Wearable Sleep Data Licensed to a Life Insurer
A wearable company has 2.3 million users across the US and EU. Its privacy notice permits using data for improving the service and for aggregated research. Sleep, resting heart rate, and step data are stored per user alongside birth year, postal code, and device ID. The company proposes licensing a dataset to a life insurer: individual-level predicted sleep-apnea risk scores plus 12 monthly summaries, so the insurer can offer premium discounts to policyholders who opt into a wellness program. An internal analysis suggests about 4% of records could be re-identified by matching to public fitness leaderboards and by step-timing fingerprints; the team argues 96% anonymity is acceptable and that the insurer contract forbids re-identification. EU users are 31% of the base. Legal says the notice probably covers research but not underwriting.
1. Enumerate the ethical problems with the proposal as written.
Read the worked answer
Purpose limitation first: the notice covers service improvement and aggregated research, and underwriting risk scoring is a materially different purpose a reasonable user would not anticipate; the GDPR research provisions do not stretch to commercial insurance pricing. Consent quality next: opting into a wellness program to obtain a discount is not freely given when declining raises the effective premium, and it is most coercive for people with sleep apnea, shift workers, and anyone the model scores badly.
Re-identification: the 4% figure and the contractual ban are being treated as controls, but a contract does not protect data subjects, and 4% of 2.3 million is roughly 92,000 people. Distributive fairness: the insurer and the company capture the value, users receive a discount framed as a reward, and the people most harmed may be those whose data is missing or unreliable. Finally, the EU cohort answers to supervisory authorities that scrutinize secondary commercial use closely, and a US-first rollout does not contain that exposure.
2. Is the dataset anonymous? Evaluate the 96% argument.
Read the worked answer
No, and the framing is the trap. A residual re-identification rate is not a budget you can spend down; risk is contextual and accumulates with whatever auxiliary data the recipient holds, and an insurer holds claims, prescriptions, and address history. The 4% estimate also ignores composition: attacks target outliers, so harm concentrates in a non-random subset, and step-timing fingerprints are exactly the quasi-identifier that survives naive de-identification.
Legally, pseudonymized data remains personal data under GDPR while re-identification by anyone, including the recipient, remains reasonably likely - and the recipient is the one party with the strongest incentive and best auxiliary data. Note the internal contradiction: the product is individual risk scores plus monthly summaries, so its value depends on being individual; true anonymization would destroy it. The honest description is a transfer of personal data and requires a lawful basis, not an anonymity claim.
3. What conditions would make a narrower version of this proposal defensible?
Read the worked answer
A fresh, specific opt-in naming the insurer, separate from the terms of service, with withdrawal as easy as consent and no detriment for declining. Restructure pricing so the baseline premium is not inflated to fund the discount - that removes the coercion at its root. Minimize: banded risk categories computed by the wearable company, never raw sleep or heart-rate traces, never postal code, and no individual-level feed into underwriting or claims decisions.
Add independent ethics review and a published DPIA covering the EU cohort, plus controls that actually bind: third-party audit, deletion and onward-transfer limits, and a contractual bar on using the data in eligibility or claims adjudication. Show a benefit returned to users rather than only to the company. Test for disparate impact on people whose data is missing or unreliable, and publish the result. If the insurer insists on individual-level underwriting use, the answer is no - the consent cannot be free, and the purpose cannot be reconciled with what users agreed to.