0

If I track a 'questionnaire started' event with a user's GUID for analytics purposes server side, could that contravene any UK data laws such as GDPR or the ePrivacy / cookie consent law?

The reason I ask is if users opt-out of anayltics cookies on the site - that doesn't seem to affect storing these server side, because it doesn't use a cookie.

So in this case I am:

  • Respecting their cookie choice (cookie consent)
  • Not storing any personally identifiable information (GDPR)
2
  • Not sure if this is relevant: For example, this is likely to be the case where identifiers are used or combined to create profiles of individuals, even when those individuals are unnamed. This may be either as a named individual or simply as a unique user of electronic communications and other internet services who may be distinguished from other users. Jul 29, 2022 at 12:38
  • Yes, I'd read that :) I still think this is fine. On the GUID in particular: my current understanding is that 'indirecting' by creating a user GUID is an OK way to track a user. Because it isn't based on anything that is identifiable outside your system. It is literally a random string - so I can't think of a less identifiable thing to associate with a user! Similar couldn't be said of a hotel room number for example - because people can have seen you come and go there etc. Jul 29, 2022 at 13:02

2 Answers 2

1

It may not be possible to identify a GUID as being associated with a specific named natural poerson. But given information about a small number of specific individuals, it masy wel be possible to determine which of mthem a particular GUID is associatwed with. In any case, when the user logs back in, it is certainly possible to associate the use with the previous sessions and activities of mthe same user, thatmi8s the point of a tracking ID. That makeds the GUID an "online identifier" and makes any data associated with it in the Data Contreoller's database (DC's DB) Personal Dara (PS) and therefore protected under the GDPR. This does not mean that the DC is forbidden to store and retain such data. It does mean thqt ther must be a lawful basis for such processing. This may be the Data Subjct's consent, but it may also be the DC's legitimate interest. However, this does mean that all such PD is subject to being disclosed in a data access request under the GDPR, or to being deleted at the request of the DS unless an exception applies.

1

I think your approach can be compliant, but it's going to be a bit tricky.

Personal data has a broad definition

The GUID is almost certainly personal data. Personal data is any information relating to an identifiable person. You should treat all the raw data collected via the survey as personal data. Even if there is no PII-style identifier like a name or telephone number, the GDPR has a very broad concept of identification.

  • Even just being able to “single out” one person's records can count as identification. A GUID facilitates such singling out.
  • Information can also be personal data if the data subject can only be identified indirectly, by linking your information with other data or with the help of third parties. It doesn't matter whether you will actually perform such linking, only if it's reasonable that you would likely have the means to carry out identification in some scenario.

Any processing needs a legal basis

To collect, store, or otherwise process personal data (such as survey responses, or analytics events), you need a legal basis.

  • For example, you might have a legitimate interest, where you weighed your interests against the data subject's rights and interests and determined that your interests are more important. However, the GDPR provides some factors that you must consider during this balancing test (such as whether the data subject would reasonably expect this processing to occur). The data subject also has a right to object (opt-out), though the objection can be denied in some scenarios.

  • A more well-known legal basis is consent (opt-in). Consent can authorize nearly any processing, but you must provide enough information up front so that the data subject can make an informed decision. Consent is never the default, but always involves some statement or affirmative action from the data subject, such as clicking an “I agree” button. Withdrawing consent must be as easy as giving it in the first place.

Consent is needed for accessing or storing information on end user devices, unless strictly necessary

Consent is widely used as a legal basis on the web because the ePrivacy directive mandates consent before setting or accessing information on the end user's device (such as cookies), unless this access/storage is strictly necessary for a service explicitly requested by the user. This consent requirement is completely independent from the question whether the information on the user's device is personal data. For example:

  • Storing or accessing cookies for analytics purposes is not strictly necessary from the perspective of the user, and therefore requires consent – regardless of whether personal data is involved.
  • Storing or accessing session cookies might be strictly necessary for user-requested functionality to work, for example in order to connect pieces of a form that is split across multiple pages. Such cookies probably do not require consent.

Note that “cookies” are merely the most common technology used for client-side storage of IDs, but ePrivacy is technology-neutral and likely covers all similar technologies, such as LocalStorage, hidden input fields in HTML, URL query parameters, and fingerprinting techniques.

Side note: you consider what happens when “users opt-out of anayltics cookies on the site”. That is not a good mindset towards GDPR/ePrivacy compliance, because analytics cookies require consent. Consent is always opt-in, never the default.

Using the GUID for multiple purposes

Things get more tricky when this access has multiple purposes, for example if a cookie with a GUID is strictly necessary for the site to work, but would also be used for analytics purposes.

I am not entirely sure how to resolve this in general. It could be argued that once the information is on the server, subsequent use of the information for different purposes would not be an additional “access” and would not require consent. If the information is also personal data, then Art 6(4) GDPR allows use of personal data for “compatible” purposes. On the other hand, such an argument would defeat the objective of the ePrivacy Directive.

But in this particular instance, things are easier: the legal basis for collecting information through your survey will almost certainly be consent. Consent must be specific to a processing purpose. Consent to data collection through the survey does not imply a legal basis for analytics, unless such metrics are integral part of the study's design (e.g. in a psychological study that measures reaction times, or in an UX study that must track user behaviour while they complete tasks). Given that consent to data collection for the study is specific to a purpose, it is unlikely that reusing the GUID for analytics purposes would be a compatible purpose.

Here, I think the appropriate approach would be as follows:

  • Before subjects can take the survey, they are informed about the processing, in line with the GDPR conditions for consent and your Art 13 information obligations.
  • Participants are only admitted to the survey if they consent to this processing.
  • Separately, participants are asked if they optionally want to consent to collection of analytics data. Taking into account Art 7(4) GDPR, this is totally optional and participants can proceed regardless of their choice.

Things might be different if you don't generate separate analytics events from the GUID, but just analyze partial survey responses, if such an analysis is compatible with the purpose for which these responses were collected. Mining your existing survey responses stored on your servers would only be subject to GDPR, not to ePrivacy's consent requirements.

2
  • So you're suggesting a change which is: users need to opt in to analytics tracking regardless of cookies? And that's because of the use of the GUID which it could be possible to identify the user with. But I'm still not clear how the GUID could be used to identify the user? UNLESS you have access to our system. But then you would have all of their PII anyway, so at that point we may as well have used their full address and name as an identifier. If we deleted all the personal data in response to a GDPR request there would be no way to associate them to that GUID. Jul 31, 2022 at 6:15
  • Also I'd have thought that event data would be used for statistical analysis, and is covered under Art 5 (1b): further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’) Aug 1, 2022 at 5:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .