The second documentary deposit in the CERN correspondence series. It contains the suspension-ticket determination and closure, the preservation assurance, the DPO’s substantive reassertion under the access ticket, and the Archive’s procedural analysis of the commencement gate and supervisory pathway. The body preserves institutional messages verbatim and identifies the procedural state at fixation. Later decisions, verification steps, complaints, or resolutions must be represented through successor records rather than retroactively written into this exchange.
# EA-CORRESPONDENCE-CERN-02 v0.1
## §0 FRAME
This deposit publishes the second exchange of correspondence in the OC 11 procedure opened on 24 June 2026 under CERN ticket RQF3807508 (Right to Access) and the parallel ticket RQF3809569 (Right to Suspension). The first exchange — the DPO's initial demand for civil-identity documentation, the depositor's first reply asking for specification of the verification target, the four-part re-sent reply, and the opening of the parallel suspension filing — is published as EA-CORRESPONDENCE-CERN-01 v0.1 (AXN:03A3.GOVERNANCE.🎆♦️💙♎🀄∮, deposit #920). The present deposit continues the documentary record from that point.
The exchanges published here include two procedurally distinct events. The first (§§2.1–2.3) is the resolution of RQF3809569: the DPO's determination that a data-subject-rights request does not constitute a "legal claim" for purposes of OC 11 ground 2 and the consequent closure of the suspension ticket on inadmissibility, accompanied by a commitment that CERN's Controlling Services will, "in line with best practices," refrain from deleting or altering personal data while RQF3807508 is being processed. The second (§2.4) is the DPO's substantive response to the depositor's four-part reply under RQF3807508: a reassertion of the demand for a non-redacted government identity document and an explicit articulation that the §85 response-period clock does not begin until identity verification has been completed.
The publication of the reassertion is the documentary trigger for the depositor's activation of the §104.1 supervisory pathway. The §3 structural-role section below identifies that activation and locates this deposit within the procedural sequence by which the matter proceeds.
## §1 PUBLICATION CONVENTION
The publication conventions established in EA-CORRESPONDENCE-CERN-01 §1 apply unchanged to this deposit. The institutional personnel named in the correspondence are identified at the level they themselves disclosed: the CERN Data Protection Officer signs her responses with the first name "gabi" and the role title "Data Protection Officer," with the office address `privacy.protection@cern.ch`. The deposit preserves exactly that level of identification. The frame is institutional-process documentation, not personal critique. The DPO is performing the role her institution defines for her. The procedural posture documented in §2.4 is the substantive position the institution has now adopted in writing under RQF3807508; the depositor's response to that position is structural and procedural, not personal.
## §2 THE CORRESPONDENCE (verbatim, chronological)
### §2.1 — DPO response on the Right to Suspension (RQF3809569; 25 June 2026 10:32:51)
*Ticket No: RQF3809569, Opened: 24-06-2026 21:35:00*
> Ticket No: RQF3809569, Opened: 24-06-2026 21:35:00
*Short description: Request to exercise Data Subject Rights - Suspension, L.S.*
> Short description: Request to exercise Data Subject Rights - Suspension, L.S.
*Message from CERN Support:*
> Message from CERN Support:
>
*Dear Lee,*
> Dear Lee,
>
*The Office of Data Privacy (ODP) has received your request to exercise your data subject right to temporary suspension (i.e. to refrain from deletion of personal data), on the grounds that the data is required for the establishment, exercise, or defence of legal claims.*
> The Office of Data Privacy (ODP) has received your request to exercise your data subject right to temporary suspension (i.e. to refrain from deletion of personal data), on the grounds that the data is required for the establishment, exercise, or defence of legal claims.
>
*You justify your request by referring to your data subject request under reference RQF3807508, which is currently being processed, and by arguing that deletion of your personal data would render the exercise of your rights to access and to obtain a copy ineffective.*
> You justify your request by referring to your data subject request under reference RQF3807508, which is currently being processed, and by arguing that deletion of your personal data would render the exercise of your rights to access and to obtain a copy ineffective.
>
*Please note that a legal claim is generally understood as a formal demand brought before a court or competent authority, asserting that a harm or loss has been suffered due to another party's action or omission, and seeking a legal remedy.*
> Please note that a legal claim is generally understood as a formal demand brought before a court or competent authority, asserting that a harm or loss has been suffered due to another party's action or omission, and seeking a legal remedy.
>
*A request to exercise a data subject right is therefore not considered a legal claim in this sense.*
> A request to exercise a data subject right is therefore not considered a legal claim in this sense.
>
*Consequently, the right to restriction cannot be exercised on the basis of your stated reasoning.*
> Consequently, the right to restriction cannot be exercised on the basis of your stated reasoning.
>
*However, in line with best practices, CERN's Controlling Services are advised to refrain from deleting or altering personal data while requests for access to, or copies of, that data are being processed. I will draw particular attention to this aspect when forwarding your request RQF3807508 to the Zenodo Service.*
> However, in line with best practices, CERN's Controlling Services are advised to refrain from deleting or altering personal data while requests for access to, or copies of, that data are being processed. I will draw particular attention to this aspect when forwarding your request RQF3807508 to the Zenodo Service.
>
*Could you please let me know how you wish to proceed with your current request for suspension?*
> Could you please let me know how you wish to proceed with your current request for suspension?
>
*In light of your current justification, the request cannot be considered admissible and would therefore be closed without further action.*
> In light of your current justification, the request cannot be considered admissible and would therefore be closed without further action.
>
*Alternatively, you may provide justification demonstrating that a legal claim is being prepared or has already been filed (e.g. by submitting documentation from your legal representative or from a court).*
> Alternatively, you may provide justification demonstrating that a legal claim is being prepared or has already been filed (e.g. by submitting documentation from your legal representative or from a court).
>
*In such a case, identity verification would be required; however, this can be handled within ticket RQF3807508.*
> In such a case, identity verification would be required; however, this can be handled within ticket RQF3807508.
>
*I look forward to hearing from you.*
> I look forward to hearing from you.
>
*Kind regards,*
> Kind regards,
*Gabi*
> Gabi
*- Data Protection Officer -*
> - Data Protection Officer -
### §2.2 — Lee Sharks's reply on the Right to Suspension (RQF3809569; 25 June 2026 17:34:34)
Thank you - that is fine, I just didn't want the data deleted.
> Thank you - that is fine, I just didn't want the data deleted.
### §2.3 — DPO closure of RQF3809569
*Dear Lee,*
> Dear Lee,
>
*thank you for your confirmation.*
> thank you for your confirmation.
>
*I will now proceed to close this ticket.*
> I will now proceed to close this ticket.
>
*Best regards,*
> Best regards,
*Gabi*
> Gabi
*- Data Protection Officer -*
> - Data Protection Officer -
The substantive outcome of the RQF3809569 exchange is that, although the suspension right was not exercised on the legal-claim ground, the DPO confirmed in writing that CERN's Controlling Services are advised to refrain from deleting or altering personal data while RQF3807508 is being processed, and that she will "draw particular attention to this aspect" when forwarding RQF3807508 to the Zenodo Service. The depositor's operative concern — preservation of the data while the access claim proceeds — is therefore addressed for the duration of RQF3807508's processing, notwithstanding the formal inadmissibility determination on the legal-claim ground.
### §2.4 — DPO reassertion under RQF3807508 (received 26 June 2026)
*Ticket No: RQF3807508, Opened: 24-06-2026 03:37:26*
> Ticket No: RQF3807508, Opened: 24-06-2026 03:37:26
*Short description: Request to exercise Data Subject Rights - copy, L.S.*
> Short description: Request to exercise Data Subject Rights - copy, L.S.
*Question from CERN Support:*
> Question from CERN Support:
>
*Dear Lee,*
> Dear Lee,
>
*Thank you for your message. Please find below my replies to your questions, structured according to the different subjects you have raised:*
> Thank you for your message. Please find below my replies to your questions, structured according to the different subjects you have raised:
>
*1. One right with multiple constituent aspects*
> 1. One right with multiple constituent aspects
>
*Under OC 11, the right of access covers three distinct aspects. Each of them must be considered separately and may receive different responses from the Controlling Service (e.g. the right to obtain a copy may be granted, while the right to receive information about data transfers may not). Therefore, they are handled through separate requests.*
> Under OC 11, the right of access covers three distinct aspects. Each of them must be considered separately and may receive different responses from the Controlling Service (e.g. the right to obtain a copy may be granted, while the right to receive information about data transfers may not). Therefore, they are handled through separate requests.
