Is the UUID considered personal data? I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services. Beyond that, my intention is just to store in my 3rd party cloud service provider the country where the user resides. Any other information like name , picture , etc , would be stored in the user’s device. Do I need to be GDPR complicant for this ?
It depends. Can the data controller or another person, with &quot;means reasonably likely to be used,&quot; (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person? If yes, it is personal data within the meaning of the GDPR. If no, it is not personal data within the meaning of the GDPR. Anonymous data is not subject to the GDPR. &quot;The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.&quot; Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing &quot;personal data&quot;. But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data. Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your &quot;lawful basis&quot; for processing the data and how you decided that.
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
Keeping logs of chats would not necessarily be against the GDPR as you have suggested. For the IRC service provider/operator: these chats/logs would be within scope if EU-based users are involved and this means the data controller/processors would have legal obligations to comply with GDPR. The IRC service provider/operator would be the data controller and would be held ultimately responsible for the data stored/processed through the IRC service, including backups and logs kept etc, and this would mean any sub-processors they select (such as hosting provider) would also have to be GDPR compliant. Due to the nature of IRC chats being entirely public in the same way forum board posts and comments are public, the contract terms between the IRC service provider and the IRC users would need to be very clear that this is the case, and the IRC users would need to give consent for this processing (this is more complicated for children, see Article 8 regarding consent from the holder of parental responsibility). For IRC users (personal use): If you wish to keep the chat records for personal use only (i.e. not in connection with a business or your employment at a business), then an exemption applies: This Regulation does not apply to the processing of personal data: ... (c) by a natural person in the course of a purely personal or household activity; ... (GDPR, Article 2: Material Scope, Paragraph 2(c), p.32) For IRC users (commercial/business use): In this case I don't think you would have any legal basis to store/process these chats/logs if they contain personal data without a legal agreement with the data controller which would require you to put in place the same protections they have to under GDPR but then allow your business to access the data for specific purposes. While the information may be published or considered to be in the 'public domain', for you to take a copy of it without permission and use it for a purpose they haven't consented to would not be allowed under GDPR. Additionally, to go through the process of removing personal data from the chats/logs would in itself be considered 'processing' under GDPR and therefore would be unauthorised without a legal agreement with the data controller. Practically therefore, your best options under this circumstance would be if: The IRC service provider implemented a 'favourites' feature to save within their own system the chat conversations you wish to retain and refer back to in future. Since they hold the data and you already have a user agreement with them there is no further complications (this is probably the best option); The IRC service provider implemented a feature to download an anonymized copy of a chat conversation (not ideal as there are no guaruntees a user will not include personal data in their messages, though the user agreement could state that message content will be considered to exclude personal data, in a similar way to how StackExchange do for this website, see the paragraph titled "Information You Choose to Display Publicly on the Network" on the StackExchange Privacy Policy). Your business considered an alternative communications solution, such as hosting its own real-time chat system or forum boards system, in which case your business would be the data controller, and while subject to GDPR you could then define the purposes for which the data will be used in your own user agreement.
You are having difficulty understanding the GDPR because you have an improperly narrow idea of “identification”. In contrast, the GDPR uses an extremely broad definition. In Art 4(1), personal data is defined as any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person It is worth noting that your “auto-generated identifier” would quite clearly be “an identifier such as … an identification number” and/or “an online identifier”. It is also worth noting that indirect identification is still identification. Recital 26 explains the concept of identifiability in more detail: ³To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. ⁴To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. Key observations: Singling out a data subject already counts as identification, meaning that it isn't necessary to infer their real-world identity! The data subject is still identifiable if you can only identify them with additional data. The data subject is still identifiable if identification can be performed by others. The main limit to this concept is the “means reasonably likely to be used” criterion: as long as there is a reasonable scenario in which the data subject could be likely identified, they are identifiable. Identifiability does not depend on your current intentions or policies, only on objective factors. As an illustration of these points, consider the Breyer case (C-582/14). The pre-GDPR Data Protection Directive had an essentially equivalent concept of identification, except for the “singling out” factor. The CJEU was asked to decide whether this meant that IP addresses collected in a server log file of some website were personal data. Quite clearly, such IP addresses do not directly identify a person, unless you happen to be the data subject's ISP. But here the CJEU constructed a reasonably likely scenario that shows that IP addresses will typically be personal data even without the “singling out” criterion: in the event of cybercrime, the website operator would reasonably provide the IP addresses of visitors to the police for investigation, and they in turn would have the means to get a subpoena/court order to get the ISP to provide the information necessary for identification. What does this mean for your identifiers? These identifiers and any linked information relate to a particular user, the data subject. Thus, these identifiers and any linked information are personal data if the user is identifiable. Since these identifiers allow you to single out a particular data subject, i.e. allow you to distinguish one user from another, the users are identifiable within the meaning of Recital 26 GDPR. Additionally, identification is possible if it is performed by someone other than you – such as the user themselves. How does this mesh with data subject rights? You correctly point out the problem that when a user contacts