Close down an organisation, and keep its records for a legal case

Closing down an organisation means ending its use of Munitas in stages, and the page explains the three stages before it offers anything. In the first stage, called Closing down and 15 days long, the clinic takes no changes but its people can still read, and a data custodian can cancel. In the second stage, called Closed to its people and also 15 days long, nobody in the clinic can do anything. In the third, everything inside the clinic is deleted, unless a legal hold stands over it. A legal hold is an order to keep records, and it appears in part four.

Pressing the button opens a box that asks for a reason before anything happens. The reason is stored with the closing down and is shown to everybody in the clinic afterwards, so that nobody has to guess why the organisation was closed. Nothing is deleted by this step.

The status changes from Open to Closing down. From this moment the clinic takes no changes: nothing can be added, registered or approved, because a write of any kind is refused by the database. Reading still works until the first date. Because this is the first stage, the page offers Dunmore a button to cancel.

Everybody in the clinic is told that it is being closed, not only the person who started it. Quinn has no menu entry for closing down, because that entry is shown only to data custodians, data protection officers and platform administrators. The banner carries a link instead.

Quinn follows the link and reaches the status page, which shows the same Cancel the closing down button. The page draws the button for everybody, because the platform decides when it is pressed and not the page. The platform checks the role against its access rules and answers with the reason.

The first stage has ended, so the clinic is now in the second stage, called Closed to its people. The platform refuses every request from the clinic’s people from this point, including the request to cancel. The console therefore shows one notice and nothing else, instead of a menu whose every link would be refused.

A platform administrator sees the clinic as one row of a table that covers every organisation. The table shows dates and states only, and never what an organisation holds. Harbour Clinic is already in the second stage.

The form asks for every part of the notice: which organisation it applies to, who issued it, the issuer’s own reference, a contact, what triggered it, the date it arrived, what the matter is about, and what must be kept. It also asks for a temporary custodian, which is the person who answers for the kept records while the hold stands. Priya names Adeyemi, the clinic’s data protection officer, a person who watches how the clinic handles personal data. The form will not send until every required part is filled in.

The hold does not take effect yet, because one platform administrator alone cannot place it. It already stops the clinic being deleted, though. The reason is that a deletion could otherwise happen between the moment the hold is recorded and the moment it is approved, and the hold would then have protected nothing. If nobody approves it within 7 days, it lapses and stops standing in the way.

The page offers the Approve button to every platform administrator and the platform decides when it is pressed. It refuses an approval from the person who recorded the hold. The same rule is also written into the database as a check, so a fault in the program could not bypass it.

Ravi sees the same waiting hold, with every part of the notice in front of the decision. The note is stored with the decision, and a note is required only when a hold is declined. Ravi writes down what was checked.

Approving moves the card from the waiting list to the list of holds in force. While it stands, nothing inside the clinic is deleted, whatever the dates say. A hold in force has a review date, so that somebody has to look at it again and it does not stand by default for ever. Releasing it is possible only with a written reason.

Besides the closing status, the notice shows a second box for the legal hold. It names the issuing firm, the matter and what must be kept. The temporary custodian is accountable for the records while the hold stands, and confirms having read the notice by pressing the button.

The acknowledgement is stored with the hold and shown to the platform administrators. Only the named person can give it. Another member of the clinic who pressed the same button would be refused.

Every few minutes the platform runs a sweep, which is a check for organisations whose time is up. It deletes an organisation only when both periods have ended and no legal hold stands. A sweep ran after the dates moved, and it deleted nothing, because the hold is in force.

Releasing a hold means that the records are no longer protected by it. The box says so, and it asks for a written reason, which is stored with the hold. Releasing does not delete anything by itself, and the platform starts the second period again from the moment of release, so a release made by mistake still leaves 15 days to notice.

The clinic is back in the second stage, with a new deletion date 15 days after the release. No hold stands, so the sweep will delete the clinic when that date arrives.

The sweep deletes everything inside the clinic: its datasets, its sealed versions, its departments, its people and its stored files. A sealed version is a dataset state that can never be edited, and the platform allows its deletion only inside a purge that the database itself has confirmed as due, so nothing else can be removed this way. The clinic’s sign-in accounts are removed too, so nobody can sign in as a person of the clinic any more. Two things stay. One is a short record, which names no contact detail and holds none of the clinic’s records. The other is the audit trail, the list of who was allowed to read what, which is kept for seven years and then removed. Both are filed under a new name made from the old one, so that a later organisation can be called harbour again.