3

I run a small hobby message board that is entirely non-commercial. People need to provide an email address to register and use that for logging in.

I do not use their email address for anything else (unless they set their profile so that they receive notifications on topic replies or private messages, or if they want to reset their password), and I describe this clearly before registration. Email addresses are never transferred to any third parties, nor are they used for sending any unsolicited messages.

Is this considered a "lawful basis for processing data"? Or is consent required?

It would be important to not require additional consent as I would like the forum to be friendly for teenagers as well, and asking them to print a form and get it signed by their parents is just plain ridiculous and it would turn most of them away (or just cause them to lie about their age instead).

Improve this question

1 Answer 1

Reset to default
2

Yes, it is fine, but you are required to write down why.

I think you can mostly base the processing on Article 6.1b GDPR;

b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

When someone registers there is a mutual contract. You need the email address of the other party to be able to contact them. You already mentioned a password reset. But there will be other important reasons to contact them, for example Article 34 GDPR requires you to inform everyone in case of a personal data breach. It is very common to also use the email address to login, it is even better than having to enter additional personal data.

Assuming notifications on topic replies or private messages are disabled by default, it is a perfect way for users to give consent by ticking a check box. So Article 6.1a GDPR would apply to that"

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

They should be able to disable these notifications at any time.

If these notifications would improve the discussions, for example because of faster replies, Article 6.1f GDPR might even apply;

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, [...]

Improve this answer
3
  • One addition; many message boards include a profile page, where users can enter information about themselves. That might include personal data. In that case you process that data based on consent. They enter that data themselves, by doing so, they agree to make it visible to others. Once they don't want that any more, they can remove that information.
    – wimh
    May 27, 2018 at 18:50
  • Thanks for your detailed answer. As for profile data: do you think this means I have to ask people if they're below a certain age and get their guardian's permission to enter info into profile fields? Would it suffice to warn not to put any personal information there?
    – parachutingturtle
    May 27, 2018 at 19:43
  • It would be interesting to see how others solve this. If it was my message board, I would just add a notice asking not to add any personal data if you are 16 or younger, or let their guardians enter that information. I would want to avoid having to store the age of the user.
    – wimh
    May 28, 2018 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .