gdpr privacy business email personal-information
GDPR and Certification Check
<p>Based in UK.</p>
<p>I manage a certification website that allows users to register an account and complete a course, before doing so they explicitly agree to the website's privacy policy and GDPR. The website collects their name and email address, along with any courses they have have completed / passed.</p>
<p>Users are assigned (pdf) certificates via the website that contain a <strong>unique number</strong>. I now want to setup a publicly accessible search function that enables employers, or potential employers to validate the authenticity of these certificates based on this unique number, similar to <a href="https://www.certmetrics.com/comptia/public/verification.aspx" rel="nofollow noreferrer">CompTIA</a>, <a href="https://training.linuxfoundation.org/certification/verify/" rel="nofollow noreferrer">Linux Training</a> and others.</p>
<p>The idea is that the (potential) employers will receive a copy of the certificate and enter this unique number on the website. A database check will be performed on this unique number and if it's valid, the user's <strong>name</strong>, <strong>email address</strong> and <strong>certification date</strong> will be displayed to the person performing the search, along with a <code>This is a valid certificate number</code> , message.</p>
<p>If the unique number isn't found a standard <code>not found</code> message will be displayed.</p>
<p>Do I need to be concerned about any GDPR or privacy issues here, or does it all sound ok?</p>

<p>GDPR definitely applies. Your scenario seems to raise two questions:</p>
<ul>
<li>What is the legal basis for processing?</li>
<li>Are the security measures appropriate?</li>
</ul>
<h3>Legal basis</h3>
<p>Every processing activity of personal data requires a legal basis. Most well-known is consent, but there are six categories in Art 6(1) GDPR including legitimate interests and necessity for performing a contract with the data subject. Conditions on consent are laid out in Art 7 GDPR.</p>
<p>You say that data subjects “explicitly agree to the website's privacy policy and GDPR”. The GDPR does not generally expect “agreement” to a privacy policy, as information per Art 13 is an unilateral notice. Such general agreement also cannot constitute valid consent.</p>
<p>In the context of certifications, the legal basis would likely be <em>necessity for performing a contract with the data subject</em>: You were contracted to provide this validation service to the data subjects. You should however make it clear which information will be displayed on the validation page (other than a valid/not valid) response. For example, I am concerned that showing the email address would not be <em>strictly necessary</em> for providing the validation service. You should also consider whether this validation service is a core component of your certification service, or whether there should be an opt-in or opt-out here.</p>
<h3>Security Measures</h3>
<p>The GDPR requires that you implement appropriate security measures, “taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms” of the data subjects (see Art 32 GDPR).</p>
<p>This gives you a lot of leeway to determine what measures are appropriate, but also criteria that you must consider in your determination. A number of security measures are explicitly suggested and must also be considered:</p>
<ul>
<li>pseudonymization and encryption</li>
<li>ensuring confidentiality, integrity, availability, and resilience of your systems</li>
<li>ability to restore the service (e.g. backups)</li>
<li>processes for regularly testing and evaluating your measures</li>
</ul>
<p>Aside from generic IT security measures like backups and providing the service over a HTTPS connection, I would be concerned about “insecure direct object reference” style attacks on the database. If I know that certification no 1234 exists, I could try to get the information for other numbers like no 1233 and so on. This would leak personal data.</p>
<p>Basic defenses could include requiring additional information such as the data subject's name to be provided, or using anti-bot measures such as captchas and rate limits.</p>
<p>However, the real solution is to avoid sequential IDs, and to generate sufficiently large tokens with a cryptographically secure random number generator. Instead of a “certification number”, it would be better to view this as a “validation code”.</p>
