gdpr data-protection
Is displaying the user first name and last name a breach of GDPR?
<p>We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by reusing their last name and first name which they previously gave to create their account.</p>
<p>My question is: Is this legal in regards to privacy ? I noticed a few apps ask for a first name and last name, then have another form for the public stuff. And more generally is it legal to show some of the user personal data as long as it is in the terms and service and the privacy document ?</p>

<p>Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service?</p>
<p>For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it.</p>
<p>So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.</p>

<p>GDPR is not a blanket ban on handling personal data. It regulates how to handle personal data, what permissions or justifications are required, and what happens when permissions are withdrawn.</p>
<ul>
<li>Data can be processed based on user consent, which can be withdrawn. Are you prepared to completely delete profiles in that case, or what would you argue you need to retain?</li>
<li>Data can be processed for the fulfillment of a contract. But billing or login data does not have to be displayed to the public to handle billing or login.</li>
<li>Either way, do you have appropriate technical and organisatonal measures to protect the data?</li>
</ul>
<p>If 'you' are a company, spend money on a specialist lawyer. If 'you' are a hobbyist, try to avoid the pitfalls, which will be helped by collecting as little personal data as possible.</p>
