1

I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not username) and email address (which are personal information).

I found another related question (GDPR Legislation and user invites by email) but in that case it's enough to store the (irreversible!) hash of the given email address. In my case I must store the name of the new user that just can't be hashed, since I'd like to display it for the existing users.

If this is not legal, are there any other ways to do something similar to this approach?

  • Why do you need to store that data? Keep it client-side, put it in a cookie. And any invitation-specific data should be in the invitation URL itself. – MSalters May 18 '18 at 23:11
  • Thank you for your reply. Client side storage (on the single invitor) would not be enough for my case, since I want all other existing users to know who exactly have been invited so far. – user1642349 May 19 '18 at 0:02
  • To answer the question you ask in in the heading: Yes, running an invitation based service program will still be legal after GDPR. I have written a longer answer to the different question you're asking in the body: Can I display the names of invitees to something after GDPR? Please clean up the question to make title and body ask the same question. – Free Radical May 19 '18 at 5:58
  • @user1642349: Letting other users know who have been invited sounds like yet another GDPR violation. Remember, you don't have permission from the invitee yet. – MSalters May 20 '18 at 0:20
0

This boils down to an interpretation of GDPR Article 6- Section (1) lists all 6 legal grounds for lawfulness of processing in subparagraphs a-f.

In your case, you cannot use use subparagraph a (consent). Subparagraphs c-e is also obviously out of scope, leaving subparagraph b and f.

Subparagraph b says:

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Joining your app is "performance of a contract" and you do this "prior to entering into a contract". However, the processing is not done "at the request of the data subject". The request comes from a friend of the data subject – so: No – subparagraph b does not provide legal grounds for processing.

Subpragraph f says:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Marketing is recognised as a legitimate interest by the EU, but having one's names publicly displayed to existing users on a website may not be in the legitimate interest of the data-subject.

To some extent I guess it depends on the website. If is a site dedicated to the appreciation of some sexual fetish, displaying names of invitees would clearly not be in the interest of the data-subject. If the site was the local chapter of the high-IQ club "Mensa", the potential harm to the legitimate interests of the data subject is much lower (I think – but it may be that somebody thinks that being associated with such a snotty bunch as "Mensa" harms their reputation, and takes you to court if you do this).

As always. Providing specific advice is not possible. If you need to know whether this marketing strategy is legal under the GDPR, get specific legal advice from a lawyer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.