1

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design enhancements without users' consent? No other info is collected, users do not have an account in my app, I just need this for statistical purposes to know what browsers and screen sizes are most used by people using my web app and do not want to use Google Analytics or other external service.

1

YES you can.

The 1st thing you need to ask yourself under similar circumstances is:

  • Is this Personal Data?

Personal Data is any Data which on its own (like a photograph) or when cross-referenced with other Data allows the identification of a specific natural person.

So, in this case, you either have a registered user and then yes it is PErsonal Data for you can identify the Data Subject; or no, you have just a visitor IP address and then it is not PErsonal Data for the maximum you can do is to identify a "known IP".

The 2nd thing you need to ask yourself is:

  • What is the Lawful Base to Process this Data?

Since the user will benefit from the Processing of this Personal Data, by having the information permanently tunned in advance to his/ her browser, you are acting on both your as well as the Data Subject's Legitimate Interest (not Consent).

Now, there is a 3rd question to be asked and that derives from the needed LEgitimate Interest Impact Assessment that you need to do in order to validate using Legitimate Interest as the Lawful Base for Processing, so:

  • What is the potential Risk that renders your Corporate LEgitimate Interest void in face of the Data Subject's Legitimate Interest to his/ her Security; Privacy and Confidentiality?

  • Security-wise registring the Browser window size does not pose any risk, so ... checked.

  • Confidentiality-wise, it is not a "topic" that may be considered "confidential", in the sense that its disclosure may represent negative consequences for the Data Subject.
  • Privacy-wise, it is also not a topic that the Data Subject may want to maintain confidentially, for it does not bear risk nor is it "critical".

So, you may proceed yet you need to make clear in your Privacy Policy or a disclaimer that you gather such Data and WHY/ HOW you process it (advantages for the user included) and that the Lawful Base is LEgitimate Interest (your's as well as the Data Subject's... do not forget that).

Last you need to allow the Data Subjects to exercise their rights if they do so desire, meaning opting out from this processing activity.

Hope this was clarifying.

  • "The 2nd thing you need to ask yourself is: What is the Lawful Base to Process this [personal] Data?" - you only need to ask yourself that if it is personal data. Which in this case it is not. – Lag Jun 18 at 11:34
  • Lag ... you are right, only if it is Personal Data. Now you may only be sure about whether if it is or not after having assessed it (even if just in your mind... that is the point :) ) – Rui Freitas Serrano Jun 18 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.