Chapter 16 — Privacy and data protection: methods II
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 The feature"]
N2["16.2 Assessment"]
N3["16.3 Consultation"]
N4["16.4 Decision"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 The feature"]
N2["16.2 Assessment"]
N3["16.3 Consultation"]
N4["16.4 Decision"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 The feature]
|
v
[16.2 Assessment]
|
v
[16.3 Consultation]
|
v
[16.4 Decision]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) carry out a data protection impact assessment for a new feature; (2) consult stakeholders; (3) record decisions.
16.1 The feature
Quayside plans a feature that uses heart-rate trends to suggest rest days. Aisha recognises that systematic processing of health data may require a data protection impact assessment under GDPR Article 35. WP29 guidance WP248 lists criteria such as sensitive data and data at large scale. The product team sees the feature as a simple convenience, but Aisha points out that it analyses health data from thousands of members over long periods and makes suggestions that could influence behaviour. Two WP248 criteria clearly apply, and the guidance suggests that meeting two criteria usually means an assessment is needed before the feature is built and released.
16.2 Assessment
She describes the processing, assesses necessity and proportionality, and lists risks: inaccurate suggestions, inference of illness, and sharing with insurers. Mitigations include on-device processing, no sharing and clear explanations. Necessity asks whether the feature needs full heart-rate histories or only recent trends; Aisha finds that fourteen days of data are enough. Proportionality asks whether the benefit justifies the intrusion. The risk of inferring illness is real, because irregular readings could suggest a heart condition. Processing on the member's phone means raw histories never need to leave the device, which removes several risks at once.
16.3 Consultation
Aisha consults trainers, five member volunteers and the data protection officer. Members want an easy off switch, which is added. Trainers worry that members might skip sessions on the app's advice without understanding why. The data protection officer asks how members will learn what the feature does and how to switch it off. Volunteers want clear wording, no surprise notifications and assurance that their insurer will never see the data. Aisha records each concern and the design response in the assessment document.
16.4 Decision
The data protection officer signs off with conditions. Mr. Reilly notes that the assessment shaped the design rather than just documenting it. The conditions are that the feature is off by default, explained in plain words, processed on the device, and reviewed after three months of use. The assessment is stored with the product documentation, so future changes trigger a review. Mr. Reilly points out that a good assessment records alternatives considered and rejected, not only the final design choice. Here, cloud processing was the rejected alternative.
Worked example
Aisha runs an impact assessment for rest-day suggestions, chooses on-device processing, adds an off switch after consultation and records sign-off.
Synthetic case. The feature is synthetic; GDPR Article 35 and WP248 are real.
Errors and limits
Assessments must be updated if the feature changes.
Exercises
- EX046 — DPIA trigger. Why does the feature need an assessment? Rubric: 3 = systematic processing of health data at scale;; 2 = mentions health;; 1 = vague;; 0 = none.
- EX047 — Key mitigation. Name one mitigation. Rubric: 3 = on-device processing, no sharing, clear explanations;; 2 = one;; 1 = vague;; 0 = none.
- EX048 — Consultation result. What did members ask for? Rubric: 3 = an easy off switch;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 16 (chapter 16 of 30)
← Chapter 15 · Course chapter index · Chapter 17 →
Continue to the next authored lesson.