Location Tracking in a Delivery App
A food-delivery startup with 300 employees and 1.2 million users plans a feature that collects precise GPS location every 30 seconds, including when the app is closed, to 'improve delivery estimates and detect fraud.' The updated terms pre-tick a consent box, and the privacy notice says data may be used to 'improve services.' Location data is retained indefinitely in a cloud data lake; analytics staff can join it with phone numbers and order history. Marketing wants to sell 'movement insights' to city planners. A security architect argues that AES-256 encryption at rest makes the plan acceptable. The part-time DPO has raised concerns but has not completed a DPIA. Launch is in five weeks. The CEO asks whether the plan is acceptable from an information security and privacy perspective and what must change before launch.
1. Identify the privacy principles most at risk and explain why encryption at rest does not make the collection acceptable.
Read the worked answer
At risk are lawfulness, fairness and transparency; purpose limitation; data minimization; storage limitation; integrity and confidentiality; and accountability. A pre-ticked consent box is not valid consent where consent is the basis, because it is not an unambiguous affirmative action; 'improve services' is too vague, and selling movement insights is a new purpose. Collecting precise GPS every 30 seconds in the background is excessive for delivery estimates and fraud detection, and indefinite retention in a joinable data lake breaches storage limitation. Encryption at rest protects confidentiality only; it does not provide a lawful basis, limit collection, stop secondary use, or satisfy transparency. It also does not prevent authorized analytics staff from re-identifying users.
2. Recommend a revised design and the ISO/IEC 27002:2022 controls that would support it.
Read the worked answer
Start with a DPIA and a documented lawful basis. Redesign to collect location only while the app is in active delivery use, or at a coarser frequency, with granular opt-in for any background collection. Separate fraud detection from marketing; do not sell identifiable movement data without a compatible lawful basis. Pseudonymize or aggregate analytics data, set retention-for example, raw location for 30 days, then aggregated-restrict access, and update the privacy notice. Relevant 27002:2022 controls include 5.34 (privacy and protection of PII), 5.31 (legal requirements), 5.12 and 5.13 (classification and labelling), 8.11 (data masking), 8.12 (data leakage prevention), 8.10 (information deletion), and 5.15 (access control).
3. The CEO wants to keep the five-week launch. What decision framework would you use?
Read the worked answer
Use a go/no-go gate, not a deadline-driven launch. The minimum conditions are a completed DPIA, a valid lawful basis, a revised collection design, a retention schedule, and DPO sign-off. If those cannot be met in five weeks, launch a reduced version without background location and without selling movement insights, then add features after review. The CEO can accept residual risk only after it is documented; they cannot accept illegality. Record the decision, owner and review date. This is privacy by design and default, and it aligns with 5.34 and 5.31.