0

1) Is Google or Facebook user ID number considered personal data? The ID itself is just a number, but you can use it to construct a profile url and reveal his identity through Google or Facebook profile.

2) If I have a website which enables social login and therefore stores registered user Google and Facebook ID numbers in the database, with no other personal data, not even email or name, just these IDs, am I data controller?

3) If answer to 1) is "yes", then is the user ID number in salt-hashed form considered personal data? Having a hash you cannot convert it back to user ID. But having a user ID e.g. from his social profile, it's possible to convert it to a hash and compare against all hashes in the database to tell if this person has account on this website or not.

2
  1. Yes, because the person is reasonably easy identifiable by the ID.
  2. Yes, because you process the ID which is personal data according to 1.
  3. No, because you cannot identify the person by their salt-hashed personal data in a straightforward way.
  • I'd like to ask one more thing: is the act of hashing the user ID considered data processing? E.g. if I receive user ID and hash it automatically without any other use and only store the hash, am I the controller? – camcam Oct 8 '18 at 12:53
  • If a hash produces unique values, it might still be feasible with reasonable means to calculate the original value. For example by calculating the hash for each possible input. In that case it would be pseudonymisation, not anonymisation. – wimh Oct 8 '18 at 18:30
  • @camcam yes, processing is any operation on personal data (like the user ID). Even deleting of personal data is considered processing. – wimh Oct 8 '18 at 18:33
  • @camcam yes hashing is processing, so it still labels you as GDPR controller. But because hashing essentially destructs personal data, your Privacy Policy is going to be simple. – Greendrake Oct 8 '18 at 22:23
  • Suppose a social network offers alternative authentication API. When user authenticates through this API, the client (my website) only gets a hash of this user's ID, not his basic profile or ID itself. Assume they use hashing algorithm which makes brute forcing unfeasible with today's technology. I process this hash and associate simple website usage data with it. Am I GDPR data controller or processor in this case? – camcam Oct 9 '18 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.