The Free App and the Consent Problem
A community sports club wants to use a free third-party app to collect player health and injury data (injuries, medication, pregnancy status for a netball program) so coaches can manage training loads. The app's terms state that data may be shared with 'partners' and stored on servers overseas; the club has not read the privacy policy in full. Players are asked to tick a box at registration that says 'I agree to the club's terms'. The club's registration form is a single paper sheet; the box is not separated from general club membership consent, and players under 18 are registered by a parent. A coach has already been given login access to view all players' records, including the pregnancy field, because 'it might affect training'.
1. Identify the legal, ethical and privacy failures in this arrangement and explain the risk each creates for the club.
Read the worked answer
Consent failures. Bundled consent - one tick covering membership and sensitive health data - is not informed consent for health information. Consent must be specific, current, and able to be withdrawn. Minors add a layer: a parent may consent to membership, but health data about a 16-year-old raises questions of the young person's own capacity and privacy expectations.
Sensitive information. Injury, medication and pregnancy status are sensitive personal information attracting higher protection. Collecting pregnancy status is especially risky: it is highly sensitive, easily misused, and arguably not necessary for training-load management. The principle of data minimisation says collect only what is needed.
Overseas storage and third-party sharing. The app's terms permit sharing with partners and overseas storage. The club has an obligation to know where data goes and to disclose that to players; 'we didn't read the policy' is not a defence. If overseas law offers lesser protection, the club remains accountable.
Access control failure. Giving a coach blanket access to all records, including pregnancy, breaches least-privilege. Coaches need training-load data, not medical detail. This creates a real risk of discrimination and a serious breach if the login is shared or lost.
Ethical dimension. Even where legal, using health data to shape selection or load without the player's knowledge is a misuse of power in a community setting. The club should drop the pregnancy field, separate consent, restrict access by role, and confirm the app's data handling before proceeding.
2. Design a revised data collection and access approach the club could adopt before the season starts.
Read the worked answer
Collection:
- Separate the health-data consent from membership consent, with a plain-language statement of what is collected, why, who sees it, where it is stored, and how to withdraw.
- Apply data minimisation: remove the pregnancy field entirely; record only injury status and training restrictions needed for load management.
- For under-18s, require parent/guardian consent and give the young person an age-appropriate explanation and a say.
- Set a retention period (e.g., end of season plus one year) and a deletion process.
Access:
- Role-based access: coaches see only training restriction flags, not diagnoses; the physiotherapist or club medical officer sees clinical detail; the committee sees aggregate counts only.
- Individual logins, no shared accounts, and an access log reviewed monthly.
Vendor due diligence:
- Read the privacy policy; confirm whether data can be exported and deleted, where it is hosted, and whether it is used for advertising or model training.
- If the vendor cannot meet these conditions, use a spreadsheet with restricted access instead.
Governance:
- Nominate a privacy contact, document decisions, and run a short briefing so coaches understand why they cannot see everything. This converts an ad hoc arrangement into an accountable one.