Process for security exception to access private data

[wwarriner]

If the researcher is a supervisor requesting their staff or student's data, use the full procedure below.

If the researcher wants to hand off data to their supervisor, start at "create a task..."

1. Before the researcher requests the approval, make sure to point them to https://docs.rc.uab.edu/data_management/research_data_responsibilities/#security-exceptions-for-accessing-former-uab-personnel-data and let them know to request /data/user, /home/ and /scratch/ all at once, as appropriate.
2. Receive approval for the security exception from Enterprise Information Security in the form of an RITM assigned to our "Assignment Group".
3. Create a TASK describing what needs to be done and notify rc-ops-team.
4. Copy the requested storage to another storage location and grant access to the requester or their delegate. We won't grant access to multiple people. If multiple people need access, the single requester/delegate can copy the data out to another location where those others can view it.
   1. Copy requested directories (ideally this will be all of /data/user/$USER, /home/$USER/, and /scratch/$USER) to /rstore/share/RITM########/. Simply copy the full paths.
   2. Recursive chown $requester on the RITM# directory.
   3. Recursive chmod u+rwx for directories and chmod u+rw for files starting at .../RITM#/.
5. Notify the user of the path and give them 2 calendar weeks (??) before we delete, and request notification when they have completed their work. (Can we automate access revocation with a single cron trigger, is it worth it? Happy to document this.)
6. Delete the copy when we hit the time limit or when they notify us.

[iam4tune]

Canned response for a scenario where a user cannot copy data from their personal account to another location (e.g., shared location, project directory), and we are unable to restore access to their account. In this scenario, the requester is usually not the owner of the destination location; therefore, approval from the destination location owner must be obtained before the transfer can be initiated.

"Your request serves as notice for us to transfer your files into the project directory you provided. Since your BlazerID/account will be deleted on MM DD YYYY, you may not receive a notification once the transfer is complete. I have included your supervisor (owner of the project directory) in this request so they are aware and can provide final approval for this file transfer.

As soon as that approval is received, I will submit a request to our Ops team and update this ticket once the transfer is complete."