First, hashed emails are personal data under GDPR. Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. With the same logic, the matching of hashed emails is a processing of personal data and is likely to produce new personal data.
- Article 2, Article 4(1) and (5 and Recitals (14), (15), (26), (27), (29) and (30) of the GDPR
- Article 29 Working Party Opinion 4/2007 on the concept of personal data
- Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques
Second, you must determine under which conditions personal data is used. The type and amount of personal data a company/organisation may process depends on the reason for processing it (legal reason used) and the intended use. The company/organisation must respect several key rules, including, but not limited to:
- personal data must be processed in a lawful and transparent manner, ensuring fairness towards the individuals whose personal data is being processed (‘lawfulness, fairness and transparency’);
- there must be specific purposes for processing the data and the company/organisation must indicate those purposes to individuals when collecting their personal data. A company/organisation can’t simply collect personal data for undefined purposes (‘purpose limitation’);
- the company/organisation must collect and process only the personal data that is necessary to fulfill that purpose (‘data minimisation’);
- the company/organisation must ensure the personal data is accurate and up-to-date, having regard to the purposes for which it is processed, and correct it if not (‘accuracy’);
- the company /organisation can’t further use the personal data for other purposes that aren’t compatible with the original purpose;
- the company/organisation must ensure that personal data is stored for no longer than necessary for the purposes for which it was collected (‘storage limitation’);
- the company/organisation must install appropriate technical and organisational safeguards that ensure the security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technology (‘integrity and confidentiality’).
- Article 5(1) and Recital (39) of the GDPR
- Article 29 Working Party Opinion 03/2013 on purpose limitation (WP 203)
You have provided limited relevant information. I am assuming that your technical and organisational safeguards are best-in class. Even if I also assume that the consent of the data subject has been obtain in a lawful, fair, and transparent manner, the information provided does not allow me to determine whether the way your organisation is matching hashed emails is legit or not under GDPR. Especially, I do not understand whether the information in the box is a full and accurate extract of your company/organisation's T&C, or equivalent documentation. I do not see a full disclosure of the purpose of the matching process. To put it in non-legal terms, I also do not see a reference to Facebook as a "data sub-processor". Your organisation may have a Data Protection Official as per GDPR. Please revert to this person to seek proper advice. Otherwise, your Legal Counsel may seek external advice.