GDPR compliance when people submit file with other's person personal data

Question

I've published a tool on my website, allowing people to submit a CSV file for a transformation into a XML file according to a governmental XSD. I would like to add a functionality that would allow people to get a link for downloading that XML file and share it with their team for instance.

The problem is that the input CSV file contains some sensitive data on employees of the company that uses my tool. For now, I do not ask consent for anything because I do not store the file on disk and there is no data on my server that can identify the user that uses the tool.

The new functionality would allow people to submit a file named 'myEmployees.csv' and to download the XML file on 'https://example.com/download/myemployees.xml'. Thus, anyone could download the file with the URL.

I would like to share a GDPR compliant tool but I'm not sure of the consent I should ask, how I should store the file on disk and how should I allow people to access the file ?

My current knowledge on this subject would make me add consent explaining my intent of storing the file (only for sharing file) and for how long. Maybe I can add a password that the user could set to allow access to the file, it might be more secure but is it really more GDPR compliant ?

Moreover, I read a few thread :
GDPR - User entering other peoples data
Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

For further information, the tool would not store the file for more than 12h time period.

Thank you for your help

Answer 1

From your description, it sounds like you will be a Data Processor rather than a Data Controller; you process data under instruction from a controller, but you don't make any decisions about what the processing is.

Processors do not have the same obligations as controllers under the GDPR and do not have to pay a data protection fee. However, if you are a processor, you do have a number of direct obligations of your own under the GDPR.

As a processor you will have to provide assurance to the Data Controllers (i.e. your customers) that you will process the data in accordance with their instructions, keep it properly confidential and so forth. You don't need to worry about the basis under which you are doing the processing; that is for the Data Controller to worry about.

If you are to return a file with the processed data to your client then you will need to make sure that nobody else can access it. For instance you might have a password-protected account, or you might encrypt the file and transmit the key to the customer by some other channel. The details are up to you, but you will be under an obligation to ensure that whatever you do provides effective security.

You will also need to ensure that your processing is accurate. A formal test system would be in order here, with proper version control, recording test runs etc. You obviously can't prove its perfect, but you do need to be able to demonstrate that you took due care.

Answer 2

Maybe I can add a password that the user could set to allow access to the file. It might be more secure but is it really more GDPR compliant?

To the extent that it increases compliance with article Article 1(1)(f), yes:

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Increasing security generally increases GDPR compliance. Whether it is fully compliant is of course another question.

I'm not sure of the consent I should ask, how I should store the file on disk and how I should allow people to access the file.

If you're not sure of these things, you should probably hire a GDPR implementation consultant. In general, consent is only necessary if there is no other basis for lawful processing, but it may be useful to have consent to protect against possible challenges to other bases. As noted above, the method of storage should be reasonably secure; it should probably be stored according to accepted industry standards for the security of such information, the details of which are off topic here. The same may be said of access methods. For example, you will want to be reasonably certain that the person downloading the file is the same person who uploaded the source.

there is no data on my server that can identify the user that uses the tool.

Are you sure? Even IP addresses have been found to be personally identifiable information. If you really want to cover your tracks, you should have a thorough audit of your systems. Of course, you'll also want to investigate the potential consequences of being found in violation, because these will be needed to decide how much money you should spend on the effort to bring your systems into compliance.