0

If I ask user to enter their faviourite laptop and transmit that information am I being GDPR non-compliant?Basically is user opion voluantarily given and o;ptional PII under GDPR

Improve this question

2 Answers 2

Reset to default
2

Personal data is any information relating to an identified or identifiable person (Art 4(1) GDPR). It is not necessary that the personal data is in itself identifying. PII is an US concept that has nothing to do with GDPR.

An opinion of a person clearly relates to that person, thus processing someone's opinions is likely to be processing of personal data. This would clearly be the case if the opinion is stored in a database and associated with an user ID that serves as an identifier.

Even without such an identifier, it may be possible to use contextual information to indirectly identify the person. When analyzing identifiability, we must consider all methods that would reasonably be available to you. Note that identification under GDPR doesn't mean “tying to a real-world identity” but also “singling out”. Thus, even pseudonymous data is personal data.

Therefore: you should assume that any user-related data is personal data, unless you are very sure that you have no reasonable means to identify them (i.e. that the data is truly anonymous).

When you process personal data and fall under the GDPR's territorial scope, your processing will need to comply with the GDPR. This involves among other things a legal basis such as valid consent.

Improve this answer
9
  • I am telling you a more specific use case here basically I will optionally ask to user to enter tgheir opinion so that I can tell GooGLE what they like and use non personalized ads rmgd.What is your judgement here?
    – protectgoodlivingbeingask
    Commented Nov 24, 2020 at 7:05
  • The information will not be stored on any server but storage is only on user device.
    – protectgoodlivingbeingask
    Commented Nov 24, 2020 at 7:05
  • 1
    @ask GDPR applies to any processing of personal data, not just to storage. Sending data to Google to help them build an interest profile on that person sounds very much like processing of personal data.
    – amon
    Commented Nov 24, 2020 at 7:11
  • So the final thing is if one wants to personalized user experience gdpr will stop that.
    – protectgoodlivingbeingask
    Commented Nov 24, 2020 at 7:17
  • 1
    @ask It is difficult for a business to comply where that business makes its money through ads or through selling data. Normal businesses that sell actual goods or services usually have an easier time. Not sure what Russia has to do with any of this, though.
    – amon
    Commented Nov 24, 2020 at 8:31
0

If I ask user to enter their faviourite laptop and transmit that information am I being GDPR non-compliant?

Transmitting only the user's favorite laptop (be it type, brand, model, or other characteristics) does not violate the GDPR because that information definitely neither identifies nor helps identifying a natural person.

Improve this answer
2
  • What the person is the only person who uses that laptop or model ?
    – protectgoodlivingbeingask
    Commented Nov 23, 2020 at 14:55
  • "What the person is the only person who uses that laptop or model ?" That is unrealistic. Even if that were the case, the ability to identify that person just from that particularity suggests that this was common knowledge beforehand.
    – Iñaki Viggers
    Commented Nov 23, 2020 at 15:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .