5

I've read GDPR document from start to end, but I am still not sure about one thing.

Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt).

Will this violate GDPR if I have those stored in database without the owner consent, given there is no other data collected, no names, emails, nothing. They are not linked to any user (there are no users in the system actually). Just the phone number in a hashed form (same things as storing a hashed password).

From what I understand if the data is anonymised there is no problem, but I am still not sure, because if you have the salt you can still create hashes of phone numbers and compare them to the hashes that exists in the database. But this gives you nothing even if you succeed, except that the phone exists there.

Improve this question
1
  • 6
    I'd recommend saying hashing throughout your post. Saying encryption for actually hashing is non-standard terminology. In fact, with proper CPA-secure encryption, even given the ciphertext, an attacker cannot determine if it's the encryption of a known plaintext. That is, there is no way the attacker could determine whether the phone number 123456789 is in there given its encryption.
    – ComFreek
    Mar 8, 2020 at 16:59

1 Answer 1

Reset to default
8

But that a phone number exists in your collection is interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be considered to be a secret key.

If the information had been anonymized it wouldn't be personal information and the GDPR wouldn't apply. However, since the phone numbers are personal information (even hashed, they relate to an indirectly identifiable person), you should apply standard GDPR compliance processes to determine whether storing these phone numbers is legal:

  1. What is the purpose of processing?
    • Some purposes like national security or purely personal and household purposes are exempt from the GDPR
  2. What is the legal basis for this purpose?
    • E.g. consent, legitimate interest, legal obligations, …
  3. What is the minimum data necessary to fulfill the purpose?
    • If pseudonymized data is sufficient, pseudonymization is mandatory.
  4. What safety measures do you think are appropriate?
    • This could shift a legitimate interest balancing test in your favor.
  5. What compliance measures are you obliged to take?
    • E.g. information per Art 13–14, preparation for data subject requests, engaging data processors, further safety measures.

While your purposes are probably benign, it can be useful to recall that the presence of identifiers in data sets can be a matter of life and death. When accounts were leaked in the Ashley Madison data breach, that drove some users to suicide. In some countries, the existence of a Grindr account can be a death sentence. Those are examples involving special categories of data per GDPR Art 9, so likely far more sensitive than the context of this question. However, in the AM breach it would not have helped much to hash identifiers like emails: third parties would still be able to check whether the email of someone they know was part of the breach.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .