1

I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not username) and email address (which are personal information).

I found another related question (GDPR Legislation and user invites by email) but in that case it's enough to store the (irreversible!) hash of the given email address. In my case I must store the name of the new user that just can't be hashed, since I'd like to display it for the existing users.

If this is not legal, are there any other ways to do something similar to this approach?

Improve this question
4
  • Why do you need to store that data? Keep it client-side, put it in a cookie. And any invitation-specific data should be in the invitation URL itself.
    – MSalters
    Commented May 18, 2018 at 23:11
  • Thank you for your reply. Client side storage (on the single invitor) would not be enough for my case, since I want all other existing users to know who exactly have been invited so far.
    – user1642349
    Commented May 19, 2018 at 0:02
  • To answer the question you ask in in the heading: Yes, running an invitation based service program will still be legal after GDPR. I have written a longer answer to the different question you're asking in the body: Can I display the names of invitees to something after GDPR? Please clean up the question to make title and body ask the same question.
    – Free Radical
    Commented May 19, 2018 at 5:58
  • @user1642349: Letting other users know who have been invited sounds like yet another GDPR violation. Remember, you don't have permission from the invitee yet.
    – MSalters
    Commented May 20, 2018 at 0:20

1 Answer 1

Reset to default
0

This boils down to an interpretation of GDPR Article 6- Section (1) lists all 6 legal grounds for lawfulness of processing in subparagraphs a-f.

In your case, you cannot use use subparagraph a (consent). Subparagraphs c-e is also obviously out of scope, leaving subparagraph b and f.

Subparagraph b says:

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Joining your app is "performance of a contract" and you do this "prior to entering into a contract". However, the processing is not done "at the request of the data subject". The request comes from a friend of the data subject – so: No – subparagraph b does not provide legal grounds for processing.

Subpragraph f says:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Marketing is recognised as a legitimate interest by the EU, but having one's names publicly displayed to existing users on a website may not be in the legitimate interest of the data-subject.

To some extent I guess it depends on the website. If is a site dedicated to the appreciation of some sexual fetish, displaying names of invitees would clearly not be in the interest of the data-subject. If the site was the local chapter of the high-IQ club "Mensa", the potential harm to the legitimate interests of the data subject is much lower (I think – but it may be that somebody thinks that being associated with such a snotty bunch as "Mensa" harms their reputation, and takes you to court if you do this).

As always. Providing specific advice is not possible. If you need to know whether this marketing strategy is legal under the GDPR, get specific legal advice from a lawyer.

Improve this answer
1
  • I think the idea here is to display the names of the invitees back to the person who invited them, so they know whom they have already invited. They presumably have a legitimate interest in not inviting the same person again.
    – interfect
    Commented Jan 6, 2020 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .