Does GDPR require anonymization of user idents when used in testing and development?
User idents will identify an employee by other employees because it's linked to login system. Outside of the company they may only hint to which employee if a list of employees is available. The usage is purely auditing, who created and edited data.
Where does this stand within GDPR regulations? Do you need consent from an employee for such ? "Can your work be visible to other employees?". I would think consent is implicit just by working there?
User idents
By user idents I mean such as windows login name, LDAP short names such as "PDIG". These identify the operator making data edits and they appear in almost every database table/row with typical column names such as created_by, modified_by, similar to how files are stamped in a filesystem. In my recent anonymization jobs I find that this represents about half the processing time and often appear in primary and unique indexes, thus creating challenges with data constraints in the anonymization programs.
Why do this?
I currently have gone through a lot of anonymization work at current client, some of which is complicated because of database constraints and relations.
** Yes they are indeed person-identifying data, but they just identify an employee internal to the company and are never sensitive. Do one have to hide the fact that people worked there?
I have the feeling that this is ok with GDPR, but since it is somewhat unclear we have currently ended up anonymizing it anyhow.