Meridian Field Services: instructional example, not project evidence
The classification register ran the trigger test and cites this document as its attachment. Every risk row names harm to a PERSON; the lens inverts here.
Screening handshake: the trigger test FIRED on systematic monitoring of workers (impact assessment[1]); this document is the attachment that summary cites.
Processing description, by citation: continuous technician location during shifts (RESTRICTED, 30-day purge; basis: contract performance and legitimate interest, per labels · retention · consent[1]); override telemetry (CONFIDENTIAL worker-conduct records with the employment-notice discipline).
Necessity: dispatch cannot assign on proximity without positions; nothing less intrusive suffices. Zone-only precision was evaluated and fails the assignment use case (the walked alternative recorded in ADR-6 context[2]). Proportionality, designed in: the 30-day purge, band-level display off dispatch surfaces, no off-shift tracking, the anonymized-code boundary at the model gateway (SR-014[3]).
| Id | Harm: to whom, what | Severity | Mitigations (cited) | Residual |
|---|---|---|---|---|
| R-S1 | A technician's movement patterns re-identified → loss of control over personal data | possible · high (the project scale[4]) | SR-033, SR-034[3] + the purge; threat row TM-07[4], cross-cited both ways | rare · moderate |
| R-S2 | Telemetry-driven discipline beyond the agreed monitoring purpose → unfair treatment | possible · moderate | The override-review purpose limit (BR-03[5]) + the audit trail (SR-009[3]) | rare · moderate |
| R-S3 | Chilling effect on work practices from felt surveillance → behavioral harm | possible · moderate | Meaningful notice, band display, the transparency question (open questions[6]) | possible · low · revisited at the pilot exit interviews |
Residual sign-off: N. Duval, July 15, 2026. Prior consultation NOT triggered: residuals sit below the high band after mitigation, stated with the scale citation. Consultation record: privacy officer consultation documented July 12; worker-representative consultation, the union co-signature review, in flight, due August 8 (shared thread[3]); the assessment is conditional-complete until it lands, and says so. Reopening triggers: off-shift tracking ever proposed; a new recipient; precision below band level; the model boundary changing.
Omission note: "cross_border omitted: processing is single-region; the classification register's cross-border record carries the claim and its re-run trigger (cross-border[1]). No transfer exists to assess; the trigger re-runs if a processor outside the region joins the integration register (register[7])."
Rights carry mechanics before they are declared supported: the answer the intake team gives is written before the first request arrives. Staff are the subjects; the worker context is the default here.
| Right | Intake | Verification | SLA | Path |
|---|---|---|---|---|
| Access | The HR service portal's named request form | Employee SSO session, proportionate: the requester is authenticated staff | 30 days; one 60-day extension with notice | N. Duval's team compiles from the position store and audit stream |
| Rectification | Roster errors route to the HR directory, the system of record (INT-5[7]); this system corrects by sync, stated so the intake team routes right | |||
| Erasure | The precedence law applied (retention rules[1]): positions purge at 30 days regardless (often the request is already satisfied); assignment records resist erasure under contract clause 14 and active holds; the written answer lives in the fulfillment pack (rights runbook[8]) | |||
| Portability | Not applicable to employment-context monitoring data under the governing regime, stated as a claim with counsel's citation | |||
| Objection | Routes to the representative channel (the union process) plus the individual grievance path; monitoring-purpose objections land with N. Duval | |||
Worker-context note: every right above names its worker-facing channel; the representative channel exists and is cited, not implied.
| Question | Owner | Answer by | Blocks |
|---|---|---|---|
| Does the union co-signature review change the notice text only, or also the objection path's routing? (Two rows depend on one answer.) | N. Duval | Aug 8, 2026 | The consultation record's completeness and R-S3's revisit wording |