2

According to GDPR (DSGVO in Germany), would it be allowed to save an address without a name of the person?

Would it also be allowed to do the same with a hash of the persons name? The name of the person can not be created with the hash but if someone tells me a name, I can recreate the hash and check if it was the same person that I have the address from.

1
  • 1
    What is the context here? For what purposes are you collecting addresses? If you're just keeping a long list of all addresses in a town (e.g. for creating a map) that's probably not personal data because it doesn't relate to individuals. But individual addresses are quite identifying even without the name. And your hashes are still personal data because you can still identify the data belonging to a person through the mechanism you explained.
    – amon
    Aug 18, 2021 at 13:15

1 Answer 1

3

The GDPR does not put specific limits on what information can be saved, or what it must be associated with. But an address can fairly easily be related to a particular natural person, and so it is PI, and probably PII. Therefor, under article 6, there must be a lawful basis for saving it, and there must be a purpose (or purposes) for saving and processing it. The basis might be consent, or one of the other permitted lawful bases. It would be improper to use it beyond the original purpose without properly notifying the Data Subject, and in many cases obtaining consent to the revised purpose.

A one-way hash created with a good hashing function, that cannot be associated back to the address (or name or whatever PI) is not normally PI, and the GDPR does not put limits on its processing, unless there is a way to associate it with a natural person, or the data is already associated (such as by being part of the same DB record)

(PI is "Personally Information, PII is "Personally Identifiable In formation.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .