Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
If I were to conduct a survey of members of a public group in the EU (for my own personal interests) what should be considered in order to comply to GDPR regulations?
If the information does not contain any records of who someone is, how can I allow that person to opt-out at a later date? I.e. say someone completes the survey, but then 1 year later asks to be removed, how would I identify which record is theirs?
The GDPR does not generally distinguish personal data based on its level of identifiability, so the general GDPR compliance process would apply. I've outlined a general checklist below.
You're concerned that you might not be able to fulfill data subject requests such as erasure if you can't locate their records. This is potentially 100% compliant because the GDPR explicitly accounts for this scenario. Per Art 10 GDPR “processing which does not require identification”:
You are not required to collect, processor, or maintain additional identifying data for the sole purpose being able to comply with GDPR data subject requests.
If you can demonstrate that you're in no position to identify the data subject, then the GDPR rights in Art 15 to 20 do not apply.
However, if the data subject provides sufficient additional information that enables you to identify their records, then those suspended rights apply again.
Scope and jurisdiction
Basics: purpose and legal basis
What is the purpose of processing?
What is the Art 6 legal basis for this processing? For example, legitimate interest or consent. A legitimate interest requires that you conduct a balancing test.
What is the minimal data necessary to achieve that purpose?
For which retention period will you keep the data?
If you will process special categories of data, you will also need one of the exceptions from Art 9.
Compliance and security measures
Which general Art 24+32 technical and organizational measures (TOMs) would be appropriate? This also includes things like backups, encryption, or pseudonymization.
If you engage data processors, have you signed suitable contracts (data processing agreements) per Art 28?
If you cause international transfers of personal data, on what basis (see Chapter V)? This is particularly relevant if you use non-European data processors.
Are you required to appoint a data protection officer and/or representative?
Are you required to keep Art 30 records of processing activities?
Are you required to perform an Art 35 data protection impact assessment (DPIA)?
Preparing for data subject rights
Have you prepared a privacy notice per Art 13/14 GDPR? Most notices also include the information from Art 15 GDPR.
Do exceptions to the data subject rights apply, such as:
How do you plan to satisfy data subject requests, in particular access, rectification, erasure, restriction, data portability, objection?
Just to add to amon's answer, here's are a couple of relevant definitions from Article 4 of the UK GDPR (emphasis added):
‘personal data’ means any information relating to an identified or identifiable natural person** (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
So, what matters is whether the data you are collecting falls within the definition of personal data. If there is no personal data, then there is no processing for the purposes of the GDPR (the bolded part above).
There are two ways that data can be personal data: (1) it relates to an identified person; (2) it relates to an identifiable person.
You're not collecting names, so that rules out the first case. Your question is less clear about the second case. In the title you've written that you might collect "potentially personally identifiable information". What matters is whether it is possible to identify the person from the data that you collect.
You therefore have two options. Either operate outside the scope of the GDPR altogether by not collecting personal data, or comply with the GDPR.
If someone asks for the data to be removed, and you do not hold identifiable information, then there is no need for compliance. If you do hold identifiable information, and the data subject identifies themself (by reference to that information) in the request then you need to comply.
