder owes the subject notice after covert processing. The cost falls in two places. An investigation loses population-scale search and bought data, and the people such a search might have protected bear that loss. The person watched learns of covert processing only afterwards, and the notice then owed is the protection they have for the time before.

A machine may help; a person decides

Automated decision support is a third record. It rests on the same holding and repeats its fields, names the decision it supports and the human reviewer who will decide, and is attested by its own source, evidence attester and reviewer. They record an accessible explanation of the inputs and the reasoning; a real chance to contest before anything takes effect; human and independent review deciding the outcome; the refusal of any consequential decision made by the machine alone; and the exclusion of every risk, threat, loyalty or dangerousness product from the record that reaches a person's rights. The reviewer who decides must be someone other than the holder and other than each of the record's attesters.

In the case, the holder owes an explanation that allows contest, the subject is permitted to contest the support, the reviewer owes a human and independent decision, and the support record completes. Support about someone other than the holding's subject completes nothing, and so does a support record that omits the refusal of a machine-only decision. The support's output reaches a decision only through the reviewer, and the rules draw no conclusion from a score.

The conditions are the same whichever way the support points. A recommendation to grant waits for the reviewer as a recommendation to refuse does, because this record has no route by which one actor's word takes effect. The person awaiting a decision bears that delay, and the office pays for a reviewer for every consequential decision.

Asking to see, correct, delete or object

A person may ask to inspect, correct or delete their own record, or object to its processing. The request binds one record in one case: it hands back no reusable identity, and it publishes no private record or identity.

Because such a request only gives the person something, it takes effect on its source's record alone. The person may make the request, the holder owes an answer, and the independent reviewer the request names owes prompt review. If that reviewer withdraws it on review, the permission and the holder's duty end. With its evidence attester and reviewer also recording it, the request completes as a reviewed record. The holder bears the cost of answering before any review has confirmed the request.

When the responding office fails to answer, its silence decides nothing. An independent positive finding that it failed to answer, after authenticated notice, a real chance to act and a deadline set by the record's source, obliges an independent alternate to review the request and secure an independent remedy. The failure counts as neither approval nor a fact against the person who asked. The person bears the wait: through the deadline, and then until the finding is made.

When the end arrives

Retention has its own reviewed record, attested as a holding is. When it shows that the holding's stated end has arrived or its purpose is exhausted, the holder owes deletion or narrowing, with a record of what was done, and the challenge office owes verification that the deletion or narrowing happened. The record rules out a quiet extension and any rebuilding of the file from copies. A retention record written against a superseded version of the record concludes nothing, and so does one resting on its source's word alone.

The cost falls on the office and on later inquiries. A file that would have helped a later decision is owed deletion once its end arrives, and an office that wants it for a new purpose needs that purpose reviewed before then.

When the input is unlawful

The main case then adds a defect record. Its source, independent evidence attester and independent reviewer each record that the holding took an unauthorised input, that this makes that exact use unsupported, and that the finding is about the use: it states nothing adverse about the subject and grants them no automatic remedy. The defect names the use exactly as the use's own source recorded it, with the same subject, domain, holder, purpose, version, period, jurisdiction, scope and end.

The holding is then contradicted. The holder's authority to keep the record ends; the holding, the processing and the automated support each stop being complete; and the permission to process ends with them. The duties outlast the authority. The holder still owes accuracy, correction and security, protection from retaliation, notice after covert processing and an explanation that allows contest; the reviewer still owes a human and independent decision; and the subject may still contest the support. The defect adds duties of its own: the challenge office must review and correct the unsupported use, and the holder must publish the correction.

A defect withdraws the holding it names and the uses resting on that holding. In a second case, a defect found against a different holding leaves this holding's processing permitted and complete, while the correction duties attach to the other holding. The same route answers purpose creep, bulk or suspicionless collection, purchased unlawful data, an unexplained automated effect, a consequential decision made by the machine alone, uncorrected inaccuracy, unlawful retention, blocked access or correction, retaliation for objecting, and a breach of the separation between records.

Every office relying on the holding loses its uses at once, and the cost of the defect falls there. Withdrawal ends authority. Deleting data, explaining a past decision and remedying harm already done each need a record of their own, and the subject's remedy follows the routes in A Way to Be Heard (Chapter 21).

What the record says about the person

Keeping a record about somebody neither enters them on the roster nor removes them from it. Personhood comes from a birth, an encounter or another standing root, and none of these names the subject of the case. The holding, the processing, the support and the defect add no credibility finding, confinement or recorded loss for that subject. Hano, recorded beside the case, keeps his food debt and his ballot throughout. A file is neither a source of worth nor a licence to reduce rights.

Counting without ranking people

A file used for a decision about one person and a dataset used to describe conditions serve different purposes, and population evidence needs a route that keeps a group pattern from becoming a judgment about an individual.

Censuses, representative samples, administrative statistics and planning data have permission only for a declared purpose, with necessary and minimised collection, accessible participation, privacy, correction, and limits on retention and deletion. The method must be independently reviewed and free of political direction of its result. The operator owes publication of the method, uncertainty, exclusions and known undercount, and protection from retaliation for participants and those who support them. A release contains privacy-safe aggregates only, with individual identifiers and reusable linkage left out.

The statistical record stays apart from the record that decides a person's rights, and from records used for eligibility or enforcement. Small groups and unusual intersections are protected against identification through an aggregate. Permission for one dataset, purpose, method version and evidence period licenses that use alone. Declining to take part draws no penalty and leaves every right intact.

A credible group pattern can support a rebuttable presumption in a remedial equality proceeding. The challenge office may open an independent systemic audit, the respondent must disclose the basis of the challenged measure and justify it, and the challenge office must hear rebuttal and correct the presumption. A reviewed rebuttal displaces that presumption alone. The presumption belongs to a remedial proceeding, never a criminal burden, and gives no verdict about what one person deserves, is owed, risks or has done.

A person may ask to inspect their own statistical evidence, and the operator owes private access, correction, deletion and challenge, with no reusable identity classification handed back. A failure to respond, positively found, obliges an independent alternate to review the request and secure a remedy; silence shows neither approval nor misconduct by the person who asked.

A current reviewed defect stops the affected use and requires a privacy-safe correction to be published. Undercount disqualifies a use only when the finding shows why it makes that use unsupported. Classification harm, political manipulation, stale data, method drift, suppression and identity reuse are open to the same challenge. No statistical finding takes anyone's standing, floor, liberty, ballot or permanent public answerability.

What this cannot settle

The rules read no computed value, so what an automated tool actually does lies beyond them. The explanation field records that an accessible explanation was given; whether it describes the tool's reasoning rests on the attesters who recorded it. A named human reviewer must decide, and a reviewer who adopts every recommendation as it comes still satisfies that requirement on the record; a defect finding that the decision was the machine's alone is where that can be caught.

Deletion is shown by a record of what was done and a verification of it. The rule against rebuilding a file from copies binds the holder, and a copy kept where no record names it stays out of the rules' sight.

The statistical rules use the statistics and findings they are given. Counting a population, calculating a disparity, authenticating an identity and observing a deadline fall outside them.

Whether files are kept securely, data deleted, notices sent, corrections published and requests answered belongs to the second book.

The permission to keep a record stays bounded by its purpose even when another use would be convenient. The next chapter puts that discipline under a more urgent claim: that a crisis requires the ordinary limits to give way.

Run it: the companion runs this chapter's cases on your own device, at dhilipsiva.dev/rights-nobody-has-to-earn/cases.

Argument: Uses bound to their holding, decisions to a person

The companion states these rules as Article 19.

I tie every use of a record to one reviewed holding, matching its subject, domain, purpose, version and period, because a record's power over a person grows with each place it reaches, and so does the reach of its mistakes. Bound to its holding, a use is also the unit of correction: a defect withdraws the holding it names and the uses resting on it, and leaves other holdings standing. China's social credit system is the usual warning, and the scholars who studied it describe it as fragmented and mostly regulatory.^[1] Its lesson lies at its enforcement edge. By the end of 2018, the Guardian reported from the national credit information centre's figures, courts had banned would-be travellers from buying flights 17.5 million times, and people on blacklists for social credit offences had been refused train tickets 5.5 million times: counts of blocked purchases, not people.^[2] Lists kept to enforce court orders and penalties decided who could buy a ticket.

I refuse a consequential decision made by a machine alone because contest is worth most before the effect lands, and it needs someone who can be persuaded then and held to account after. I require that person to be someone other than the holder, so the one who checks the machine has no stake in the office's own record.

The strongest alternative is the tell-us-once state. It keeps purpose limits but lets facts flow, which makes it narrower than the integrated case record of What the Record May Say (Chapter 2) and the broader linked record of Part V. A person tells the state a fact once, such as a birth, a move or a death, and every office that needs it updates its own record, while routine changes to entitlements take effect automatically, with a human review available on request. It is held by those who design services around the person rather than the office. Its best case is that the people whose circumstances change most are spared repeating themselves, and a benefit that a registered birth could start begins on time, before anyone applies. I have no registered measurement of it to cite.

My rule costs exactly those things. A fact given to one office reaches another only when that office has a holding reviewed for its own purpose, so the person repeats it; and even a change in their favour waits for a human reviewer's decision. People whose lives change often bear the repetition, and claimants bear the wait. I accept these costs because an error that flows automatically reaches every office the fact reaches, and its effects land before anyone contests them; under my rule it reaches one holding and the uses resting on it, which one defect withdraws.

I would reconsider on evidence that automatic propagation, with contest before effect, produced fewer wrongful adverse decisions and fewer missed entitlements than holdings bound to one purpose. I would begin by letting a favourable automated change take effect on one actor's record, with a reviewer able to withdraw it, as a person's own access request already does. And if human reviewers were shown to adopt automated recommendations as they came, the requirement would protect nobody, and I would look for another safeguard.