◇ OpenCyber Academy
Technologist · Chapter 12 · English

Chapter 12 — Privacy and data protection: data flows

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Privacy and data protection: data flows

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 SDKs"]
  N2["12.2 Results"]
  N3["12.3 Recommendations"]
  N4["12.4 Follow-up"]
  N5["Lab — SDK data flows and coverage"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 SDKs"]
  N2["12.2 Results"]
  N3["12.3 Recommendations"]
  N4["12.4 Follow-up"]
  N5["Lab — SDK data flows and coverage"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 SDKs]
    |
    v
[12.2 Results]
    |
    v
[12.3 Recommendations]
    |
    v
[12.4 Follow-up]
    |
    v
[Lab — SDK data flows and coverage]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) inspect SDKs embedded in an app; (2) check notice and contract coverage; (3) recommend changes.

12.1 SDKs

Quayside's app embeds five software development kits. Aisha lists what each receives using a test build and network inspection with synthetic accounts. SDKs are third-party code that can collect data without the app team noticing. An SDK is a library supplied by another company that the app includes to provide a feature such as crash reports or chat. Aisha builds a test version of the app, signs in with synthetic members and records network traffic while using workouts, classes and chat. She then lists each SDK, the fields it receives and whether the notice and contracts cover it.

12.2 Results

The lab shows that the crash reporter, analytics and chat support SDKs are covered by the privacy notice and contracts. The ad network receives an advertising identifier, heart-rate zone and location, and is neither in the notice nor under contract. Social login lacks a contract. Heart-rate data flowing to advertisers is the most serious finding. The heart-rate zone is derived from health data, and sending it with an advertising identifier and location lets an ad network build a profile of a member's fitness and movements. The developers say the SDK came bundled with a promotions feature two years ago and nobody reviewed its data collection. The other gaps are smaller but still need contracts and notices to be fixed.

12.3 Recommendations

Aisha recommends removing the ad network SDK, signing a contract with the social login provider and updating the notice. She also recommends a rule that no SDK is added without privacy review. She writes the recommendations with owners and dates. The app team owns removing the SDK, procurement owns the social login contract and the data protection officer owns the notice update. She also asks the app team to keep a list of every SDK with its version and purpose in the repository, so future reviews start from an accurate record rather than memory.

12.4 Follow-up

The app team removes the ad SDK in the next release. Aisha tests again and confirms that no heart-rate data leave to advertisers. Mr. Reilly notes that SDK reviews should be repeated for every release. The retest uses the same synthetic accounts and steps, so results can be compared directly. Traffic to the ad network has disappeared, and the social login contract is signed within a month. Aisha adds an SDK review step to the release checklist, with a simple question for developers: does this release add or update any third-party library that sends data off the device?

Lab — SDK data flows and coverage

# Fitness app: what does each embedded SDK receive, and is it covered by the privacy notice and a contract?
sdks = [("crash reporter", ["device model", "app version"], True, True),
        ("analytics", ["member id", "screen views", "workout type"], True, True),
        ("ad network", ["advertising id", "heart rate zone", "location"], False, False),
        ("chat support", ["member id", "name", "messages"], True, True),
        ("social login", ["email", "name"], True, False)]
for name, data, notice, contract in sdks:
    issues = ([] if notice else ["not in notice"]) + ([] if contract else ["no contract"])
    health = any(d in ("heart rate zone",) for d in data)
    print(f"{name:15s} {', '.join(data):40s} {'OK' if not issues else '; '.join(issues)}{' [HEALTH DATA]' if health else ''}")

Run with python3 lab_flows.py. Verified output:

crash reporter  device model, app version                OK
analytics       member id, screen views, workout type    OK
ad network      advertising id, heart rate zone, location not in notice; no contract [HEALTH DATA]
chat support    member id, name, messages                OK
social login    email, name                              no contract

Worked example

Aisha finds the ad network receiving heart-rate zone and location without notice or contract and social login without a contract, and the ad SDK is removed.

Synthetic case. SDKs are synthetic.

Errors and limits

Network inspection may miss data sent later or in batches.

Exercises

Continue studying — lesson 12 (chapter 12 of 30)

← Chapter 11 · Course chapter index · Chapter 13 →

Continue to the next authored lesson.