1

I want to create an online application. The visitor could enter his website URL then the application will make some analysis. The application asks the visitor if he wants a regular website report on e-mail. I don't want to store personal data as I don't want to write a consent or something else. So I will request the visitor to enter a (non personal e-mail address) business e-mail address like "[email protected]" or "[email protected]" to send the report to.

This should not be considered personal data, right? Some tips?

Thank you so much!

Improve this question

2 Answers 2

Reset to default
1

Is storing business data considered personal data?

No. Personal data refers to that of natural persons (i.e., human beings).

Your direction (if conspicuously stated) that the user enter non-personal data is a good idea, since it precludes a duty to comply with the GDPR. If notwithstanding your direction the user enters an email address with personal identifier(s), that user forfeits the protections enacted in the GDPR with respect to that email address.

Improve this answer
2

The accepted answer is wrong. The way of getting the data doesn't matter in light of the GDPR.

Whilst it is true that it has to be personal data (about individuals residing in the EU), personal has a very broad meaning (more examples). It is true that [email protected] is not personal data. However, when the user can be identified it is personal data, even if no explicit names are used (eg. [email protected]). Moreover, if you process any data that indirectly make a person identifiable (eg. location data, ip-address, certain id's, device id's, ...), it will also be personal data.

In any case, in no way does a user entering information against your directions lift your duty to comply with the GDPR. Because, the moment you process personal data (the way you got it doesn't matter) GDPR is applicable. And processing is a very broad concept under GDPR (more examples). Even 'shredding documents containing personal data' is processing. So, the moment data "passes through your code", you are processing data. Obviously, the risks will differ with different kinds of processing, but that's a risk that you have to assess (this is in fact an obligation under GDPR).

Improve this answer
8
  • Thank you! So, the moment data "passes through your code", you are processing data. I have a form: "Enter the name of your favourite pet." That's all the data I request (not the name, ip, cookies or something else) What if the visitor enters in that field: "My name is .... and my personal id is ... "?
    – MM PP
    Feb 15, 2020 at 12:58
  • 1
    @MMPP Yeah technically you will be processing personal data if they enter their name, even if it is on accident. Your organisational obligations might be just 'best-practices', but in any case data subjects (individuals) will still have their rights (see this ICO documentation). But tbh, if you do that minimal processing, you'll probably only get in trouble when someone files a complaint. So just make sure someone can contact you and data isn't abused.
    – Sasja Vandendriessche
    Feb 15, 2020 at 13:34
  • Thank you very much!
    – MM PP
    Feb 15, 2020 at 15:02
  • @SasjaVandendriessche "in no way does a user entering information against your directions lift your duty to comply with the GDPR". Wrong. Users cannot unilaterally create obligations the controller legitimately sought to preclude. A user's departure from the OP's direction forfeits GDPR protections. Suppose Bob spray paints his personal data on a wall knowing it is video taped and has a clear sign that prohibits posting personal data: Your rationale would lead to the absurdity that Bob's deliberate violation gives him GDPR rights he wouldn't even have if he followed a straightforward rule.
    – Iñaki Viggers
    Feb 25, 2020 at 21:44
  • @IñakiViggers You really should read up on the GDPR. GDPR's obligations greatly surpass the mere creation of subjective rights for individuals. Also, personal data get's its personal qualification irrespective of whether the data subject has (willfully) given it or not (see for example the definition of personal data and, indirectly, examine all the lawfullness grounds in article 6 GDPR). You qualify GDPR as an instrument that modulates how data is handled inter specified parties, but the goal was to create (enforce) more data awareness top-down.
    – Sasja Vandendriessche
    Feb 26, 2020 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .