Store browser width / screen size and browser type without user consent?

Question

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design enhancements without users' consent? No other info is collected, users do not have an account in my app, I just need this for statistical purposes to know what browsers and screen sizes are most used by people using my web app and do not want to use Google Analytics or other external service.

Answer 1

YES you can.

The 1st thing you need to ask yourself under similar circumstances is:

• Is this Personal Data?

Personal Data is any Data which on its own (like a photograph) or when cross-referenced with other Data allows the identification of a specific natural person.

So, in this case, you either have a registered user and then yes it is PErsonal Data for you can identify the Data Subject; or no, you have just a visitor IP address and then it is not PErsonal Data for the maximum you can do is to identify a "known IP".

The 2nd thing you need to ask yourself is:

• What is the Lawful Base to Process this Data?

Since the user will benefit from the Processing of this Personal Data, by having the information permanently tunned in advance to his/ her browser, you are acting on both your as well as the Data Subject's Legitimate Interest (not Consent).

Now, there is a 3rd question to be asked and that derives from the needed LEgitimate Interest Impact Assessment that you need to do in order to validate using Legitimate Interest as the Lawful Base for Processing, so:

• What is the potential Risk that renders your Corporate LEgitimate Interest void in face of the Data Subject's Legitimate Interest to his/ her Security; Privacy and Confidentiality?

• Security-wise registring the Browser window size does not pose any risk, so ... checked.

• Confidentiality-wise, it is not a "topic" that may be considered "confidential", in the sense that its disclosure may represent negative consequences for the Data Subject.
• Privacy-wise, it is also not a topic that the Data Subject may want to maintain confidentially, for it does not bear risk nor is it "critical".

So, you may proceed yet you need to make clear in your Privacy Policy or a disclaimer that you gather such Data and WHY/ HOW you process it (advantages for the user included) and that the Lawful Base is LEgitimate Interest (your's as well as the Data Subject's... do not forget that).

Last you need to allow the Data Subjects to exercise their rights if they do so desire, meaning opting out from this processing activity.

Hope this was clarifying.