0

1) Is Google or Facebook user ID number considered personal data? The ID itself is just a number, but you can use it to construct a profile url and reveal his identity through Google or Facebook profile.

2) If I have a website which enables social login and therefore stores registered user Google and Facebook ID numbers in the database, with no other personal data, not even email or name, just these IDs, am I data controller?

3) If answer to 1) is "yes", then is the user ID number in salt-hashed form considered personal data? Having a hash you cannot convert it back to user ID. But having a user ID e.g. from his social profile, it's possible to convert it to a hash and compare against all hashes in the database to tell if this person has account on this website or not.

Improve this question
1

1 Answer 1

Reset to default
2
  1. Yes, because the person is reasonably easy identifiable by the ID.
  2. Yes, because you process the ID which is personal data according to 1.
  3. No, because you cannot identify the person by their salt-hashed personal data in a straightforward way.
Improve this answer
7
  • I'd like to ask one more thing: is the act of hashing the user ID considered data processing? E.g. if I receive user ID and hash it automatically without any other use and only store the hash, am I the controller?
    – camcam
    Oct 8, 2018 at 12:53
  • If a hash produces unique values, it might still be feasible with reasonable means to calculate the original value. For example by calculating the hash for each possible input. In that case it would be pseudonymisation, not anonymisation.
    – wimh
    Oct 8, 2018 at 18:30
  • @camcam yes, processing is any operation on personal data (like the user ID). Even deleting of personal data is considered processing.
    – wimh
    Oct 8, 2018 at 18:33
  • @camcam yes hashing is processing, so it still labels you as GDPR controller. But because hashing essentially destructs personal data, your Privacy Policy is going to be simple.
    – Greendrake
    Oct 8, 2018 at 22:23
  • Suppose a social network offers alternative authentication API. When user authenticates through this API, the client (my website) only gets a hash of this user's ID, not his basic profile or ID itself. Assume they use hashing algorithm which makes brute forcing unfeasible with today's technology. I process this hash and associate simple website usage data with it. Am I GDPR data controller or processor in this case?
    – camcam
    Oct 9, 2018 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .