◇ OpenCyber Academy
Postgraduate · Chapter 3 · English

Chapter 3 — Privacy and data protection: specialist evidence

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Privacy and data protection: specialist evidence

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 The necessity question"]
  N2["3.2 Results"]
  N3["3.3 Interpreting evidence"]
  N4["3.4 Evidence culture"]
  N5["Lab — Fraud detection with full GPS, city-level loca"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 The necessity question"]
  N2["3.2 Results"]
  N3["3.3 Interpreting evidence"]
  N4["3.4 Evidence culture"]
  N5["Lab — Fraud detection with full GPS, city-level loca"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 The necessity question]
    |
    v
[3.2 Results]
    |
    v
[3.3 Interpreting evidence]
    |
    v
[3.4 Evidence culture]
    |
    v
[Lab — Fraud detection with full GPS, city-level loca]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) test whether data are necessary with evidence; (2) compare model performance with less data; (3) apply evidence to a minimisation decision.

3.1 The necessity question

Data minimisation requires that data be adequate, relevant and limited to what is necessary, under GDPR Article 5(1)(c) and the necessity principle in LGPD Article 6(III). The fraud team argues that precise GPS is necessary. Priscila asks for evidence. Together with a data scientist she designs a simulation on 20,000 synthetic transactions comparing three rules: full GPS with device novelty, city-level location with device novelty, and device novelty alone. The aim is to measure what precise location adds. All three rules run on the same synthetic transaction history so the comparison is fair.

3.2 Results

The lab shows that full GPS with device and city-level location with device detect the same 43.1% of fraud with the same 90 false alarms. In this synthetic setting GPS adds nothing beyond knowing that a payment comes from an unusual city. Using device novelty alone detects more fraud, 56.4%, but produces 1,572 false alarms, which would block many legitimate customers. City-level location therefore provides the useful signal without precise tracking. Device novelty alone catches more fraud only by flagging huge numbers of customers. The lab output shows that keeping exact coordinates adds no detection over city-level location, so precise tracking cannot be called necessary.

3.3 Interpreting evidence

Priscila is careful. The simulation is synthetic and built on assumptions the fraud team agreed. It shows that GPS may be unnecessary, not that it never helps. She proposes a controlled pilot with real but pseudonymised data in the fraud team's secure environment, comparing city-level and GPS rules for three months. Until results are available, Corvina uses city-level location. She records this as a decision taken under the necessity principle, with the evidence and the plan. The plan includes a review after six months.

3.4 Evidence culture

Dr. Ward points out that Priscila changed the conversation from opinion to evidence. The fraud team, initially resistant, accepts the pilot because it might prove them right. Priscila notes that necessity arguments are stronger when backed by data, and that privacy teams gain credibility when they help test claims rather than simply reject them. She plans to use the same approach for other data-hungry requests. The fraud team now proposes its own tests before asking for new data, and the next request, for contact-list access, is withdrawn after a small trial shows no benefit.

Lab — Fraud detection with full GPS, city-level location or device only

# Does a fraud rule need precise location? Compare detection with full GPS, city-level and no location (synthetic).
import random
r = random.Random(21)
tx = []
for _ in range(20000):
    fraud = r.random() < 0.01
    far = r.random() < (0.70 if fraud else 0.05)          # far from usual city
    newdev = r.random() < (0.60 if fraud else 0.08)       # new device
    odd_gps = far and r.random() < 0.5                    # GPS adds detail only within 'far' cases
    tx.append((fraud, far, newdev, odd_gps))
def score(rule):
    flagged = [t for t in tx if rule(t)]; tp = sum(t[0] for t in flagged); fr = sum(t[0] for t in tx)
    return tp / fr, len(flagged) - tp
for name, rule in [("full GPS + device", lambda t: (t[1] and t[2]) or t[3] and t[2]),
                   ("city-level + device", lambda t: t[1] and t[2]),
                   ("device only", lambda t: t[2])]:
    rec, fp = score(rule); print(f"{name:20s} detects {rec:5.1%} of fraud; false alarms {fp:5d}")

Run with python3 lab_fraud.py. Verified output:

full GPS + device    detects 43.1% of fraud; false alarms    90
city-level + device  detects 43.1% of fraud; false alarms    90
device only          detects 56.4% of fraud; false alarms  1572

Worked example

Priscila shows that GPS and city-level rules both detect 43.1% of synthetic fraud with 90 false alarms, while device-only detection raises false alarms to 1,572, and adopts city-level location pending a pilot.

Synthetic case. Transactions are synthetic; GDPR Article 5(1)(c) and LGPD Article 6 are real.

Errors and limits

Synthetic data reflect assumptions; real pilots may show different results.

Exercises

Synthesis

Chapter 3 tests necessity. Chapter 4 addresses risk and ethics.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →