Fall-Detection Pendant: Sharing Link and Default PIN
A startup is launching a fall-detection pendant for older adults. The pendant sends accelerometer data over Bluetooth Low Energy to a companion phone app, which relays it to a cloud service. Family caregivers can view a daily activity timeline, and telehealth nurses can review fall events. The pendant ships with a fixed six-digit pairing PIN of 0000, and the app stores the last 30 days of raw acceleration data unencrypted in local storage. Marketing wants a 'share my parent's activity with anyone' web link that requires no login, to drive family adoption. The company has no privacy notice beyond a two-line splash screen and plans to retain raw data indefinitely to improve its detection model. A pilot with 40 families is due to start in six weeks.
1. Identify the main privacy principles engaged by the proposed 'share with anyone' link and explain how to redesign it.
Read the worked answer
Reasoning. The open link engages purpose limitation, consent and choice, data minimisation, transparency, security and accountability. A no-login URL is a bearer token: anyone who receives or guesses it can view health-related activity, and the older adult loses control over secondary use.
Redesign: require an authenticated invitation with a named recipient and a scoped role, such as view-summary-only; obtain consent from the data subject or lawful representative; make the link expire and be revocable; show an audit trail of who viewed; exclude raw accelerometer data; disable search indexing. The default should be private, not public.
Conclusion. The feature can exist, but only as an explicit, revocable, authenticated sharing action-not an open link.
2. Evaluate the fixed PIN 0000 and unencrypted local storage against IoT security principles. What should replace them, and what constraints matter for an older-adult user?
Read the worked answer
Reasoning. A fixed 0000 PIN is a default credential and defeats device authentication; an attacker nearby can pair and inject or read data. Unencrypted local storage exposes 30 days of raw acceleration if the phone is lost or backed up insecurely.
Replacements: per-device unique keys in a secure element or OS keystore; BLE LE Secure Connections; QR-code or passkey onboarding backed by the phone account; app-level authentication and an encrypted local database. For older users, avoid complex passwords: use a large-font passkey, caregiver-assisted setup, and account recovery that does not reintroduce a universal PIN. Minimise raw local data and encrypt backups.
Conclusion. Security by design and secure defaults are the principle-level fixes; usability constraints shape the mechanism, not the decision to authenticate.
3. The company wants indefinite raw-data retention. Apply data minimisation and retention principles. What retention policy and technical measures would you recommend?
Read the worked answer
Reasoning. Raw acceleration is sensitive health and behaviour data. Indefinite retention violates data minimisation and storage limitation and increases breach impact. 'Improve the model' is a purpose, but it is secondary and needs a separate lawful basis.
Policy: retain raw data only as long as needed for fall review, for example 30 days, then delete or irreversibly anonymise; keep aggregates for service metrics. For model training, use de-identified or synthetic data with opt-in consent, or a documented legitimate-interest assessment. Implement automated deletion, retention dashboards and audit logs. Do not use sharing-link data for training.
Conclusion. Set a schedule by purpose, separate research consent, and make deletion the default.