Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other words, they only need to click on the link, no username or password is required for the customer to access the info).

  • 1
    To what data does the hashed URL allow access? Name, address, date of birth, credit card numbers, medical conditions, family members details ...? – Lag Sep 4 '19 at 12:17
  • Information about the customer's journey (travel dates, locations etc). – Mark Fox Sep 4 '19 at 12:27
  • What data is used to generate the hash? Is that data predictable or guessable? – Philipp Sep 4 '19 at 12:51
  • We have not decided upon that aspect yet. The hashing solution doesn't seem sufficient under GDPR though. – Mark Fox Sep 4 '19 at 13:07
  • 1
    Why hashing? If you go that way, using a (safe) random number generator to generate the link is a lot safer without any disadvantages. – kat0r Sep 4 '19 at 14:26

The GDPR does not tell you whether some technical approach is compliant or not. Instead, it requires you, the data controller, to analyze the possible risks to the data subjects (compare Arts 24/25). Where you identify risks, such a use may become compliant if you implement appropriate measures to mitigate the risks. In some cases, you may be required to write a formal Data Protection Impact Assessment (DPIA) per Art 35. Even if not required, creating such a document can bring clarity.

The security problems of your hashed URLs are more an infosec issue than a legal issue. A couple of pointers:

  • a hash only summarizes the input data – if the input is guessable, an attacker has access
  • using a strong random number to generate a token is likely more preferable than a hash
    • this is industry standard in many applications. While this prevents discovering the URL (e.g. via enumeration attacks), it doesn't control who actually has access to the URL.
  • alternatively: signing tokens with a public/private key system can make them unforgeable, compare how JWT works
  • risks can be reduced if the token is a nonce (can be used at most once)
  • risks can be reduced if the token is only valid for a limited time (e.g. 48 hours)

Time-limited nonces are often used in password reset flows. Hashed, signed, or random tokens are often used in email unsubscribe links. Random URLs are often used in content delivery networks for non-sensitive data. If repeated, long-term access to personal data is required, asking the user to sign in to their account is likely going to be the only viable approach.

| improve this answer | |
  • Thank you for this very helpful answer. – Mark Fox Sep 5 '19 at 12:35

No, not at all. Hashing achieves no relevant legal benefit; it only makes the URL shorter.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.