4

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone in the E.U., you would inadvertently be leaking their personal data by saying whether or not they use the service.

The GDPR even places restrictions on what personal data you can store. This seems to imply that you would need consent to store whether or not someone uses your service. It is easy enough to get consent to store who is using it, but how to get consent from every EU citizen who doesn't use your service? After all, according to the GDPR, personal data are "any information which are related to an identified or identifiable natural person." If someone does not use the service, it is pretty easy to identify that fact by looking at the user database.

So, would revealing or storing whether or not an EU citizen uses your service constitute a GDPR violation?

Improve this question
1

1 Answer 1

Reset to default
1

Revealing whether an EU citizen used a service could certainly be considered a data breach under the terms of GDPR, but that's not what's happening here.

The service provider would be checking whether a particular string of characters had appeared before as an account name. This wouldn't have to be a name, an e-mail address, or anything else directly associated with a Natural Person.

There might be some risk to a person who intentionally entered another Natural Person's Personal Data in an attempt to discover whether they had used that name to register for a specific service - and certainly if they were to reveal this to others - but this would be an action of the third party, and not something the service provider had done.

It's worth mentioning that consent is not the only lawful basis for processing. In this case "to fulfill contractual obligations with a data subject" would seem to cover checking that a particular string of characters was not duplicated as an account name.

Improve this answer
4
  • 3
    But many services and sites tell people to use their email addresses as user names, and some check their validity. for such a service, the user name is highly likely to b the person's public email, and thus to be personal data.
    – David Siegel
    Commented Feb 8, 2019 at 16:51
  • "In this case 'to fulfill contractual obligations with a data subject' would seem to cover checking that a particular string of characters was not duplicated as an account name." So you would have to form a contract with anyone whose email is entered into the username box, or what? How you supposed to know they even exist?
    – Christopher King
    Commented Feb 8, 2019 at 18:20
  • @DavidSiegel - checking that an entered string is valid as an e-mail address doesn't mean it's one that's ever been used or that it relates to a particular Natural Person, but I'll agree that services that use e-mail addresses as account names could be taking a risk. That said, any that say "enter your e-mail address" (emphasis on "your") would have some defence. Otherwise, the process described is a bit like knocking on selected doors and asking "does John live here?" and isn't what GDPR was designed to cover.
    – ItWasLikeThatWhenIGotHere
    Commented Feb 9, 2019 at 9:11
  • @PyRulez - The service provider would have a contract with people who had already registered a particular string of characters as an address. And the idea that the site wouldn't know whether people even existed corresponding to strings subsequently entered in the username box is kind of the point.
    – ItWasLikeThatWhenIGotHere
    Commented Feb 9, 2019 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .