The Consent Gap in a Cross-Border Analytics Program
A healthcare-adjacent company runs analytics on user behavior across the EU, UK, and US. A new program would combine EU app-usage data with US purchase history to build a propensity model. Legal has flagged that EU consent captured at signup covers 'service improvement' but not 'marketing analytics,' and that 22% of EU users have withdrawn consent since a policy update. The data team proposes pseudonymizing EU records and proceeding, arguing pseudonymized data is out of scope. The US dataset includes health-adjacent inferences. The program has a 10-week launch target and an executive sponsor who says the consent question is 'a legal detail.'
1. Assess the pseudonymization argument and the compliance position of the proposed program.
Read the worked answer
The pseudonymization argument is wrong as stated. Pseudonymized data remains personal data under GDPR because it can be re-linked using additional information (the pseudonymization key). It is not anonymous, and anonymity - not pseudonymization - is what removes data from scope. Proceeding on this basis would be a material misreading, and the fact that the team believes it is a red flag about the program's privacy review.
Compliance position, element by element:
- Purpose limitation: signup consent covers 'service improvement,' not 'marketing analytics.' Building a propensity model is a new purpose. Reusing the data requires a valid basis - fresh consent or a documented legitimate-interest assessment where applicable - not a relabeling.
- Withdrawn consent (22%): these users' data must be excluded from the new processing. If the pipeline cannot exclude them, that is a design defect, not a rounding error.
- Cross-border combination: combining EU usage with US purchase data increases identifiability and the sensitivity of inferences. The transfer mechanism and the combined-purpose assessment must both be documented.
- Health-adjacent inferences in the US: inferences about health status may be sensitive or protected data depending on jurisdiction (e.g., state health-privacy laws). The US dataset cannot be treated as unregulated.
Conclusion. The program as proposed is not compliant. The 10-week target is not achievable on the current design; the sponsor must be told that plainly, with the specific blockers.
2. The sponsor insists on launching in 10 weeks. What is your recommendation and how do you present it?
Read the worked answer
Recommendation: launch a compliant subset, not the full program. Do not accept 'launch and fix later' - the liability is regulatory and reputational, and retroactive consent is not a cure for data already processed.
Compliant path within 10 weeks:
- Scope the model to users with valid consent for marketing analytics, excluding the 22% who withdrew. This likely shrinks the EU cohort and must be sized immediately - if it is too small to model, say so now, not at week 9.
- Separate the US and EU processing until a documented basis for combination exists. Run the US-only propensity model first if that is lawful under applicable state law, and treat EU combination as a phase 2 gated on consent refresh.
- Refresh consent for the EU base with clear marketing-analytics language, and build consent-state into the pipeline as a first-class, enforced filter - not a manual step.
- Document the legitimate-interest or consent basis for each processing purpose, and the transfer mechanism for any EU data leaving the region.
How to present it to the sponsor: lead with the decision they must make, not the legal lecture. Frame it as: 'Full launch in 10 weeks carries a regulatory exposure we cannot accept; here is what we can launch in 10 weeks, what it will and won't predict, and the date the full version becomes available if consent refresh proceeds.' Give them a dated path, not a refusal.
If the sponsor overrides: escalate to the DPO and legal in writing, record the decision and the advice given, and ensure the processing is halted if it proceeds without a lawful basis. 'Legal detail' is not a defensible position to hold in an incident review.