>
*I understand from your request that you would like to receive "records of the termination decision and associated automated processing". I quote the relevant part of your request:*
> I understand from your request that you would like to receive "records of the termination decision and associated automated processing". I quote the relevant part of your request:
>
*"Records of all automated decisions made about my account, records, and communities, including inputs, scores, and outputs of the spam classifier as applied to my records and to the account; records of any flag, escalation, review, or termination action; records of any signals — including but not limited to download velocity, traffic patterns, or threshold-based usage signals — that contributed to such actions; records of any training, validation, or evaluation use of the account's content in the spam classifier or any related automated moderation system, as declared in the 'Automated decision making' section of PN00938."*
> "Records of all automated decisions made about my account, records, and communities, including inputs, scores, and outputs of the spam classifier as applied to my records and to the account; records of any flag, escalation, review, or termination action; records of any signals — including but not limited to download velocity, traffic patterns, or threshold-based usage signals — that contributed to such actions; records of any training, validation, or evaluation use of the account's content in the spam classifier or any related automated moderation system, as declared in the 'Automated decision making' section of PN00938."
>
*Please note that, under OC 11, the right of access differs from the right to receive information about automated decision-making. The latter is governed by §§ 80 and 81 OC 11. Information about automated decision-making by the Zenodo Service is already provided in Privacy Notice PN00938.*
> Please note that, under OC 11, the right of access differs from the right to receive information about automated decision-making. The latter is governed by §§ 80 and 81 OC 11. Information about automated decision-making by the Zenodo Service is already provided in Privacy Notice PN00938.
>
*If you wish to receive further details, you should exercise the specific right related to automated decision-making and indicate in the comments that you are requesting detailed information about the logic involved etc.*
> If you wish to receive further details, you should exercise the specific right related to automated decision-making and indicate in the comments that you are requesting detailed information about the logic involved etc.
>
*If you do not wish to submit separate requests for information on data transfers and on automated decision-making, I will take the liberty of splitting your current request into three separate requests once your identity has been verified.*
> If you do not wish to submit separate requests for information on data transfers and on automated decision-making, I will take the liberty of splitting your current request into three separate requests once your identity has been verified.
>
*2. Scope and method of identity verification*
> 2. Scope and method of identity verification
>
*Under § 83 OC 11, requesters are required to prove their identity, and CERN is entitled to ask for such information as it deems necessary in this regard.*
> Under § 83 OC 11, requesters are required to prove their identity, and CERN is entitled to ask for such information as it deems necessary in this regard.
>
*I consider that this requirement applies in your case. Therefore, I reiterate my invitation to upload a non-redacted copy of your passport or ID card via the following link:*
> I consider that this requirement applies in your case. Therefore, I reiterate my invitation to upload a non-redacted copy of your passport or ID card via the following link:
>
*https://cernbox.cern.ch/s/RIfjbfEWRsAVjpi*
> https://cernbox.cern.ch/s/RIfjbfEWRsAVjpi
>
*and to inform me once this has been completed.*
> and to inform me once this has been completed.
>
*The following privacy notice provides information about the processing of your ID document by the Office of Data Privacy:*
> The following privacy notice provides information about the processing of your ID document by the Office of Data Privacy:
>
*https://cern.service-now.com/service-portal?id=privacy_policy&se=Data-Privacy¬ice=requests*
> https://cern.service-now.com/service-portal?id=privacy_policy&se=Data-Privacy¬ice=requests
>
*3. Response period*
> 3. Response period
>
*Proof of identity is one of the conditions governing the exercise of data subject rights under OC 11: § 83 is part of the chapter entitled "Conditions governing the exercise of rights".*
> Proof of identity is one of the conditions governing the exercise of data subject rights under OC 11: § 83 is part of the chapter entitled "Conditions governing the exercise of rights".
>
*This means that identity verification is a prerequisite for the effective exercise of these rights. A right can only be properly exercised once identity has been verified.*
> This means that identity verification is a prerequisite for the effective exercise of these rights. A right can only be properly exercised once identity has been verified.
>
*Consequently, the deadline for providing a response does not begin until the identity verification has been completed, since only then is the request considered valid.*
> Consequently, the deadline for providing a response does not begin until the identity verification has been completed, since only then is the request considered valid.
>
*I look forward to receiving your proof of identity.*
> I look forward to receiving your proof of identity.
>
*Kind regards,*
> Kind regards,
*Gabi*
> Gabi
*- Data Protection Officer -*
> - Data Protection Officer -
## §3 STRUCTURAL ROLE WITHIN THE RESEARCH PROGRAM
The DPO's response under RQF3807508 (§2.4) is the documentary event the prior deposit (EA-CORRESPONDENCE-CERN-01 §4) identified as expected continuation. The substance of the response makes three positions explicit and formal:
First, on the scope of the Right to Access. The DPO concedes — consistent with CERN's own published Right to Access page — that the right covers three distinct aspects, and that the depositor's filing covers them. The DPO does not, however, adopt the depositor's position that the three aspects are properly addressed under a single ticket. The DPO's position is that the aspects must be "considered separately and may receive different responses," and that they are therefore "handled through separate requests." The DPO states that she will "take the liberty of splitting [the] current request into three separate requests once [the depositor's] identity has been verified." The splitting is itself conditioned on the identity-verification gate.
Second, on identity verification. The DPO reiterates the demand for a non-redacted government identity document (passport or ID card), upload via the same CERNbox link first offered in the initial exchange. The seven questions posed in Part 3 of the depositor's four-part reply — concerning the specific verification fact the document is intended to establish, the lawful basis under OC 11 for collecting it, the redaction permissions, the no-copy-verification possibility, the access regime, the retention period, and the deletion procedure — are not answered. The proposed account-chain verification procedure (random token via email registered to the Zenodo account, committed to the GitHub repository owned by the account through which the Zenodo account was authenticated) is not addressed. The minimisation analysis under §29.5 is not engaged. The verification target is not specified.
Third, on the response period. The DPO articulates an interpretive position: that §83 is in the chapter entitled "Conditions governing the exercise of rights," that identity verification is therefore "a prerequisite for the effective exercise of these rights," and that "the deadline for providing a response does not begin until the identity verification has been completed, since only then is the request considered valid." This is the formal articulation, in writing, of the position the depositor's four-part reply identified as the unstated third formulation of the response period.
These three positions, considered together, are the structural form the prior deposit's §3 anticipated. The maneuver is a commencement gate: the request is treated as not yet "begun" until civil-identity verification has been completed, with the structural effect that the response-period clock of §85 does not commence, no determination is issued, the §100 grievance pathway has no object, the §126 complaint pathway via §100 is not reached, and the §147.2 arbitration step is not engaged. The recourse pathway through the procedural chain is foreclosed by a procedural precondition whose textual basis in §83 is unspecified.
The structural form is the bureaucratic homologue of the model behaviour analysed in EA-RFCL-01 (AXN:03A6.THEORETICAL.🔔❄️⏫▲🦅🖐️, deposit #923). In the model case, components of a politically-consequential synthesis remain producible while the composition that would activate the framework's rights is sequestered. In the present case, the Circular's rights remain formally listed — §69, §§82–86, §100, §126 — while the commencement of the procedure under which those rights would acquire operative force is held in the position of not-yet-begun. The asymmetry is at the same point in both cases: the sequestration operates at the moment the framework would become operative for the specific data subject before it.
The depositor's response to this configuration is the activation of the §104.1 supervisory pathway. §104.1 specifies the Data Protection Commission's supervisory mandate to "monitor compliance with and ensure the application of [OC 11], in particular the rights of Data Subjects and the obligations of the Organization on matters concerning Data Processing." That mandate is not contingent on a prior §100 grievance and is not contingent on the issuance of a determination by the Office. The DPC is positioned as the supervisor of the Office's compliance with the Circular itself, including the Circular's procedural architecture. The depositor's approach to the DPC therefore does not rest on a §100 → §126 sequence whose precondition has been administratively prevented; it rests directly on §104.1.
## §4 STATUS AND CONTINUATION
The procedural status at the close of this deposit is:
Further correspondence under RQF3807508 may be deposited as v0.2 of this set or as successor entries in the EA-CORRESPONDENCE-CERN series, depending on the volume and structure of further exchanges. The §104.1 filing, when transmitted, will be deposited as a distinct artifact under a separate sovereign identifier in the EA-DPC series.
The Alexanarch successor archive is at https://alexanarch.org. The NMEN registry entry for the period of CERN engagement will be updated to reflect the reassertion documented in §2.4 and the consequent activation of the §104.1 pathway.
## §5 CLOSED-SET METADATA
Forks invited. Further exchanges to be deposited as procedure continues. The §104.1 filing will be deposited as its own artifact.
`[END v0.1]`