gdpr privacy software personal-information
Is a &quot;login timestamp&quot; considered as personal data according to GDPR?
<p>If software is saving the timestamp of the last login <strong>of a user</strong>, would that timestamp itself be considered personal data by GDPR?</p>

<h2>You ask the wrong question first</h2>
<p>What do you save in the database? Let's take an example of a door:</p>
<ul>
<li>Do you have a legitimate interest to know/save who passed this door?</li>
<li>Do you have a legitimate interest to know/save when the door was opened?</li>
<li>Do you have a legitimate interest to know/save both?</li>
</ul>
<p>Only <strong>now</strong>, once you have established that you have any interest in the door passing at all, you have to start to figure out if it is personal data - if you have no interest in saving it in the first place, there's little reason to figure that out.</p>
<p>Let's say you have a legitimate interest to save both, because behind the door is the server room, and physical access is limited to authorized personnel and you want to know when who was in there for figuring out if or who was responsible for changes.</p>
<p>Now, which of the data is Personal Identifiable Data for you?</p>
<ul>
<li>You know where the door is. That's in itself Location Data, but if you don't know who or when the door was opened, then it is not PII.
<ul>
<li>It becomes PII if you connect it with a person.</li>
</ul>
</li>
<li>A pin-code used by the whole department is not <em>always</em> PII, but can become PII in a very small to medium-sized department.
<ul>
<li>e.g. one of all the 20 000 employees in a facility is just saying &quot;an employee&quot; and is not identifiable, but one of 20 is much more likely is, as you can correlate that with <em>other</em> data to possibly identify a smaller group.</li>
</ul>
</li>
<li>The Employee ID or Card would be most definitely PII if saved.
<ul>
<li>Similar, if the login date is saved to the account list on some server.</li>
</ul>
</li>
<li>The timestamp on itself is not a PII, if <strong>only</strong> the timestamp is recorded and no other information exists. Like, if the front door only logs &quot;The door was opened/closed&quot; but not who did it, to count customers or schedule maintenance.
<ul>
<li>However, together with other information - such as the door being access restricted and the paystubs from timekeeping when all those access carriers were in the building and having a tight access restriction to a decently small group (see above) - that can quickly become PII.</li>
</ul>
</li>
</ul>
<p>It is enough that the information from different information sources compiled can become enough to say &quot;it was one of these few people&quot;, as that is enough to make it identifiable under GDPR Art.4. Once you know it is PII, you need to handle it as PII. As such, you need consent or a legitimate interest. That's why I pulled the <em>other</em> test before figuring out if it is indeed PII: Ic you have already figured out that this data is required for some legitimate reason, such as that you need to know the door operation log to ensure some <em>other</em> compliance, then you can proceed through the other parts of the GDPR compliance.</p>
<p>Now, OP asked about a login timestamp. That is <em>by necessity</em> bound to an identifier, such as a login name. As such, it is the Keycard or Employee ID example and automatically PII because it is tied to a PII.</p>
<h3>Definitions</h3>
<p>The <a href="https://gdpr.eu/article-4-definitions/" rel="noreferrer">GDPR defines PII in Article 4</a></p>
<blockquote>
<p>‘personal data’ means <strong>any information</strong> relating to an identified or <strong>identifiable natural person</strong> (‘data subject’); an identifiable natural person is <strong>one who can be identified, directly or indirectly</strong>, in particular by reference to an identifier such as a name, <em>an identification number</em>, <strong>location data</strong>, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
<p>The <a href="https://www.dol.gov/general/ppii#:%7E:text=Further%2C%20PII%20is%20defined%20as,with%20other%20data%20elements%2C%20i.e.%2C" rel="noreferrer">US Department of labor</a> defines quite similar</p>
<blockquote>
<p>PII is defined as information:</p>
<p>(i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or</p>
<p>(ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification.</p>
</blockquote>

<p>The timestamp being among the data related to &quot;an identified or identifiable natural person (‘data subject’)&quot;, the user, yes it is personal data.</p>
<p><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN#d1e1489-1-1" rel="noreferrer">GDPR Article 4(1)</a>:</p>
<blockquote>
<p>‘personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’); an identifiable natural
person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one
or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
<p><a href="https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en" rel="noreferrer">What is personal data? - European Commission</a></p>
<blockquote>
<p>Personal data is any information that relates to an identified or
identifiable living individual. Different pieces of information, which
collected together can lead to the identification of a particular
person, also constitute personal data.</p>
<p>Personal data that has been de-identified, encrypted or pseudonymised
but can be used to re-identify a person remains personal data and
falls within the scope of the GDPR.</p>
<p>Personal data that has been rendered anonymous in such a way that the
individual is not or no longer identifiable is no longer considered
personal data. For data to be truly anonymised, the anonymisation must
be irreversible. ...</p>
</blockquote>
