Does keeping an MD5 hash of user data violate GDPR?

Question

If a user requests to have their data deleted, would we still be permitted to keep hashes of user data for later use, even after the original data has been deleted?

Answer 1

I believe it might be possible, and could also be useful in many cases, as long as the hashes can't be bruteforced easily. In other words, if the user's data cannot be restored or read in any feasible way, then it's not user data anymore. The problem is that in this case it seems a hash can often be reversed by bruteforcing.

For example, if you hash the user's gender that can either be "male" or "female", then you can only have two possible hashes which can easily be reversed by bruteforcing (you just have to try with either "male" or "female"). A hash of the gender is therefore very likely to be considered "personal data". But if you hash all the user's data in a single hash, maybe by concatenating firstname+lastname+gender+age+etcetera and then calculating the hash, then it's going to be harder to reverse it, but how hard? The age is probably just a number between 0 and 100, the email is often [email protected], lots of first names might be John, lots of last names might be Davis, and so on.

In conclusion, I think that you should only keep the user's data that you really need for legitimate purposes and interests (maybe just the email to avoid another registration in the future, etc.), which should be as little data as possible, and delete everything else. Hashing it is probably a good idea, but I'm afraid hashing can't always be seen as a good excuse to keep all the data you want. It depends.

Answer 2

When reading the law comments then it is important to recognize that any data is either "user data" or "anonymous data" in a given context. These are distinct categories and any data falls in one of these categories. The same data can fall into different categories for different contexts.

Furthermore it is important to recognize that "pseudonymized data" is "user data".

When you must delete "user data" then you have either to really delete it or you have to anonymize it. Be aware that pseudonymization is not sufficient and that it could be very hard to proof that your data is anonymized and not just pseudonymized.

Unsalted Hashing can be easily reversed using Rainbow-Tables. For MD5 it is often enough to paste the hash into Google. Therefore it is only pseudonymized data. Therefore it is still user data that have to be deleted.