5

We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by reusing their last name and first name which they previously gave to create their account.

My question is: Is this legal in regards to privacy ? I noticed a few apps ask for a first name and last name, then have another form for the public stuff. And more generally is it legal to show some of the user personal data as long as it is in the terms and service and the privacy document ?

4
  • 2
    Why do you want to create a public profile? If you are running a social media app, I guess that is the point (but even then users could use pseudonyms), but in any other case I'd be pissed if some app or website creates a public profile when I sign up.
    – Robert
    Nov 28, 2022 at 23:45
  • @Robert We are building a booking app, the first name and last name and avatar of the person appears as the Host. We thought about modifying it so only the firstname is shown or smtg like that
    – Ced
    Nov 29, 2022 at 9:30
  • The first name, last name, date of birth and nationality are used to register with our payment provider.
    – Ced
    Nov 29, 2022 at 9:39
  • 3
    @ced outside of the scope of questions-answers: if you are building an actual booking app as you mention in the comments, which involves legally binding commitments, money and for sure personal data, and you need to ask this question, then for heaven's sake do yourself a big favour and find a real-world person who knows about these things. Maybe just subcontract them for a while to settle all these issues for you and teach your team about GDPR etc. If you get this one wrong, and are unlucky enough to get some customers who care about this, you can incur ridiculously high fines or worse...
    – AnoE
    Nov 29, 2022 at 12:09

2 Answers 2

22

Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service?

For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it.

So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.

3
  • 3
    IMHO why do you even want to ask for the user's name in the first place? If you really only need a user name, don't ask for real names. AFAIK reddit does without, as does stackoverflow.
    – Robert
    Nov 28, 2022 at 23:46
  • 1
    If your user terms get long enough, they don't really constitute "consent" any more. If you're doing it without consent, you'd better have a really good reason to be doing it! (Fortunately, you can fix this by explaining at the time it's given what you're going to be doing with the data, as well.)
    – wizzwizz4
    Nov 29, 2022 at 0:26
  • @Robert we are building a booking app. The first name, last name, date of birth and nationality are used to register with our payment provider. We made it so the first name and last name was what appeared for the "Host" but wondered if we weren't breaching privacy there. Even the payment info could wait for payment to be asked. My colleague was under the impression that it would be a better idea, I wasn't but this answers kind of tells me he was right.
    – Ced
    Nov 29, 2022 at 9:41
9

GDPR is not a blanket ban on handling personal data. It regulates how to handle personal data, what permissions or justifications are required, and what happens when permissions are withdrawn.

  • Data can be processed based on user consent, which can be withdrawn. Are you prepared to completely delete profiles in that case, or what would you argue you need to retain?
  • Data can be processed for the fulfillment of a contract. But billing or login data does not have to be displayed to the public to handle billing or login.
  • Either way, do you have appropriate technical and organisatonal measures to protect the data?

If 'you' are a company, spend money on a specialist lawyer. If 'you' are a hobbyist, try to avoid the pitfalls, which will be helped by collecting as little personal data as possible.

7
  • 3
    If you're a hobbyist you probably don't have to worry about GDPR. The odds of anyone trying to enforce it on your website are basically nil. Nov 28, 2022 at 16:05
  • 8
    @JonathanReez That sounds a lot like "unless you're a bus driver, you can just ignore traffic rules".
    – Robert
    Nov 28, 2022 at 23:46
  • 3
    @JonathanReez I am one of the annoying people who will try to enforce it on your website.
    – wizzwizz4
    Nov 29, 2022 at 0:24
  • 1
    @Robert traffic rules are important for society. GDPR is not. That’s the difference. Nov 29, 2022 at 3:42
  • 2
    @Ced Usually email; patiently explaining the GDPR to people until they do something about it, CCing in officials where necessary. Most people break privacy law out of ignorance, rather than malice. I only tend to do it if the GDPR violation is important, but many are: personal data only needs to be compromised once, after all.
    – wizzwizz4
    Nov 29, 2022 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .