7

I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services.

Beyond that, my intention is just to store in my 3rd party cloud service provider the country where the user resides. Any other information like name , picture , etc , would be stored in the user’s device.

Do I need to be GDPR complicant for this ?

Improve this question
1
  • 2
    Please ask someone knowledgable whether your plan actually works on a technical level. If the user buys a new phone, if the user uses your app for years, and so on. How bad is it for me if I can't access my data because my UUID is lost?
    – gnasher729
    Commented Aug 18, 2022 at 10:57

2 Answers 2

Reset to default
5

It depends.

Can the data controller or another person, with "means reasonably likely to be used," (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person?

If yes, it is personal data within the meaning of the GDPR.

If no, it is not personal data within the meaning of the GDPR.

Anonymous data is not subject to the GDPR. "The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes."

Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing "personal data". But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data.

Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your "lawful basis" for processing the data and how you decided that.

Improve this answer
2
  • My idea is to have a database in some cloud provider which I will store the uuid, and the country where the user is from. The rest of the standard user data say name , last name , etc , will be stored in the users physical device, meaning that I won’t collect such info. In case of a data breach, the thief will just have a bunch of random ids, and a bunch of countries.
    – user3240549
    Commented Feb 18, 2020 at 19:42
  • @user3240549: That's indeed a viable approach. It puts the customer in full control of his own data, and nobody else. Storing address information at country level is coarse enough. If you'd add city, street and housenumber you could try to identify a person, but even a small EU country has hundreds of thousands of citizens.
    – MSalters
    Commented Feb 18, 2020 at 20:11
2

Yes

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Improve this answer
3
  • It is not clear whether the OP fetches user name/pictures from their devices. If he does not (which is likely the case), the UUID does not at all help to identify the person "by reference to" it.
    – Greendrake
    Commented Feb 18, 2020 at 6:25
  • From the comment on the other answer, it appears that this UUID cannot be used to identify a natural person. The only two parties which have the UUID are the natural person and the data controller, but the data controller only has the UUID and cannot link that UUID to other data.
    – MSalters
    Commented Feb 18, 2020 at 20:14
  • In this situation, it appears that the UUID is an identification number for a device, and that the knowledge of the device identifier can then be used indirectly to identify the individual. Unless that is somehow not possible, then the UUID seems to be usable indirectly to identify an individual.
    – Brandin
    Commented Aug 18, 2022 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .