A resident asks what personal data the city holds about them. Which governance capability should respond?
Select an answer to reveal the explanation.
Short Explanation
When someone asks 'what do you have on me,' you need a map and a process—not a shrug. Inventory plus a playbook lets the city find and answer without a scavenger hunt. Subject requests are governance muscle, not a favor.
Full Explanation
Governed processes to locate holdings across systems are required to fulfill data-subject style requests from residents. When a resident asks what personal data the city holds about them, the response capability depends on inventory, ownership, and repeatable search—not guessing games. Telling the resident no inventory exists and closing the request immediately fails civic duty and often legal timelines. Publishing every employee email inbox publicly as a substitute for a targeted response creates new privacy harm and operational chaos. Requiring the resident to guess which department holds their records before helping shifts the city's inventory burden onto the public. Exam caveat: response scope and identity verification rules vary by law; design the process to meet applicable timelines and authentication standards. Operational check: maintain a system inventory with personal-data flags and owners, run a tabletop fulfillment drill, and measure time-to-locate and time-to-respond for sample requests. City clerks and privacy leads should fund inventory quality as a prerequisite for trustworthy resident rights handling. Publish anonymized drill metrics so council sees whether resident rights requests are operationally feasible.