Automated GDPR compliance

Nobody has claimed this yet.

*Pain point*: Complying with GDPR requests requires manual work from an admin to collect and/or delete data from Lookit.

*Acceptance criteria*: Lookit complies with GDPR "right to be forgotten," "right to access," "right to portability" by giving participants a way to request deletion of all their data, a copy of all their data, and information about how their data is being used.

*Implementation notes/Suggestions*: We will likely need to differentiate between the "Lookit copy" of data and what researchers have already been given access to; when planning this task, we should schedule a quick conversation with OGC. When deleting data, we may be allowed to retain some record that it existed at all, for researchers' use in reporting rate of these events. We are already in compliance in that we can/will respond to requests appropriately, but for scaling we should make it easier to do this without manually handling requests.

Start by reviewing the API's current handling of participant data and the manual GDPR-request workflow described in the issue. Clarify the retention and researcher-access rules with OGC before defining the request flows. Done means participants can request deletion, access, and portability, with behavior covering all stated acceptance criteria.

Written by the indexing model from the issue text.