9

Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). This is false as hashed email addresses are still considered personal information under the regulations as it is still may be possible for the data controller to identify the actual email address associated with the hashed value i.e. the data controller still has personal information stored of the user. Pseudonymized data is still unequivocally considered personal data under the GDPR, as noted in Recital 26.

GDPR Recital 26 states "Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. "

Under GDPR & EPD a persons hashed or un-hashed email address can be considered personal information. GDPR & EPD require user consent before storing a users personal information.

Websites need a way of blacklisting malicious users i.e. add the users email address to a blacklist to prevent them logging into the website.

Similarly when a user deletes their account on a website their email address may be added to a blacklist to prevent another account being opened with the same email address for various security and management reasons.

Under GDPR a user has the right to be forgotten and can request that their personal information be deleted.

Are we allowed to keep the users email address in a blacklist if they request that their personal information be deleted ?

Improve this question
3
  • related law.stackexchange.com/questions/37882/…
    – Lag
    Commented Jul 29, 2020 at 7:32
  • Notes: (a) while relevant, recitals are not provisions of a Regulation; (b) Directive 2002/58/EC is not relevant, but the enabling act in the applicable jurisdiction may be; (c) a hash is only personal data if it can be combined with other data the controller has, to identify a specific natural person, so if you get rid of the email address but retain the hash, the hash by itself is not personal data - I have implemented exactly this solution for the same problem; and (d) the right to erasure is not absolute and has exceptions/exemptions including national derogations. Where are you?
    – Sam_Butler
    Commented Aug 6, 2020 at 16:09
  • @Sam This would be for Ireland where we are subject to the Irish Data Protection Commission (DPC). Are you using MD5 for hashing ?
    – user32690
    Commented Aug 6, 2020 at 19:39

2 Answers 2

Reset to default
17

GDPR & EPD require user consent before storing a users personal information.

Wrong.

User consent is one of the ways that justify storing personal information, but there are others.

You may check art.6 to see the several reasons that allow to store personal information.

In this case, it seems reasonable to justify it under the paragraph f

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Of course, that means that the data has to be used for this purpose. Avoiding spammers and other banned users would be such a purpose, but you should ensure that you do not send those e-mail address commercial information or even a Christmas greeting.

In any case, be careful with anything you store. If along with the e-mail you stored more info, this could be interpreted as excessive and beyond the scope of paragraph f. For example, imagine storing "User wrote nazi statements" explaining why the e-mail is banned; EU laws are very restrictive about storing information about political or religious beliefs.

Improve this answer
14
  • 9
    This is the correct answer. I use hashes when remembering to forget. The nice thing about only storing an email hash instead of the actual email address is that there's no way to accidentally send a Christmas greeting.
    – Andrew Brēza
    Commented Jul 28, 2020 at 15:03
  • 3
    @MikeMoy "why are the users interests or fundamental rights and freedoms overridden by a blacklist ?" - they aren't. "it is a regulation which each European country in-acts into law though local legislation in each country". No, that's how EU directives work. EU regulations such as the GDPR apply directly.
    – richardb
    Commented Jul 28, 2020 at 16:31
  • 7
    @MikeMoy It's hard to imagine circumstances where a court would find keeping an email blacklist would be a breach of fundamental freedoms, or even a regulator think it worthwhile taking action. You don't know for sure but you don't have to outrun the bear either.
    – richardb
    Commented Jul 28, 2020 at 18:35
  • 3
    @MikeMoy A worried platform should call the regulator with the query and invest in competent legal advice if still concerned.
    – Lag
    Commented Jul 28, 2020 at 21:30
  • 3
    @MikeMoy "I do not think a small platform should have to take legal advice for such a common thing as blacklists" - we have to deal with the law as it is, not how we think it should be. I'm trying to offer practical advice - you can help yourself, quite easily if my experience today is anything to go by. You think "the legalities are not clearly defined". You seem to disagree with the apparent consensus here. Why not do what I did and contact your data protection authority? It will cost you nothing but time.
    – Lag
    Commented Jul 29, 2020 at 12:34
8

The article 17 right to be forgotten aka the right to erasure is not absolute.

Assuming you lawfully recorded the email address, if the email address is necessary for the purpose for which you collected or otherwise processed it then you aren't obliged to erase the email address on request.

Seems to me you have a 'legitimate interest' under article 6(f) to store the email address - if it's personal data. An email address isn't necessarily personal data.

(Your right of freedom of expression, with regard to what your platform publishes/serves to the public, may be relevant, in which case the right to erasure cannot be applied.)

GDPR & EPD require user consent before storing a users personal information.

GDPR does not require consent. Consent is one of the six lawful bases (see Article 6) for processing personal data.

The EPD seems irrelevant in the context. You do not want to market to these email addresses. You do not want to store data on their devices.

[edit]

I contacted the Information Commissoner's Office for guidance. The ICO is the UK's data protection authority. The guidance was:

  • If you can justify the necessity of keeping the email address on the blacklist it is lawful to keep it

  • The rights to object and to erasure are not absolute and can be refused in some circumstances, e.g. when the organisation can justify that it's necessary to keep the data

  • An automated process for refusing erasure requests in the context is lawful provided you can justify refusing each request

I recommend you seek guidance to satisfy yourself about your particular circumstances and concerns.

Improve this answer
6
  • @MikeMoy Yes you do have to delete everything if the data was (foolishly) collected under consent. But if the data was collected under legitimate interest they can object to further processing (Art 21) and eventually ask for erasure (Art 17). However, you can invoke “compelling legitimate grounds” (Art 21(1)) or “overriding legitimate grounds” (Art 17(1)(c)) to deny the objection/erasure request. For the purpose of enforcing a ban, this would let you keep the email address (or a pseudonymized version thereof, as may be required via the data minimization principle).
    – amon
    Commented Jul 28, 2020 at 17:31
  • 1
    @MikeMoy Agreeing to terms of service or a privacy policy does not constitute valid consent per GDPR Art 7. Most kinds of processing of personal data are based on legitimate interest or legal obligations, not consent. I'm pretty sure that StackOverflow keeps your email address + last IP address if you're banned. And I often hear stories about websites that outright refuse to delete banned accounts, but I think that's illegal. (To clarify: keeping necessary data is probably OK, refusing an erasure request outright is not OK.)
    – amon
    Commented Jul 28, 2020 at 19:16
  • 1
    @MikeMoy If you're worried then consult your local equivalent of the UK's Information Commissioner's Office for guidance. ico.org.uk/for-organisations/guide-to-data-protection/…. ICO guidance is that you can refuse an erasure request if "the request is malicious in intent and is being used to harass an organisation with no real purposes other than to cause disruption."
    – Lag
    Commented Jul 28, 2020 at 19:31
  • 1
    @MikeMoy 1. Email addresses are not necessarily personal data, so in the context the GDPR is irrelevant with respect to those. 2. Why do you think manual reviews are required? There's no difference between a person and a machine following a standard process that determines if an email address should be on a blacklist and whether an erasure request for that is refused or complied with.
    – Lag
    Commented Jul 28, 2020 at 20:59
  • @MikeMoy please see my edit.
    – Lag
    Commented Jul 29, 2020 at 9:31

You must log in to answer this question.