Figure out GDPR rules regarding storage of user data on DTU hosted server

frksteenhoff / ClimApp

Codebase for prototype and final version of the smartphone application ClimApp, a project under the European Research Area for Climate Services. The application is available for iOS and Android in App Stroe and Google Play respectively.

https://www.lth.se/climapp/

4 stars 2 forks source link

Figure out GDPR rules regarding storage of user data on DTU hosted server #34

Open frksteenhoff opened 5 years ago

frksteenhoff commented 5 years ago

When is something identifiable with an individual (if it is a pseudorandom UUID without any specific user details, is it then okay to store without extra work/security randomisation)
How should this be specified explained to the user

We have nothing directly related to a person (email, phone numbers etc.) Only date of birth and location

Chuansi-LU commented 5 years ago

I will forward this question to our legal counsel at LU. Preferably ask Jörn and the legal advisor at DTU too. In addition to date of birth and location data, ClimApp requests users to input body weight, height, gender and acclimatisation status, and their feedback for machine learning, for example if the predicted heat stress and thermal comfort agree with their thermal sensations, if not, the prediction can be modified based on user's feedback (perception, opinion, etc.).

JakobP-LU commented 5 years ago

In addition to this, it might be very sensitive to store various disease attributes if that is something we intend to do in the future (long term thinking). Simple ones will probably be easy (i.e. cold), but trickier diseases not so much.

Chuansi-LU commented 5 years ago

Agree.