0

If I ask user to enter their faviourite laptop and transmit that information am I being GDPR non-compliant?Basically is user opion voluantarily given and o;ptional PII under GDPR

2

Personal data is any information relating to an identified or identifiable person (Art 4(1) GDPR). It is not necessary that the personal data is in itself identifying. PII is an US concept that has nothing to do with GDPR.

An opinion of a person clearly relates to that person, thus processing someone's opinions is likely to be processing of personal data. This would clearly be the case if the opinion is stored in a database and associated with an user ID that serves as an identifier.

Even without such an identifier, it may be possible to use contextual information to indirectly identify the person. When analyzing identifiability, we must consider all methods that would reasonably be available to you. Note that identification under GDPR doesn't mean “tying to a real-world identity” but also “singling out”. Thus, even pseudonymous data is personal data.

Therefore: you should assume that any user-related data is personal data, unless you are very sure that you have no reasonable means to identify them (i.e. that the data is truly anonymous).

When you process personal data and fall under the GDPR's territorial scope, your processing will need to comply with the GDPR. This involves among other things a legal basis such as valid consent.

9
  • I am telling you a more specific use case here basically I will optionally ask to user to enter tgheir opinion so that I can tell GooGLE what they like and use non personalized ads rmgd.What is your judgement here?
    – ask
    Nov 24 '20 at 7:05
  • The information will not be stored on any server but storage is only on user device.
    – ask
    Nov 24 '20 at 7:05
  • 1
    @ask GDPR applies to any processing of personal data, not just to storage. Sending data to Google to help them build an interest profile on that person sounds very much like processing of personal data.
    – amon
    Nov 24 '20 at 7:11
  • So the final thing is if one wants to personalized user experience gdpr will stop that.
    – ask
    Nov 24 '20 at 7:17
  • 1
    @ask It is difficult for a business to comply where that business makes its money through ads or through selling data. Normal businesses that sell actual goods or services usually have an easier time. Not sure what Russia has to do with any of this, though.
    – amon
    Nov 24 '20 at 8:31
0

If I ask user to enter their faviourite laptop and transmit that information am I being GDPR non-compliant?

Transmitting only the user's favorite laptop (be it type, brand, model, or other characteristics) does not violate the GDPR because that information definitely neither identifies nor helps identifying a natural person.

2
  • What the person is the only person who uses that laptop or model ?
    – ask
    Nov 23 '20 at 14:55
  • "What the person is the only person who uses that laptop or model ?" That is unrealistic. Even if that were the case, the ability to identify that person just from that particularity suggests that this was common knowledge beforehand. Nov 23 '20 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.