This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked.
Note that it is not necessary to consider "enumeration" here. Even just being able to check whether one person has a registered account raises the issue.
The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added):
Article 4(2): 'processing’ means any operation or set of
operations which is performed on personal data or on sets of personal
data, whether or not by automated means, such as collection,
recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction
So, disclosure of the fact that a user has a registered account amounts to "processing".
Article 6(1): Processing shall be lawful only if and to the extent that
at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Of these, only (a) and (f) are likely to be of any relevance:
- (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give).
- That leaves us with (f). As noted by the Information Commissioner's Office, "Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.".
The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be "necessary" for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest.
Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point.
If the processing is unlawful then Article 18 is applicable:
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...]
(b) the processing is unlawful and the data subject opposes the
erasure of the personal data and requests the restriction of their use
instead
Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed
with the data subject’s consent or for the establishment, exercise or
defence of legal claims or for the protection of the rights of another
natural or legal person or for reasons of important public interest of
the Union or of a Member State.
In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request.
Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items:
Article 13(1): Where personal data relating to a data subject are
collected from the data subject, the controller shall, at the time
when personal data are obtained, provide the data subject with all of
the following information: [...] (c) the purposes of the processing
for which the personal data are intended as well as the legal basis
for the processing; (d) where the processing is based on point (f) of
Article 6(1), the legitimate interests pursued by the controller or by
a third party;
So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.
