SoftwareDesignDocument
       CCBY-SA2.5CA2017OpenEffect.
       Electronicversionfirstpublishedatopeneffect.cain2017byOpenEffect. OpenEffectisaCana-
       diannot-for-profitappliedresearchorganizationfocusingondigitalprivacyandsecurity.
       TheCitizenLabattheMunkSchoolofGlobalAffairs,UniversityofTorontocontributedexpertise
       andequipmentinsupportofthisproject. OpenEffectandtheCitizenLabarecollaborativere-
       searchpartners. Together,thetwogroupsengageinresearchthatinvestigatestheintersection
       ofdigitaltechnologiesandhumanrights.
       ThisprojectwassupportedbyagrantfromtheCanadianInternetRegistrationAuthority(CIRA)’s
       CommunityInvestmentProgram.
       DocumentVersion: 1.0
       OpenEffecthaslicensedthisworkunderaCreativeCommonsAttribution-ShareAlike2.5Canada
       license. Allbrandandproductnamesandassociatedlogoscontainedwithinthisreportbelong
       totheirrespectiveownersandareprotectedbycopyright. Undernocircumstancesmayanyof
       thesebereproducedinanyformwithoutthepriorwrittenagreementoftheirowner.
       Information presented in this document is for research and educational purposes only. These
       materialsdonotconstitutesolicitationorprovisionoflegaladvice. OpenEffectmakesnoclaims,
       promises, or guarantees about the accuracy, completeness, or adequacy of the information
       contained in this document. Nothing herein should be used as a substitute for the legal ad-
       viceofcompetentcounsel.
                          –i–
       ABOUTTHISDOCUMENT
       DocumentVersion: 1.0
       Access My Info (AMI) is a web application that helps people learn what data companies have
       collected and stored about them, and how that data is used. AMI guides requesters through
       asimplestep-by-stepprocessthatcreatesaletteraddressedtoaparticularcompanythatre-
       questsaccesstoavarietyofpersonalinformation.
        This documentisprimarilywrittenforsoftwareprofessionalsandresearchersinterestedin
       learning how AMI was designed both conceptually and technically. It describes AMI’s design
       goals, its model of what an access request looks like, its technical design, its implementation
       asawebapplication,andashortguideonhowtodeployAMIinnewjurisdictions. Itconcludes
       with a discussion of the applications’ impact to-date, as well as some limitations and future
       work.
                          –ii–
        ABOUTTHEORGANIZATIONS
        OPENEFFECT
        OpenEffectisaCanadiannot-for-profitthatconductsresearchandadvocacyfocusedonensur-
        ingthatpeople’spersonaldataistreatedsecurelyandaccountably. Itbuildsinteractiveadvo-
        cacytoolstoempowerindividualstolearnaboutandexercisetheirrightsonline. OpenEffect’s
        researchontheadoptionofhasbeenpublishedinpeer-reviewedstudies.
        https://openeffect.ca
        CITIZENLAB
        The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs,
        University of Toronto, Canada. It focuses on advanced research and development at the in-
        tersection of Information and Communication Technologies (ICTs), human rights, and global
        security.
        https://citizenlab.org
        ABOUTTHEAUTHOR
        AndrewHilts
        andrew@openeffect.ca
        AndrewHilts is a researcher working at the intersection of Internet-connected digital services
        and human rights, with a focus on privacy. He runs the Canadian not-for-profit Open Effect,
        throughwhichhecollaborateswiththeCitizenLabattheMunkSchoolofGlobalAffairs,atthe
        UniversityofToronto. HehasspokenateventsorganizedbyorganizationssuchastheCouncil
        onForeignRelations,AccessNow,andUSENIX.
          Mr. Hilts’ work has appeared in numerous academic publications, a wide variety of news
        mediastories, and privacy-enhancing software authored by him has been used by thousands
        of people. His team’s research into the privacy and security of fitness tracking devices led to
        changesinseveralcompanies’applications,and“AccessMyInfo”,atooltohelppeoplecreate
        legalrequestsfortheirpersonaldatafromcompanies,isbeinglocalizedandreleasedinseveral
        different countriesaroundtheworld.
                                 –iii–