0

In Europe, developing Android and iOS Apps, server backend hosted in Azure, on behalf of a customer. The Apps are line-of-business for internal users only, accepting sign-up/login as the work email address of the user. Does GDPR require that these apps fulfill GDPR requirements for use of the users' personal data (which in this case is exclusively the email address , potentially the user location)?

Extensive research on the topic does not seem to yield any definitive answers.

To be clear, does having a simple login form to a work-only app which requires only the work email address mean that the app must fulfill GDPR active consent to login, use the email, display ToC/Privacy etc?

Improve this question

2 Answers 2

Reset to default
2

Does GDPR require that these apps fulfill GDPR requirements for use of the users' personal data

The simple answer is yes - e-mail addresses (even work ones) are still personally identifiable information (PII) and fall under GDPR.

does having a simple login form to a work-only app which requires only the work email address mean that the app must fulfill GDPR active consent to login, use the email, display ToC/Privacy etc?

If this is a work-only app and logging in (or more specifically having an account associated with that e-mail address regardless of whether they actually login or not) then it might not require "active consent", active consent is only one of the potential legitimate bases for processing PII. If the app is necessary for the functioning of the business then it could fall under "legitimate interest".

To determine whether this may apply there's a three-part test, since the customer is going to be the one actually using the e-mail addresses here, it's really them that need to address these aspects:

Identify a legitimate interest

If the need to login and use the app in the course of doing the individual's job, then that's likely a legitimate interest.

Show that the processing is necessary to achieve it

Does carrying out the business purposes the app is used for require the person to be identified?

Balance it against the individual’s interests, rights and freedoms

This is about considering the potential impact on the individual by doing this, and it means asking yourself some questions. Would the individual reasonably expect you to use the PII in this way? Would using the information in this way cause them unwarranted harm? How sensitive is the information? What safeguards do you have int

Improve this answer
3
  • 1
    As additional background to consent vs legitimate interest, it is almost never appropriate to rely on consent as a legal basis in an employment context, due to the power imbalance: the employee can't really refuse, and doesn't have a free choice. See also paragraphs 21–23 in the EDPB's guidelines on consent 05/2020.
    – amon
    May 14, 2020 at 17:16
  • @amon This is very interesting. I will have a think about this and maybe reformulate my question at later. This notion of legal basis for compliance is interesting too. Thanks.
    – Frank
    May 14, 2020 at 19:55
  • @amon That's a good find!
    – motosubatsu
    May 15, 2020 at 9:47
1

Yes

The email address identifies an individual in the EU. Therefore, GDPR applies. Whether that requires "active consent to login, use the email, display ToC/Privacy etc" depends on the reason the data is being collected/stored. For example, consent is the last reason you should turn to for collecting personal data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .