Question

A fitness app product team wants to add a new feature that recommends nearby running routes. The proposed design requests continuous background access to precise GPS location, the device contact list, microphone, and calendar entries. As the data privacy solutions engineer reviewing the collection design against the data life cycle principle of collection limitation, which recommendation should you make?

Accepted Answer

Restrict collection to coarse location gathered only while the feature is in active use, and remove the contacts, microphone, and calendar access that are not necessary for route recommendations

Answer

Approve all requested data elements because broad collection improves recommendation accuracy and can be retained for future analytics

Answer

Allow all requested access but obtain a single blanket consent covering every permission at first app launch

Answer

Collect all requested elements now but pseudonymize the identifiers so the excess collection is compliant