gdpr data-protection email
GDPR and Query String Variables
<p>I have a project where a customised email is sent out to clients and there is a link that takes them to a landing page, with a form, that currently gets populated by way of query string variables e.g. domain.com?email=larry@test.com&amp;firstname=Larry, etc.</p>

<p>However in light of GDPR is this still an okay thing to do? If not the only way I can think of getting around this is by using something like having a form on the html email that 'posts' the data to the landing page, but I'm not sure if that would work.</p>

<p>The first question is if you have the right to have this data in the first place. E-mail and name will typically be covered by contract reasons; you may need consent for other pieces of information if they are not needed to fulfill the contract or legal obligations. Other data may require the user's consent.</p>

<p>Sending to a user his own data is not an issue, as e-mail is usually considered a safe communication channel.</p>

<p>A different issue is that, by using this mechanism, that data is going to appear in more places than needed. For example, in your server and firewall logs, that registers accesses to <code>https://business.lee-m123.example/login?email=mysecreteemail@gmail.com&amp;name=DrDoom</code>, for example. These registers then become affected by the GDPR, and if the person asks you to provide which information do you have about them, you have to include them<sup>1</sup>.</p>

<p>Additionally, someone could object to the system on the grounds of data rectification. If a customer tells you "My name is not Larry, but Lawrence (or, FWIW, Vanessa)", the link will still fill the fields with the old name. I would say that you would be ok (it is not your data that is wrong), but a less technically savvy person may object and get upset and force you to do some work explaining your system without need; and in the best of cases it is a nuisance to your customer who will be correcting the name each time.</p>

<p>From a technical POV I do not understand why you do not just send an ID in the parameters and then, when you get that ID, fill the forms with the data that you have in your database. And of course, keep that form protected<sup>2</sup> with a password or whatever so nobody can just pass random IDs and retrieve your users data without proving that it is them.</p>

<p><hr/>
<sup>1</sup>It would also become an issue if the user asks you to delete your records about him; you might be able to claim "legitimate needs" to keep the logs but it is still an unnecessary trouble.</p>

<p><sup>2</sup>Because you are already protecting that form from unauthorized access, AREN'T YOU?</p>
