4

Could I store a copy of very basic Pseudonymous order data in a non-essential place (Google Analytics) without user consent to essential cookies (which normally loads Google Analytics)?

Either:

  1. Order ID hashed and Order Revenue
  2. Just Order Revenue

This is data we already collect for essential purposes to fulfill orders, regardless of the consent dialogue. All the personal data in our order list is collected from the user during checkout process.

I haven't been able to find anything on storing a Pseudonymous copy of essential data in a non essential place.

Thank you in advance to anyone taking the time to help me out.

1
  • 3
    The problem with GA isn't necessarily linking stuff in GA, but accessing client-side storage like cookies. Here, GDPR overlaps with ePrivacy, which allows accessing or storing information on the end user's device only with consent, or when strictly necessary. The ePrivacy rules apply regardless of whether the information in question is personal data. While it may be necessary to store order information client-side for order processing, it might not be strictly necessary to access this data for analytics purposes.
    – amon
    Jan 24 at 12:12

1 Answer 1

8

Data is personal information if it is or can be tied to an individual. A hash is problematic since it is merely pseudonymous and not anonymous. (Pseudonymization may be a good measure to mitigate the risk of a data breach, however.)

And the amount of an order may also be tied to the customer if you have the name in your invoices and if it is possible that the amount is unique -- say only one customer with $123.45 on April 1st.

1
  • 1
    Thank you! So basically everything to do with orders will be personal data, because it can always be tied back to invoices. That's unfortunate for me, the google analytics record will remain incorrect.
    – Simkoo
    Jan 24 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .