The fitness app that bundled its consents
PulseRun is a Shenzhen-built fitness app with 2.3 million registered users in mainland China. On the single sign-up screen there is one check box reading: 'I agree to the User Agreement, the Privacy Policy, and to sharing my data with our partners.' The app collects step counts, continuous GPS routes, continuous heart rate, menstrual-cycle logs, and the phone's contact list, used for 'friend matching'. Device identifiers and location are sent to six advertising partners. Another 340,000 users were enrolled by their employer, a Shenzhen logistics firm, under a 'corporate wellness' package; the employer receives a monthly report listing each named employee's heart rate and body mass index. 47,000 users are 12 or 13 years old. In February a user asks to withdraw her consent to advertising, and the app replies that withdrawal means her whole account, including her training history, will be deleted within 24 hours.
1. Assess the validity of the sign-up consent and identify every defect the company must fix.
Read the worked answer
The consent is not valid consent. It fails on at least four grounds.
- Bundling destroys voluntariness (Article 14). One box covering the user agreement, the privacy policy and third-party sharing means the user cannot consent to one purpose without the others. Consent must be freely given, and Article 14 requires separate consent where the law demands it.
- Missing separate consent for third-party sharing (Article 23). Providing data to the six advertising partners requires separate consent plus notice of each recipient's name and contact details, the purpose and method of processing, and the categories of data. 'Our partners' is not notice.
- Missing separate consent for sensitive information (Article 29). Heart rate, menstrual-cycle logs and continuous GPS trajectories (whereabouts) are sensitive personal information under Article 28. Article 30 also requires notice of the necessity of the processing and its impact on rights.
- Missing guardian consent for minors (Article 31). Personal information of children under 14 is treated as sensitive; it needs guardian consent and dedicated processing rules. 47,000 users are in that band.
- Contact-list upload probably fails the Article 6 minimum-necessity test - 'friend matching' can work through user-initiated invitations rather than wholesale address-book exfiltration. Article 16 also bars refusing the service to a user who declines consent to processing that is not necessary for it.
Fix: split into granular, purpose-specific opt-ins; add a pre-consent notice layer; build a children's mode; delete the contact upload or make it optional.
2. The employer receives named heart-rate and BMI reports on 340,000 enrolled employees. Is that permissible?
Read the worked answer
Almost certainly not as designed, and the employer's consent does not cure it.
- The legal basis is wrong. Consent from an employee to an employer is rarely voluntary, because of the subordination in the relationship. Article 13(2) (necessity for a contract to which the individual is a party) and Article 13(3) (necessary for human resources management under lawfully formulated labour rules or a collective contract) are the realistic bases - and Article 13(3) requires validly adopted internal rules and a genuine management necessity.
- Health data is sensitive. Heart rate and BMI trigger Articles 28–30: specific purpose, sufficient necessity, strict protection, separate consent and enhanced notice. Individual-level health surveillance of a workforce for wellness purposes is hard to defend as necessary when aggregated reporting would achieve the same aim.
- Minimum necessity under Article 6. The employer needs to know whether the programme works, not which named employee has an elevated resting heart rate. Named health reporting also creates discrimination risk.
- PulseRun's role. It has become a handler for this purpose and must have its own basis and notice, not rely on the employer's.
Recommended redesign: aggregate-only employer dashboards with a minimum cohort size (for example, no report for a team of fewer than 10), employee-initiated opt-in, no named health metrics, and a written purpose limitation clause in the corporate contract.
3. Evaluate the reply given to the user who withdrew consent to advertising.
Read the worked answer
The reply is a punitive response dressed as policy, and it contravenes the law.
- Article 15 gives a right to withdraw consent. Withdrawal must be possible, and the method must be as easy as giving consent - not hidden behind an email to support.
- Article 15 also says withdrawal does not affect the lawfulness of processing carried out before the withdrawal. So the company cannot retroactively treat the past 18 months of advertising processing as unlawful, and equally cannot claim the withdrawal invalidates the account.
- Conditioning continued service on advertising consent breaches Article 16. The handler may not refuse to provide products or services unless the processing of the information is necessary for the service. Advertising identifiers are not necessary for a fitness tracker.
- Threatening deletion of training history is effectively a penalty, and it goes further than Article 47 permits: deletion applies to the data whose processing purpose is achieved, consent is withdrawn, or processing is unlawful - not to unrelated data used to deliver the service.
Correct handling: accept the withdrawal, stop advertising processing immediately, offer the option of keeping an ad-free paid or limited account, delete only the advertising identifiers and derived profiles, tell the user what was deleted and what was retained, and log the request and the response for evidential purposes. Article 50 requires a convenient request channel, an explanation when a request is refused, and acceptance of complaints.