Under GDPR, are service operators allowed to record all clicks of logged in users?

Question

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either:

• The user consents to having that piece of data collected while being able to maintain access to the service if the decline to consent
• There is a direct business need to store that data
• There is a legal need to store that data

However, consider the following scenario:

• There is a web app that requires users to log in to access
• Users can not log in unless they agree to the terms and conditions
• Once logged in all button clicks (and keystrokes on the site) by users are recorded (on the service operator's servers)
• This recording behavior is described in the terms in conditions
• The service operator needs to collect this data in order to identify how to improve their service in the future

Is such a scenario allowed? My gut inclination is that it would not be allowed since the need to identify future service offerings is not "direct" and that one of the benefits allowed by GDPR is that individuals have the right to opt out of analytics tracking while continuing to be able to use services. However, a counter argument that could be made is that this business need is direct. Which interpretation is correct?

Answer 1

This would probably fall under the "legitimate interest" basis. However the service provider would need to show that the processing they did was aimed at this objective and in accordance with the data protection principles, particularly of data minimisation and storage.

They should consider what data they want to extract from the detailed logs, whether the logs can be anonymised, how long they need to keep them, and whether they can achieve their objectives by storing aggregate data (e.g. percentage of people who clicked this link when viewing this page) rather than individual clicks and key presses. They should also consider whether the logs might reveal special category data (e.g. health, sexuality, religion, politics). This can happen if, for instance, the site contains information about a particular disease; people who read it are likely to have that disease or know someone who does.

Answer 2

You are correct that any processing needs a legal basis (although there are more than the three you listed, compare Art 6(1)). Strictly speaking, it is not the processing but the processing purpose that requires a legal basis.

There is also no legal basis that broadly allows any “business need” or requires that business needs be direct. Instead, there is:

• necessity for performance of a contract, which is fairly narrow.
• legitimate interest, which requires the legitimate interest to be balanced against the data subject's interests. Legitimate interest is an opt-out approach: the data subject must generally be able to object to this processing.
• consent, which allows anything but requires the data subject's explicit, specific, informed, and freely-given opt-in.

Processing must also be known to the data subject (transparency principle) and must only collect data that is necessary for that purpose (data minimisation principle). The processing must be proportional to its purpose.

The purpose of improving services is clearly covered by legitimate interest, so that first-party website analytics are generally fine (as far as the GDPR is concerned, but note that any involved cookies may require consent under ePrivacy).

But the mechanism of capturing all clicks and keystrokes will generally be excessive for that purpose. Recall that legitimate interest requires the legitimate interest to be balanced against the data subject's interests. Here, the data subject's interests to not be subjected to that level of surveillance would probably outweigh any legitimate interest in these analytics.

That the data collection is disclosed in the terms of service does not matter here: that is required for transparency, but the agreement to these terms does not fabricate consent in the sense of the GDPR (the agreement is not sufficiently specific).

Since such keystroke tracking is highly invasive, the controller would likely have to write an Art 35 Data Protection Impact Assessment, regardless of the chosen legal basis. In general, it is the responsible data protection agency's call whether such DPIAs are required. A DPIA helps defend the controller's decisions before the DPA, and in some cases prior DPA approval is required (Art 36).

So are these mouse and keyboard analytics forbidden? Not outright. But to use them the controller would need to clear a very very high bar and the chance of that is quite slim. Most likely, the processing as described is a GDPR violation.