I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form.

If a user includes personal information (e.g. their email) in the form, what is its status under the GDPR (and other similar regulations)? I am not actively cataloguing this information, but it can be used to easily identify a person.

  • I am aware that security.SE isn't mainly for privacy, but I chose this site as the least bad place to ask after reading this meta.SE question: meta.stackoverflow.com/questions/345480/… . By the way, the second part of your comment could easily be made into an acceptable answer to this question. Aug 28 '19 at 9:02
  • Privacy can be on-topic here. But you're asking an interpretation of a regulation. That puts it outside our scope.
    – schroeder
    Aug 28 '19 at 11:02

The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data.

GDPR does even apply to anything offline and on paper.

Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.

  • Basically it means you have to validate any entry field is free of PII before processing it. - When you are validating it, you are already processing data. But you don't have to validate if data contains PII where you don't expect it. And GDPR only applies to non automatically processed data when it's (intended to form) part of a filing system.
    – wimh
    Aug 28 '19 at 19:29
  • Validation and processing here are not the same. and are context dependent. GDPR does not care about whether its a filling system or not (unless by filing system you mean anything that stores the data in any form. than yes). The Methodology I outline is for when you do noyt intend a specific piece of data to have PII, but does. The validation is in that case done (usually) by a human and the subsequent actions (usually) by machine. Intend matters in GDPR but there are provisions for 'accidental uses. (i.a. not intended but due to scope still applicable to the GDPR laws.)
    – LvB
    Aug 29 '19 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.