3 ms·

From section on local storage consent. For storing data in the cloud you only need consent to store their personal data. You can store non-identifying data with

From section on local storage consent. For storing data in the cloud you only need consent to store their personal data. You can store non-identifying data within th cloud. For example you have a web game and you use javascript code that generates a session id randomly then you use that session id to store data about a game stats in the cloud. (Why you would do this I am not sure) You wouldn't need permission from the user to store the non-identifying data.

DarkWiiPlayer 4y ago
Yea but then you need to be really careful not to let the user sneak in any PII anywhere; say a user sets their full name + address as their username; they can now request that you delete this data.
- naniwaduni 4y ago
  While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it isn't expect is probably out of scope as not part of a filing system anyway. Certainly I wouldn't expect a serious problem to punt it to "we'll deal with it manually on a 3-month turnaround if it becomes relevant" as long as you're not actively designing your systems to not be able to delete data.
happymellon 4y ago
How about a high score table?
naniwaduni 4y ago
Practically speaking, if you're using personal data in ways that GDPR demads consent for, you ... probably shouldn't be doing that. You can store data that you need for a laundry list of legitimate purposes without consent. The consent provision is an escape hatch for incumbents with consent-tracking infrastructure to carry on doing (and raise barriers of entry to) mostly-illegitimate processing (and okay, the odd thing that might be reasonable but that the law hasn't considered).
d1sxeyes 4y ago
I see what you mean, but the statement is false as written. If it were 'You have an app that only stores non-identifying data in the cloud', then it would be correct. That said, depending on how you code your app, you might end up logging user requests in a way that could end up causing issues by accident. You'd have to make sure that the unique identifier can't be matched up with an IP address in any way. I think the article is giving advice which is overgeneralised, and could very easily end up misleading its readers.

DarkWiiPlayer 4y ago

Yea but then you need to be really careful not to let the user sneak in any PII anywhere; say a user sets their full name + address as their username; they can now request that you delete this data.

naniwaduni 4y ago
While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it isn't expect is probably out of scope as not part of a filing system anyway. Certainly I wouldn't expect a serious problem to punt it to "we'll deal with it manually on a 3-month turnaround if it becomes relevant" as long as you're not actively designing your systems to not be able to delete data.

happymellon 4y ago

How about a high score table?

naniwaduni 4y ago

Practically speaking, if you're using personal data in ways that GDPR demads consent for, you ... probably shouldn't be doing that. You can store data that you need for a laundry list of legitimate purposes without consent. The consent provision is an escape hatch for incumbents with consent-tracking infrastructure to carry on doing (and raise barriers of entry to) mostly-illegitimate processing (and okay, the odd thing that might be reasonable but that the law hasn't considered).

d1sxeyes 4y ago

I see what you mean, but the statement is false as written. If it were 'You have an app that only stores non-identifying data in the cloud', then it would be correct. That said, depending on how you code your app, you might end up logging user requests in a way that could end up causing issues by accident. You'd have to make sure that the unique identifier can't be matched up with an IP address in any way. I think the article is giving advice which is overgeneralised, and could very easily end up misleading its readers.