3

I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form.

If a user includes personal information (e.g. their email) in the form, what is its status under the GDPR (and other similar regulations)? I am not actively cataloguing this information, but it can be used to easily identify a person.

Improve this question
2
  • I am aware that security.SE isn't mainly for privacy, but I chose this site as the least bad place to ask after reading this meta.SE question: meta.stackoverflow.com/questions/345480/… . By the way, the second part of your comment could easily be made into an acceptable answer to this question.
    – evilcandybag
    Aug 28, 2019 at 9:02
  • Privacy can be on-topic here. But you're asking an interpretation of a regulation. That puts it outside our scope.
    – schroeder
    Aug 28, 2019 at 11:02

1 Answer 1

Reset to default
3

The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data.

GDPR does even apply to anything offline and on paper.

Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.

Improve this answer
2
  • Basically it means you have to validate any entry field is free of PII before processing it. - When you are validating it, you are already processing data. But you don't have to validate if data contains PII where you don't expect it. And GDPR only applies to non automatically processed data when it's (intended to form) part of a filing system.
    – wimh
    Aug 28, 2019 at 19:29
  • Validation and processing here are not the same. and are context dependent. GDPR does not care about whether its a filling system or not (unless by filing system you mean anything that stores the data in any form. than yes). The Methodology I outline is for when you do noyt intend a specific piece of data to have PII, but does. The validation is in that case done (usually) by a human and the subsequent actions (usually) by machine. Intend matters in GDPR but there are provisions for 'accidental uses. (i.a. not intended but due to scope still applicable to the GDPR laws.)
    – LvB
    Aug 29, 2019 at 9:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .