A recent fintech privacy assessment reminded me that the best outcome of an assessment may not be a longer report. Sometimes, it is seeing issues being addressed before the report is even complete. I am currently working with a fintech organization developing an application designed to analyse users' income and spending patterns. From a privacy perspective, this is naturally an interesting application to assess. Financial information can reveal a great deal about an individua

Designing a consent screen can look deceptively simple. Explain why personal data is required. Present the relevant information. Add a checkbox, toggle or button. Capture the individual's choice. But when an organisation actually begins implementing consent, the difficult questions start appearing. What exactly is the individual consenting to? Are different purposes sufficiently clear? Is consent actually required for every activity? Can optional processing be separated from