Building a software program that will integrate into a larger system that contains business data. To access this system (and the underlying integrated tool) individuals must enter their email address and password to authenticate. Would this authentication information be considered personal information that needs to be accounted for only if it is received by the underlying tool, for example, as log data? I’m not sure if not receiving this information would be a possibility. Appreciate your help and thank you for taking the time.
1 Answer
Details will depend on the exact jurisdiction.
- Personalized email adresses ([email protected]) are considered PII in most jurisdictions. So are non-personalized emails ([email protected]) if the data controller can resolve them to a person or small group of persons.
- Under rules like the GDPR, there are different possible justifications for handling personal data. One of them is is a contractual relationship between the data controller and the data subject. When access to business data is granted, surely there is some sort of contract?
- Handling this personal data would be subject to technical-organizational measures to safeguard them. But professional standards for handling credentials should also cover the safeguard part of handling PII.
The system as a whole needs a privacy and security concept, not just a single component like login. If it is used commercially, a professional should look over it ...
