gdpr european-union data-protection data-storage encryption
Does GDPR apply to personal information entered in a password-field?
<p>If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? </p>

<p>For example if someone enters their email, phone number or name in a password-field? If so, does it matter if the password is salted and hashed, only hashed, encrypted or plain text? </p>

<p>Or let's say they enter their name, adress, phone number, email, social security number and exact GPS-coordinates in a field used for registering some kind of "random" alphanumeric promo code. The promo code is logged and/or stored in plain text on a server when they press "Apply". Does GDPR apply in this case?</p>

<p>It can't be expected that someone will enter personal data in these cases. But where exactly does one draw that line? Does the field need to be clearly marked "Email", "Phone number", etc. in order for GDPR to apply? If so, what about a field marked "Username" - a username alone isn't necessarily enough to identify a physical person?</p>

<p>This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's compliance obligations, it matters for what purposes <em>they</em> collect and process personal data. You can't shove sensitive personal data on an unsuspecting recipient and then complain that they violated your rights. However, that recipient can't use that data for their own purposes unless this is in compliance.</p>

<p>As a simple example, let's consider some kind of social media site where people can talk about whatever they want. Posts clearly are personal data because they are associated with an identifiable data subject. The site processes this data for the purpose of showing posts to other people, and everything is fine.</p>

<p>But what if users post more sensitive data, for example about their health, sex life, political opinions, or their street address? For the site, nothing changes: the posts are only processed for the purpose of running the site, the information <em>in</em> the posts is not processed in any meaningful way.</p>

<p>Someone – whether the site itself or a third party – could analyze the posts to extract or use such sensitive information in the posts. Then they must consider the GDPR again: for which purpose and under which legal basis will this analysis be done?</p>

<hr>

<p>As a side note, your interpretation of personal data is a bit narrow. Personal data includes any information relating to an identifiable person, and is more than just PII. Some data like an email address may be directly identifying, other data like an interest profile might be indirectly identifying. Online identifiers (such as usernames) are <em>explicitly</em> listed as identifying information.</p>

<h2>Yes</h2>

<p><strong>You are confusing personal data with data that can identify a person</strong></p>

<p>Any data that is connected to a person is personal data: my friends list on Facebook, the record of the tweets I’ve viewed on Twitter, my recently watched video list on YouTube, and, yes, my password on any given website. None of that data on its own may be able to identify me but if it linked to data that does, its personal data for GDPR.</p>

<p>Now, my name, address and phone number are all data that, alone or with other data, can be used to identify me. That stuff is also personal data <strong>and</strong> anything that can be linked to it is also personal data.</p>

<p>Password fields are the least of your worries, actually. You shouldn't be storing passwords anyway, and the type of processing you should be doing on them (salt &amp; hashing) is not covered under the GDPR.</p>

<p>But your more general problem is indeed a real concern. However, the impact here is limited. Such a "general" field wouldn't be subject to specific processing on your side. You still have GDPR obligations, though. For instance, this inadvertent data may be accessed, changed or deleted by the data subject. But since you don't intend to collect personal data, you don't need to ask for consent. </p>
