The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all circumstances.
My company has a web based product where access is granted only to individuals who are allowed to use the app, by our company, or other companies that have contracted for the use of our product by their own users. I.e. a user can not simply go to our webpage and create an account for themselves, we have to do it for them.
We currently require and store only information required for business purposes, such as name, phone #, email address, company, etc. This information is stored in an encrypted database.
We don't "process" this personal information in any way, shape or form, beyond using it to validate users at login time, to contact users when issues arise, to identify current users of specific resources, etc.
The user data is stored in a database, with a UUID. Any other database field that references the user specifically, contains only the UUID.
There may be other information, for example messages "posted" to an internal memo board, which might contain any sort of information the user, or someone else, might add, including names, email addresses, phone numbers, etc.
Additionally, we log information that is strictly used for debug purposes when problems occur, such as IP addresses. I do believe, though, that all collected IP addresses are for machines that are part of product, and not specific IP addresses of user machines, although I could be mistaken on that point.
The only cookies we store on the users browser are session based, and are not persistent.
We currently believe that our requirements for GDPR should be fairly simple:
- The responsibility we have for removing a users personal data is limited to deleting, or simply overwriting the data in the user record in the database.
- Arbitrary personal information contained in memo board posts doesn't need to be removed, as it would be difficult, if not impossible, to find such information. For example, the user may be named Peter Rabbit, but might be referred to in a memo as simply Peter, or Pete, or Pete Rabbit.
- We may be required to scan the memo board posts for exact names, email addresses and phone numbers, and remove them from the memos.
- On first login, and every subsequent 12 months, we will issue an opt-in message to the user asking permission to store his/her information, etc.
- There will be a mechanism for the user to request removal of their personal information.
- As the personal information is required for business purposes, if a user opts-out, or requests removal of their information, we will delete their account and remove/overwrite their user record the database, after possibly scanning the memo board posts for exact matches to the fields in the user record. Of course there will be appropriate safeguards to avoid someone else maliciously trying to delete another users account.
- Do we need to scrub logfiles of user names and IP addresses that might be attached in some way to users, even when those logfiles might be scattered across hundreds of different machines on the internet? How would we even be able to discern the connection between a user an an IP address?
- Given the stated constraints on the use of personal data in our app, does this strategy seem sound and complete, or are there other considerations that we have missed?