Twelve Thousand Loyalty Members and a Free Survey Tool
Lumen Retail runs a loyalty programme with 12,000 members. The marketing team wants faster feedback and has built a satisfaction survey in a free, US-hosted form tool. The form asks for full name, national ID number, date of birth, email, and last three purchase amounts; the team says the ID number is needed 'to match records'. When members joined, the consent notice covered 'marketing communications about Lumen products' and said nothing about third-party survey tools or overseas processing. The applicable privacy law requires a comparable standard of protection before personal data leaves the country, and requires breach notification within 72 hours where significant harm is likely. On Tuesday a marketing assistant uploads a test file containing 300 real member records to check the import format, and shares the form link in a public Slack channel. The tool's free tier gives the vendor a licence to use submitted data and sets no retention limit. The campaign goes live in five days.
1. Identify the compliance problems and rank them by urgency.
Read the worked answer
Ranked by what is happening right now:
- 300 real member records are already in an overseas, unassessed tool. That is a live transfer of personal data - including national ID numbers - with no transfer mechanism, no vendor agreement and a publicly shared form link. If the link is open, the exposure may exceed 300 records and the true count is unknown. This is the urgent item.
- No lawful basis for the new purpose or the transfer. Consent covered 'marketing communications about Lumen products'. A feedback survey processed by a third party is a different purpose, and the notice said nothing about overseas processing. Consent that does not cover the processing cannot be stretched to cover it.
- No vendor assessment or data processing agreement. The free tier grants the vendor a licence to use submitted data and sets no retention limit, so the vendor's purposes are now in scope and Lumen cannot answer 'where is it and who can see it'.
- Excessive collection. National ID and date of birth are not needed for a satisfaction survey. A national ID is a high-harm identifier - the key to impersonation and to other services - and should never be the price of a feedback form.
- Poor access control on the form and its results. Sharing in a public Slack channel is broader than any legitimate need.
Urgency tracks harm and irreversibility: the live records first, the transfer mechanism second, consent and design third - though the design problem is what created the other four.
2. What should be done about the 300 uploaded records?
Read the worked answer
Treat it as a suspected personal-data breach until assessed otherwise, and document the assessment either way - that record is what an auditor or regulator will ask for.
Contain:
- Take the form offline or restrict it to authenticated testers; remove the public Slack link and check who clicked it (Slack shows this).
- Delete the uploaded records from the tool and any local exports. If the free tier has no delete function, disable the form and request deletion in writing; a vendor that will not confirm deletion is itself a finding.
- Check whether responses were visible to anyone with the link, and whether the upload sits in a recycle bin, version history or export cache.
Assess:
- Exactly which fields were in the file (ID numbers, birthdates) and how many people, not how many rows.
- Whether the exposure is likely to cause significant harm - national ID plus date of birth usually pushes toward notifiable in regimes that use a harm threshold. Decide with the DPO and legal counsel, and if notification is required the 72-hour clock runs from awareness, not from the end of the investigation.
- Whether the vendor actually received the data or only stored it.
Fix forward: test with synthetic data only, and require a staging environment plus a privacy review before any tool touches production data.
3. Redesign the survey so it can launch and stay compliant.
Read the worked answer
Data minimisation first, because it removes most of the risk cheaply. A satisfaction survey needs a member reference or nothing. Drop the national ID and date of birth entirely - matching can be done on an internal member ID or a one-way hash. Purchase amounts are not needed; ask for a rating and a comment.
Lawful basis and transparency. Either run the survey on a basis that legitimately covers it, or update the consent notice to name third-party survey processing, overseas transfer, retention period and the opt-out - and re-consent where consent is the basis. Do not bury the change in a policy update nobody reads.
Vendor. Move to an enterprise tier with a signed data processing agreement: purpose limitation, no vendor secondary use, deletion on termination, breach notification to Lumen within a defined window, and a data residency option in-region or a documented transfer mechanism with comparable protection. Confirm where data is stored and who can access it.
Access and retention. Results restricted to the marketing analyst group, individual-level responses not exported to shared drives, retention set to something defensible (for example 12 months) with an automated deletion job.
Process. A one-page privacy gate before any tool receives personal data, with two questions: which fields, and where do they go. That is far cheaper than what the team is currently doing.