| Course | FI311 FinTech Law and Ethics |
|---|---|
| Unit | Unit 4 |
| Paper type | Data privacy case study |
| Length | About 1,130 words, 7 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | BS in Finance |
| Updated | October 2026 |
Free sample paper for FI311 Unit 4
Collected to Move Money, Wanted for Everything Else: A Unit 4 Data Privacy Case Study of Three Proposed Uses
[Student Name]
Purdue University Global
FI311: FinTech Law and Ethics
Unit 4 Data Privacy Case Study
[Instructor Name]
[Date]
The app, its customers, its partners and every figure are composite; the statute, regulation and articles cited are real. Not legal advice.
Background: What the App Holds
The app offers checking accounts through a partner bank and a debit card it manages. For every card purchase it stores the merchant's name and category, the amount, the date and time, and the location of the terminal. It collected this data to authorize payments, detect fraud and show customers their spending. Over four years it has accumulated about 310 million transactions from 900,000 customers.
The privacy notice customers accepted at account opening says the app shares information "with service providers who help us run our business" and "as permitted by law," and it offers an opt-out from sharing with nonaffiliated companies for their own marketing. About 6 percent of customers have used that opt-out. The notice says nothing about building models or selling data.
The product team has proposed three uses, each projected to earn between $1.5 million and $4 million a year. The chief compliance officer has asked for an assessment of each before any is approved.
Use 1: Merchant Offers
The proposal. Participating retailers would buy access to audience segments, for example customers who spent more than $200 a month at a competing grocery chain, and send them offers.
The privacy rule. The Gramm-Leach-Bliley Act restricts financial institutions from disclosing customers' nonpublic personal information to nonaffiliated third parties unless customers receive notice and a chance to opt out (Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809, 2018). Regulation P sets out how that notice and opt-out must work (Privacy of Consumer Financial Information (Regulation P), 12 C.F.R. pt. 1016, 2024). A list of customers who shop at a competitor, handed to a retailer, is a disclosure of nonpublic personal information.
The design choice that matters. If the retailer received names or emails, the app would be disclosing, and it could do so only for customers who had not opted out. If instead the retailer supplied an offer and the app placed it in the app for customers in the segment, without telling the retailer who they are, nothing would be disclosed. The retailer would learn only how many people redeemed.
Assessment. The second design is lawful and lower risk, though customers may still find it unwelcome to see offers based on where they shop. The first design is lawful for 94 percent of customers but would surprise many of them.
Use 2: An In-House Credit Model
The proposal. The app would use transaction histories to build a model offering small credit lines to customers who lack credit history.
The privacy rule. Because the data stays inside the company and is used to offer the company's own product, the privacy rule's limits on disclosure do not apply. The legal question changes.
The new question. A model built on spending data can treat customers differently based on information that tracks protected characteristics. Shopping at particular grocery chains, sending money abroad or paying at certain churches can correlate with national origin or religion. Fair lending law prohibits discrimination on those grounds whether or not the model uses them directly, so the model would need testing for disparate outcomes before launch.
Assessment. Lawful as a privacy matter; the risk sits with fair lending and should be managed there.
Use 3: An Aggregated Data Sale
The proposal. An investment research firm would buy weekly aggregates: spending by merchant, by ZIP code and by hour, with customer identifiers removed. It would use them to forecast retailers' quarterly sales.
Is it really anonymous? The proposal treats aggregation as removing identity. Research on credit card records suggests caution. A study of three months of card transactions for 1.1 million people found that four data points, each a shop and a day, were enough to single out 90 percent of individuals, and that coarsening the data helped less than expected (de Montjoye et al., 2015). Spending by ZIP code and hour, for a small merchant in a small ZIP code, can describe a handful of people.
Aggregation removes names but not patterns, and when the time and place of a purchase survive, the people behind a "trend" can be few enough to find, which means the sale's privacy protection is only as strong as the smallest group it reports.
What customers were told. Nothing in the notice describes selling data in any form. Even if the aggregates fall outside the legal definition of personal information, customers would reasonably be surprised, and a privacy notice that most people do not read is weak ground for consent (Solove, 2013).
Assessment. High reputational risk and uncertain legal footing, for the smallest of the three revenue projections.
Comparing the Three Uses
The three proposals carry different risks. Merchant offers raise a disclosure question that design can answer. The credit model raises no disclosure question at all but a serious fairness one. The data sale raises a question that design can only partly answer, because the value of the data to the buyer depends on the detail that makes it identifying. The less detailed the aggregates, the safer and the less useful they become.
The three also differ in how well they match what customers expect. Customers who use a banking app to see their spending would probably accept offers inside the app and might welcome a credit line built from their own history. Few would expect their purchases to inform a hedge fund's forecasts.
Beyond the Legal Minimum
The law sets a floor, not a business strategy. A banking app depends on customers trusting it with every purchase they make, and that trust is easier to lose than to rebuild. If a news story described the app selling grocery-store visits to investors, the loss of customers could outweigh years of data revenue. The compliance question is therefore two questions: whether a use is permitted, and whether the company would be comfortable explaining it to customers in a single plain sentence.