you to exercise their data subject rights, you wouldn't be able to find their records. But Art 11 GDPR prepares for this: If your processing activities do not require identification, then you are not required to acquire or maintain additional information just for the purpose of complying with data subject requests (this encourages data minimization). If you can demonstrate that you are unable to fulfill a data subject request because you can't identify the data subject, then the data subject rights in Art 15 to 20 do not apply. These are the rights to access, rectification, erasure, restriction, and data portability. Unaffected are the right to information, the right to object, and rights related to profiling. However, you still have to comply if the data subject provides additional information enabling their identification. You have intuitively grasped the correct solution: you can provide a feature where the user can see their automatically generated user identifier. Then, they can provide this ID to you when invoking their data subject rights. A note on privacy-preserving analytics. When it comes to analytics, the GDPR and ePrivacy issues must be looked at separately. From a GDPR perspective, any client IDs or other identifiers are likely to be personal data, regardless of how they are stored or created. But the GDPR does not necessarily require that the user gives consent to such analytics – a legitimate interest (opt out) solution might also work. The ePrivacy Directive does not care about whether such IDs or fingerprints are personal data, only about how they are created and stored. Any access or storage to information on the end user's device is only permissible with consent, unless the access or storage is strictly necessary for a service explicitly requested by the user. Analytics are not strictly necessary from the user's perspective. Thus, while cookies or LocalStorage can be freely used to store user preferences on a site, accessing/storing cookies for analytics purposes, or accessing information for fingerprinting purposes through JavaScript APIs, is only permissible with consent. Compare also the WP29 opinion 9/2014 on fingerprinting (PDF). This leads me to conclude that many so-called GDPR-compliant or cookie-less analytics fail to meet ePrivacy obligations if they include a client-side component such as the typical JavaScript tag without asking for consent, but that they might be OK if they rely on purely server-side data collection. Regardless of how user IDs or fingerprints would be created, those IDs and any linked data would still be personal data though, so that GDPR would still apply. A hash of an identifier is still an identifier and therefore personal data, and at the very least still enables indirect identification. (WhatsApp attempted a “lossy hashing” argument while appealing its fine, but didn't convince many supervisory authorities.)
There’s no definitive list of what is or isn’t personal data, so it all comes down to properly interpreting the GDPR’s definition: ‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’). — Article 4(1) In other words, any information that is clearly about a particular person. But just how broadly does this apply? The GDPR clarifies: [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. — Article 4(1) This means that because you say that coordinates and anticheat logs are linked to the cheaters ingame username and unique id, if there is a record of who that username and/or unique id belongs to, even if it is just an IP or email address, it is considered personal data because the information relates to an identifiable natural person. Personal data includes any data which can be linked to information where a person can be identified From CommentsIf the online username and unique id is not linked to the actual human (no stored real name, no home address, no IP), can the natural person actually be identified? The records and anticheat logs are linked to the unique id and username, however the unique id and username are (from my POV) not actually linked to the real human Only you can answer that question as it stands because we have no access to your data. From what you have told us, even though the coordinates and anticheat logs are linked to the cheaters ingame username and unique id, that alone doesn’t fall under the GDPR’s scope of personal data, as, in all likelihood, the usename and unique id could relate to anyone in the world. The issue comes if elsewhere you have a record of the person's name, IP, date of birth etc. which when combined with the anticheat logs could link that data to identifiable people. You might think that someone’s name is always personal data, but it’s not that simple, as the UK’s Information Commissioner’s Office document what is personal data (PDF) explains: “By itself the name John Smith may not always be personal data because there are many individuals with that name. However, where the name is combined with other information (such as an address, a place of work, or a telephone number) this will usually be sufficient to clearly identify one individual.” Note: A name which is much less common could be personal data as the likelihood of it relating to others deminishes. John Smith is a common name all over the UK, but what about a particular polish/czech/hungarian/french.... name (let's say) living in Nottingham, UK? What is the likelihood of another person of the same name in Nottingham, UK? Add a middle name or double barrelled surname, and it becomes even more likely that it is personal data. If you’re unsure whether the information you store is personal data or not, it’s best to err on the side of caution. This means making sure data is secure, reducing the amount of data you store, collecting only as much data as necessary to complete your processing activities, keeping data for only as long as it meets its purpose, and ensuring only authorised people are able to access the data.
GDPR killing genealogy websites? I could see GDPR totally killing genealogy websites if they follow the rules strictly, but would they really want to do that. Seems to me genealogy has an important historical role. Treat living persons with anonymization I assume you don't have data to identify a person or contact the living person. How would you contact to get consent to show personal information if you only have a name, impossible right? GDPR tries to stop abuse of personal data, yes, and your family tree certainly is personal data. However those who come to your website would mostly want to search and edit the non-living, search back in the history, thus the current generation follows the family tree and are not the point of entry. You can provide certain anonymization to those alive by not displaying the first names in full, maybe just the first letter. You may want to hide address, spouse, children for current generation. You could make those available for view/edit first by going through a secondary login, "not a robot". Further you may remove living people from search results and hide from search engines so they do not have ability to index the current generation. That would make it harder to abuse if you're going after an individual, but at the same time doesn't lock out the people providing information.
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.