If your app is "targeted" at residents of the EU and anyone currently located in the EU uses your app, the GDPR will apply. If the application operator is located in the EU, the GDPR will apply. If anyone who is a resident of California uses the app, the CCPA (TITLE 1.81.5.) will apply. The data protection and privacy laws of other countries may well apply as well.
Under Article 4 section (1) of the GDPR:
personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
This means that under the GDPR an Email address is definitely personal data. An IP address is usually personal data. Anything that relates to a user that can be identified is also personal data.
An email address is also personal information under the CCPA.
Under GDPR article 6 there must be a lawful basis for processing (which includes storage) of any personal information. The most likely basis for the situation described in the question is the consent of the data subject. Consent must be freely given, and may be revoked at any time.
Under CCPA section 1798.100 (a), a business that collects personal information must inform consumers of:
- (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared.
- (3) (3) The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.
Under Article 15 of the GDPR a data subject has the right to ask what information the data controller is processing (including storing). The CCPA provides a similar right under section 1798.110. Under Article 17 of the GDPR a data subject has the right to request that the data controller delete such information. The controller must comply unless there is another lawful basis for continues processing. There are some complexities in regard to when a controller may decline such a request. The CCPA provides a similar right under section 1798.105.
In short an application operator must respond to questions from users about what information the app has on file about a particular user, and how it is used, and must delete such info on request unless there is good reason to retain it. details vary.
Under Article 24 of the GDPR
- Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
- Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
Under CCPA section 1798.100 (e)
A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.
In short an operation must use reasonable security measures to keep user information confidential, except where users have agreed to it being made public. What is reasonable will depend on the nature of the app, and the kind of information it is likely to process an store.
It is good practice to generally indicate what information is secured, and the overall degree of security in use, but not the specific measures taken. If information is not highly secure, users should be aware of that before they entrust highly sensitive data to the app.
Neither the GDPR nor the CCPA provides any exceptions for "small" controllers/businesses/operators, although the GDPR provides an exemption for "household" use. That would not apply when any person on the net is able to register an account and use the app.
If I'm storing just an e-mail address and unique identifier key in the database for login, would this in itself, be identifiable information? Would a user storing the text string "Mop floor tonight" be considered personal data?
Any data that is associated with PII, such as an email address therby* becomes personal data (PD). If a given row of the apps DB has "[email protected] " in the "email" column, and "mops flops" in the "uploaded text" column, then "mops flops" has just become PD relating to Joe. This leal framework applies to all users.
In the app as described in the question, the obvious and plausible legal basis fore processing is consent. One need simply obtain consent from every user to store and process that user's login details and all test uploaded by that user. If the user revokes consent, remoe the user from the DB. There is nothing special about a "sync" command. Once you have PD for a user on any part of the controller's system, a basis is needed.
