Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other words, they only need to click on the link, no username or password is required for the customer to access the info).
The GDPR does not tell you whether some technical approach is compliant or not. Instead, it requires you, the data controller, to analyze the possible risks to the data subjects (compare Arts 24/25). Where you identify risks, such a use may become compliant if you implement appropriate measures to mitigate the risks. In some cases, you may be required to write a formal Data Protection Impact Assessment (DPIA) per Art 35. Even if not required, creating such a document can bring clarity.
The security problems of your hashed URLs are more an infosec issue than a legal issue. A couple of pointers:
- a hash only summarizes the input data – if the input is guessable, an attacker has access
- using a strong random number to generate a token is likely more preferable than a hash
- this is industry standard in many applications. While this prevents discovering the URL (e.g. via enumeration attacks), it doesn't control who actually has access to the URL.
- alternatively: signing tokens with a public/private key system can make them unforgeable, compare how JWT works
- risks can be reduced if the token is a nonce (can be used at most once)
- risks can be reduced if the token is only valid for a limited time (e.g. 48 hours)
Time-limited nonces are often used in password reset flows. Hashed, signed, or random tokens are often used in email unsubscribe links. Random URLs are often used in content delivery networks for non-sensitive data. If repeated, long-term access to personal data is required, asking the user to sign in to their account is likely going to be the only viable approach.