1

I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added a function which uploads the log file to our ftp server, which is only visible to us. The log does only contain information about the update process, no personal data. But in order to know from which customer this log came he can fill out in the GUI his company name and location. Otherwise we wouldn't know to whom the log belongs to.

My question is: Do I need to add a checkbox that the customer agrees sending the log + customer name + location or not? Better would be if not because then not everyone will send the log. But only if it's compatible with GDPR and data privay laws. And if it's needed, is a checkbox where the customer agrees enough?

Improve this question

1 Answer 1

Reset to default
1

he can fill out [...] his company name and location.

You only talk about data which identifies a company.

Article 2 GDPR contains:

  1. This Regulation applies to the processing of personal data [...]

Article 4 GDPR contains:

(1) ‘personal data’ means any information relating to an identified or identifiable natural person [...]

So the GDPR does not apply to legal persons like companies. So there is not privacy related issue.

However you have to keep in mind that data about employees is personal data. So if your log contains the (login)name of the person performing the update, it is personal data, so the GDPR would apply.

Of course if one of your customers is a natural person, or a sole proprietorship, then GDPR also applies.

Improve this answer
2
  • Ok, I understand. Well good point with the login name. If the user who performs the update fails to login it could be in the log. Does this mean a login name like pparker is already personal data?
    – user1673665
    Sep 12, 2019 at 7:45
  • A login name is personal data because it uniquely identifies a single person. So you will need a lawful base to process that data. Consent is one of them, but you will be better off if you can base the processing on another base, like legitimate interest, because consent can always be withdrawn. You need to determine that yourself, in particular on how important it is to process that data.
    – wimh
    Sep 12, 2019 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .