Dental chain bundling consent, facial recognition and a 15-year-old patient
Hangzhou-based dental chain BrightSmile operates 12 clinics and an app with 400,000 registered patients. New patient registration requires checking one box that says 'I agree to the Privacy Policy and to receive marketing, research and third-party offers.' Facial recognition is used at clinic entrances; the app collects ID numbers, dental X-rays and payment records. BrightSmile offers a 15% discount only to patients who accept marketing messages. A 15-year-old patient, Li, registers alone and books orthodontic treatment. Li later withdraws marketing consent and asks for core appointment reminders to continue; BrightSmile says the contract requires all consent to remain and refuses. It also shares X-rays with a partner clinic for 'quality benchmarking' without separate consent.
1. Evaluate the validity of BrightSmile's registration consent, including the single checkbox, the discount condition and the X-ray sharing.
Read the worked answer
Consent must be voluntary, explicit and informed, and separate consent is required for sensitive PI, third-party provision and changes of purpose. BrightSmile's single checkbox bundles the privacy policy, marketing, research and third-party offers. That is not separate consent for each purpose, and it makes the marketing and third-party elements hard to refuse independently. The 15% discount tied only to marketing acceptance creates a voluntariness problem: consent should not be a condition of core service unless processing is necessary for that service, and marketing is not necessary for dental treatment. Sharing X-rays with a partner clinic for benchmarking is a separate purpose and a third-party provision; it needs separate consent and notice of the recipient, purpose and method. Without that, the sharing lacks a valid Article 23 basis and cannot rely on the original registration consent.
2. Li is 15. What additional requirements apply because the service uses facial recognition, dental X-rays and payment records?
Read the worked answer
Facial recognition is biometric data, dental X-rays are medical-health data, and payment records are financial-account data; all are sensitive PI under Article 28. BrightSmile needs specific purpose, sufficient necessity, strict protection, separate consent under Article 29 and notification of the necessity and impact on rights. For Li, aged 15, the under-14 guardian-consent rule does not automatically apply, so the key issue is whether a 15-year-old can give valid consent; best practice is to involve a guardian, and the clinic should not treat a lone minor's blanket consent as sufficient for sensitive PI. The app also should not condition orthodontic booking on facial recognition if another access method is enough. A DPIA is required for sensitive PI processing.
3. Can Li withdraw marketing consent while keeping appointment reminders? How should BrightSmile respond?
Read the worked answer
Li has a statutory right to withdraw consent under Article 15, and BrightSmile must provide a convenient method. Withdrawal does not retroactively invalidate earlier processing, but it stops processing whose only basis was consent. Marketing must stop. Appointment reminders may continue if they are necessary to perform the treatment contract under Article 13(2), but the clinic cannot rely on a contractual clause that says all consent must remain in order to block withdrawal. Such a clause undermines voluntary consent and is unlikely to be enforceable. Core service can continue on the contract basis; marketing and optional research cannot. The clinic should record the withdrawal and separate contract-necessary processing from consent-based processing.