Is a "login timestamp" considered as personal data according to GDPR?

Question

If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?

Answer 1

The timestamp being among the data related to "an identified or identifiable natural person (‘data subject’)", the user, yes it is personal data.

GDPR Article 4(1):

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

What is personal data? - European Commission

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR.

Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. ...

Answer 2

You ask the wrong question first

What do you save in the database? Let's take an example of a door:

• Do you have a legitimate interest to know/save who passed this door?
• Do you have a legitimate interest to know/save when the door was opened?
• Do you have a legitimate interest to know/save both?

Only now, once you have established that you have any interest in the door passing at all, you have to start to figure out if it is personal data - if you have no interest in saving it in the first place, there's little reason to figure that out.

Let's say you have a legitimate interest to save both, because behind the door is the server room, and physical access is limited to authorized personnel and you want to know when who was in there for figuring out if or who was responsible for changes.

Now, which of the data is Personal Identifiable Data for you?

• You know where the door is. That's in itself Location Data, but if you don't know who or when the door was opened, then it is not PII.
  • It becomes PII if you connect it with a person.
• A pin-code used by the whole department is not always PII, but can become PII in a very small to medium-sized department.
  • e.g. one of all the 20 000 employees in a facility is just saying "an employee" and is not identifiable, but one of 20 is much more likely is, as you can correlate that with other data to possibly identify a smaller group.
• The Employee ID or Card would be most definitely PII if saved.
  • Similar, if the login date is saved to the account list on some server.
• The timestamp on itself is not a PII, if only the timestamp is recorded and no other information exists. Like, if the front door only logs "The door was opened/closed" but not who did it, to count customers or schedule maintenance.
  • However, together with other information - such as the door being access restricted and the paystubs from timekeeping when all those access carriers were in the building and having a tight access restriction to a decently small group (see above) - that can quickly become PII.

It is enough that the information from different information sources compiled can become enough to say "it was one of these few people", as that is enough to make it identifiable under GDPR Art.4. Once you know it is PII, you need to handle it as PII. As such, you need consent or a legitimate interest. That's why I pulled the other test before figuring out if it is indeed PII: Ic you have already figured out that this data is required for some legitimate reason, such as that you need to know the door operation log to ensure some other compliance, then you can proceed through the other parts of the GDPR compliance.

Now, OP asked about a login timestamp. That is by necessity bound to an identifier, such as a login name. As such, it is the Keycard or Employee ID example and automatically PII because it is tied to a PII.

Definitions

The GDPR defines PII in Article 4

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The US Department of labor defines quite similar

PII is defined as information:

(i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or

(ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification.