12

I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:

  1. User inputs their email
  2. If the email belongs to an existing user, report this via an error message. This might be on submitting the form or immediately as the user inputs the email.

The issue here is that an (unauthenticated) user can use this to determine what emails are in use in the system. From a technical perspective there are ways to limit the damage (e.g. rate limiting) but my question is what the GDPR implications are of such a vulnerability, and what responsibility does the developer/company have to avoid this?

I'm aware the emails are categorised as PII, which leads me to believe that it is an issue. However, it's also very common to see this flow in the wild.

For context I'm based in the UK and work for a company operating in the UK and EU.

2
  • 1
    What is your specific concern, that anyone can check if a particular email is registered? Also, what alternative would you suggest — to pretend that the registration goes ahead fine, "check your email for message" (which you will not in fact send if the user is already registered)?
    – Greendrake
    Aug 24, 2021 at 10:25
  • 1
    Yes that's my concern: you could check a specific email or you could spam possible emails to determine a list in bulk. What you've described is often considered the 'best practice' from the software security perspective. Usually it's hard to argue for to a stakeholder though as it's a much worse user experience e.g. if a user genuinely inputs their own email with a typo, you don't tell them that which is confusing. Basically, I'm interested if it's a problem legally to answer yes/no to 'does this email belong to a customer of yours?'
    – MichaelJK
    Aug 24, 2021 at 10:37

1 Answer 1

12

This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked.

Note that it is not necessary to consider "enumeration" here. Even just being able to check whether one person has a registered account raises the issue.

The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added):

Article 4(2): 'processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

So, disclosure of the fact that a user has a registered account amounts to "processing".

Article 6(1): Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Of these, only (a) and (f) are likely to be of any relevance:

  • (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give).
  • That leaves us with (f). As noted by the Information Commissioner's Office, "Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.".

The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be "necessary" for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest.

Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point.

If the processing is unlawful then Article 18 is applicable:

  1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead

  2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request.

Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items:

Article 13(1): Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: [...] (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.

9
  • 2
    Perfect answer. Legitimate interest always requires a balancing of the various interests, and this depends a lot on context. E.g. membership on a dating site might be much more sensitive than having an account with a home insurance provider. In any case, the data controller has an obligation to account for relevant risks and implement appropriate technical and organisational measures (compare Art 24, 25, 32 GDPR).
    – amon
    Aug 24, 2021 at 10:58
  • 1
    Great answer. I would question that the "accepting the duplicate registration followed by sending an email to the account holder" would be less user friendly. If you are really trying to sign up then to get a "have you forgotten your password" email rather than a fail would probably be better.
    – Dave
    Aug 24, 2021 at 11:15
  • 7
    The workaround here is to ask the user to verify their email address immediately after they enter it. Then you can send new addresses a 'here is your verification code' email, while existing ones get told 'you already have an account'.
    – avid
    Aug 24, 2021 at 18:41
  • 1
    This answer discounts consent as a useful option, but it seems fairly simple to include a "by registering on this site you agree to our terms of service/privacy policy/etc" checkbox. Am I missing something?
    – Dan
    Aug 24, 2021 at 22:14
  • 1
    @dan The GDPR prohibits compulsory consent as a condition of the contract unless consent is necessary for the controller to perform the contract (see Article 7(4) and recital 32). Consent can also be withdrawn at any time (Article 7(3)). Consent is separate to legitimate interests so there is no balancing exercise we can do and in this scenario, the service can be provided without needing consent to reveal the user during sign up.
    – JBentley
    Aug 25, 2021 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.