Recommendation
Approve merchant offers only in the in-app design, with no customer-level data given to retailers, and add a setting that lets customers turn offers off. Approve development of the credit model, subject to fair lending testing before launch and an explanation to declined applicants that names the factors used. Decline the data sale. If the company revisits it, it should require minimum group sizes, remove time of day and fine location, ban re-identification by contract and rewrite the privacy notice in plain terms before any data leaves the company.
References
de Montjoye, Y.-A., Radaelli, L., Singh, V. K., & Pentland, A. S. (2015). Unique in the shopping mall: On the reidentifiability of credit card metadata. Science, 347(6221), 536-539. https://doi.org/10.1126/science.1256297
Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809 (2018).
Privacy of Consumer Financial Information (Regulation P), 12 C.F.R. pt. 1016 (2024).
Solove, D. J. (2013). Privacy self-management and the consent dilemma. Harvard Law Review, 126(7), 1880-1903.
Reading the FI 311 Unit 4 instructions
The fourth FI311 unit asks you to analyze proposed uses of customer financial data. Start with what the company holds, why it was collected and what customers were told in the privacy notice. Take each proposed use separately. Describe it precisely, identify which legal rule applies, and show how design choices change the answer, for example whether data leaves the company. Where privacy law does not apply, ask what other legal risk does. Test claims of anonymity against research. Compare the uses with one another and with what customers would expect, then go beyond the legal minimum to ask what the company could explain in a plain sentence. Recommend a decision for each use, with conditions. Cite the privacy statute, its regulation and the research in APA 7.
How the FI 311 Unit 4 example is put together
The sample's app stores merchant, amount, time and location for each purchase and offers an opt-out that 6 percent of customers used. Merchant offers that hand retailers customer lists count as disclosure requiring notice and opt-out, while offers placed inside the app without naming customers disclose nothing. The credit model stays in-house, so the privacy rule steps aside and fair lending takes over, since spending patterns can track national origin or religion. The data sale meets research showing that four purchase points singled out 90 percent of 1.1 million card users, and the highlighted sentence explains why aggregation removes names but not patterns. Recommendations approve the in-app offers, test the model and decline the sale.
Reading the FI311 Unit 4 grading rubric
Privacy case studies in FI311 earn points for treating each proposed use on its own terms and applying the right rule to each. Graders check that the data and the original notice are described, that disclosure and internal use are distinguished, and that design alternatives are considered. The rubric rewards recognizing when a privacy question becomes a fairness question, testing anonymity claims against evidence and weighing customer expectations beyond legal compliance. A decision for each use, with conditions, shows judgment. Case studies that treat all uses alike, accept "aggregated" as meaning anonymous or stop at what the notice permits receive fewer points. Accurate citation of the privacy rule supports the analysis.
Common FI311 Unit 4 mistakes, and how to avoid them
Weak Unit 4 case studies apply one rule to every use, missing that internal modeling raises different risks from sharing. Others assume that removing names makes data anonymous. Many quote the privacy notice as if customers read and understood it. Design choices, such as delivering offers without disclosing identities, go unexplored, so the recommendation is all or nothing. Revenue is weighed without reputational risk. Should your company hold health, location or brokerage data instead, the analysis can test each proposed use against the rules governing that data.
Get an FI311 Unit 4 example written to your instructions
Describe the firm and the data uses your Unit 4 case proposes, or paste the scenario as given, and attach the FI311 instructions and rubric. Each use is taken through the applicable rule, customer expectation and risk, then ranked with conditions. This is a course paper, not privacy counsel. Your first custom sample is free, usually within 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More FI311 papers and BS in Finance samples
- FI311 Unit 1: Discussion Post on Fintech Complaints
- FI311 Unit 2: Fintech Regulatory Map Brief
- FI311 Unit 3: Wage Advance Compliance Analysis
- FI311 Unit 5: Consumer Protection Analysis
- FI311 Unit 6: Seminar Reflection
- FI311 Unit 7: Algorithmic Fairness Memo
- FI311 Unit 8: Cross-border Regulation Analysis
- FI311 Unit 9: Ethics Scenario Response
- FI311 Unit 10: Regulatory Position Paper
- FI310 Unit 4: Digital Lending Case Study
FI311 Unit 4 questions, answered
Where can I find a free FI311 Unit 4 sample paper?
This page holds a full FI311 Unit 4 data privacy case study of a composite banking app weighing three new uses of 900,000 customers' transaction data, with a decision for each and APA 7 references.
When does sharing customer data require an opt-out?
When a financial institution discloses nonpublic personal information to a nonaffiliated third party outside the rule's exceptions. In the sample, handing a retailer a list of customers who shop at a competitor would be a disclosure; placing the retailer's offer inside the app without naming anyone would not.
Why doesn't privacy law settle the credit model question?
Because the data never leaves the company and is used for its own product, so the disclosure limits do not apply. The legal risk moves to fair lending, since spending patterns can stand in for protected characteristics even when those are never collected.
Is aggregated transaction data anonymous?
Not necessarily. Research on card records found that four purchases, each a shop and a day, singled out most people in a large dataset. Aggregates broken down by small ZIP codes and hours of the day can describe only a handful of customers.
Why decline the data sale if it might be legal?
Because its legal footing is uncertain, customers were never told data could be sold in any form, and it carried the smallest revenue projection of the three. A use the company could not comfortably explain to customers in a sentence is a poor bet for a firm that runs on trust.