Heart-rate data, a sponsor, and 210 teenagers
A community gym in Hamilton runs a subsidised fitness programme for 210 rangatahi aged 13–17. The gym's app pairs with a wristband recording heart rate every 30 seconds, plus session attendance and a self-reported wellbeing score. Data is stored in an Australian cloud service. The gym's volunteer IT helper has built a dashboard and wants to send the sponsor - a sports nutrition company - a spreadsheet of ‘anonymised’ results: age, suburb, average heart rate and wellbeing score. The gym also wants to email weekly progress reports to caregivers. Thirty-eight participants are 13 or 14. A parent has complained after a gym newsletter published a leaderboard showing first names and average heart-rate zones. The gym has no privacy officer and no written policy.
1. Assess whether the proposed sponsor spreadsheet is genuinely anonymised. What would you need to do before releasing anything?
Read the worked answer
Treat ‘anonymised’ as the conclusion of an assessment, not a step you perform by deleting a name column.
Test it against the actual population. The release keeps age, suburb, average heart rate and wellbeing score. In a 210-person programme in one city, a combination of suburb plus age plus a distinctive heart-rate average can plausibly isolate one or two people - especially since the sponsor can cross-check against the leaderboard already published, or simply know a participant.
The practical test is cell size. Count how many participants share each combination you intend to publish. Any cell of one or two, or any combination that could be matched to the leaderboard, is a re-identification risk. Removing names from a dataset that still contains a wristband identifier is pseudonymisation at best.
Before release. Aggregate so that every published cell has a minimum count (say 10 or more); drop suburb or band it to a few large areas; report distributions rather than averages where averages are identifying; and question whether the wellbeing score is needed by a nutrition sponsor at all. Then ask whether participants and guardians consented at collection to commercial reporting - if not, aggregation fixes identifiability but not purpose.
2. Apply the relevant Privacy Act 2020 principles to the three proposed uses: sponsor reporting, caregiver emails and offshore hosting. Identify what must change.
Read the worked answer
Name the principle, then the concrete failure.
Collection (IPP 3). The app collects suburb and a wellbeing score. Each must be necessary for running the programme. If the purpose is programme delivery, commercial sponsor reporting was never a lawful collection purpose unless it was disclosed up front.
Manner of collection (IPP 4). Continuous heart-rate sampling of minors is intrusive; it needs a plain-language explanation and guardian involvement, not a terms-and-conditions checkbox.
Storage and security (IPP 5) and retention (IPP 9). Thirty-second health-adjacent data in an Australian cloud raises questions about admin access, encryption and how long it is kept after a participant leaves.
Use and disclosure (IPPs 10 and 11). Sharing with a sponsor is a new purpose. Consent must be specific and obtained at collection; a sponsor's commercial interest is not the purpose for which the data was gathered.
Offshore disclosure. The principle governing disclosure outside New Zealand applies where information goes to an overseas person or entity. The gym must show comparable safeguards or a valid authorisation, and say so in its privacy notice.
Unique identifiers (IPP 13). Do not adopt the sponsor's ID scheme for participants.
Minors. There is no fixed statutory age, but the Privacy Commissioner expects an assessment of capacity; 13–14 year olds will generally need guardian involvement.
What must change now: appoint a privacy officer, write a notice, and stop sponsor reporting until re-consent is obtained.
3. The leaderboard has already gone out in a newsletter. Recommend what the gym should do, and what governance change would prevent a repeat.
Read the worked answer
Remedies matter more than blame, and order matters.
Immediate. Take the newsletter down. Record what was published, when, and to whom - a written timeline, not a memory.
Assess harm. First names plus heart-rate zones is a health inference about a minor, published in a small community where names are identifying. Notify the affected participants and their caregivers directly, and consider the notifiable-breach test in the Privacy Act 2020: a breach that has caused or is likely to cause serious harm must be reported to the Office of the Privacy Commissioner. Reason about it openly - do not assume it falls below the threshold because the gym is small.
Fix the cause, not the symptom. The default in the app should be that leaderboards are opt-in and use display names, so that publishing cannot happen by habit. Require approval from a named person for any publication containing participant data.
Governance. The absence of a privacy officer and a written policy is the real finding: both are required of an agency. Appoint a privacy officer, write a one-page data policy covering collection, retention, publication and third parties, and brief the volunteer IT helper on what de-identification actually requires - their goodwill is not the problem, their assumptions are.