search

dwyl / learn-security

:closed_lock_with_key: For most technology projects Security is an "after thought", it does not have to be that way; let's be proactive!
67 stars 10 forks source link

GDPR question - personal user data used in aggregate data analytics? #34

Closed vlbee closed 6 years ago

vlbee commented 6 years ago

Question that came up in conversation related to GDPR - If I use personal user data in anonymised aggregated data analytics and then the user opts-out, does their input into the aggregate analysis need to be removed?

nelsonic commented 6 years ago

@vlbee thank you for opening this question. 👍

Answer: "it depends" on the type of data stored and how well "anonymised" it is.

Recital 26 http://www.privacy-regulation.eu/en/recital-26-GDPR.htm "The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable."

So, provided that your application effectively anonymises all personally identifiable information please see: https://en.wikipedia.org/wiki/Personally_identifiable_information#NIST_definition removing all names, nicknames/usernames, email, address/places, IP address, phone, national/social security number, gender, date-of-birth, etc. It will be GDPR-compliant.

Always take the approach of "over anonymising" any data, because there are "Data Scientists" and "Intelligence Experts" who's job it is to "de-anonymise" data see: https://en.wikipedia.org/wiki/De-anonymization And the algorithms for identifying people through anonymised data will only continue to improve as machine learning and access to larger datasets become widespread.

vlbee commented 6 years ago

Thanks @nelsonic !

We might be aggregating some anonymised user data (but not personally identifiable information!) in an upcoming FAC project so this is very helpful!