gdpr
Android Application: Is purchaseToken defined under GDPR as PII?
<p>In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using <a href="https://developer.android.com/google/play/billing/billing_reference#getPurchases" rel="nofollow noreferrer">this API</a> ) and saving purchaseToken on our server to validate his license. </p>

<p>According to documentation on above page "purchaseToken" is defined as "A token that uniquely identifies a purchase for a given item and <strong>user pair</strong>".</p>

<p>From my side as developer: we cannot get exact user who purchased this item based on purchaseToken. Google does not provide such possibility (no API for this). But in theory – if somebody has token + access to Google database – he can identify user exactly.</p>

<p>So the question is: For me as Android Developer, is "purchaseToken" identified as PII (Personally Identifiable Information) or not? </p>

<p>The question is important, because depending on if it is true or false I have to inform user or do not inform about that.</p>

<p>IANAL, But the information commissioners office (UK) describe personal data as: (bolding mine)</p>

<blockquote>
  <p>The GDPR applies to ‘personal data’ meaning any information relating
  to an identifiable person who can be directly or <strong>indirectly identified</strong>
  in particular by reference to an identifier.</p>
  
  <p>This definition provides for a wide range of personal identifiers to
  constitute personal data, including name, <strong>identification number</strong>,
  location data or <strong>online identifier</strong>, reflecting changes in technology
  and the way organisations collect information about people.</p>
</blockquote>

<p><a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/</a></p>

<p>So I would say that in your case it is personal information.</p>

<p>In principle, regardless of if <em>you</em> can identify an individual, personal data is that which <em>can</em> be used to potentially identify an individual. </p>

<p>For an extreme example of why this is important: Lets say your app sells AIDs medication. Can a hacker who got in and stole your database, be able to use that with information they stole elsewhere to identify people with AIDs and blackmail them, <strong>in a way that they wouldn't if you had not stored this identifier?</strong></p>

<p>Plus, if you want to err on the side of caution, there's no legal penalty for telling the user about non-personal information you store.</p>

<p>No, it is not <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">personal data</a> (GDPR does not define "PII") because <em>you</em> cannot identify the person it belongs to at reasonable time and costs. It is <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">anonymous data</a> in the context of you/your company/app.</p>

<p>The fact that Google (or any other party) <em>privately</em> knows the link between the token and the user is irrelevant (that said, for Google that token <em>is</em> personal data).</p>

<p>I agree with David's answer, and I would just like to add that without need of an external database, the token you store to prove that a payment was done by a given user, who, in accordance with your processing, has the right to obtain a license for your software is a collection and processing of data allowing you to identify such a user individually.</p>

<p>The same reasoning applies here as with cookies. They allow to single-out a person (or even a group of persons using the same browser in the case of cookies), and that suffices to consider that the information collected and stored is personal information, and that you are using it for your own purposes of checking licensing rights (certainly passing through the API your own details about the purchase order).</p>

<p>The token would absolutely not be anonymous data. If it has to be legally classified, it would be pseudonymous information, which is not anonymous because it allows to single-out a person.</p>

<p>See <a href="http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf" rel="nofollow noreferrer">Article 29 Working Party's opinion 0829/14/EN WP216 on the subject</a> for more details about Anonymisation Techniques and distinctions with pseudonymisation.</p>

<p>When referring to "costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments" in <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Recital 26</a> the GDPR is simply covering the case where while an Anonymisation Technique may be considered safe at a certain point in time, as the technology evolves, this may not longer be the case.</p>

<p>It is interesting to note that, at the time WP29 wrote the above mentioned opinion, the draft versions of GDPR were being amended by the European Parliament, and WP29 expressly noted this amendment (at that time contained in a Recital 23), and that after referring to it (footnote 6 in 2.2.2) WP29 subsequently stated that "It should be noted that the identification risk may increase over time and  depends  also  on  the  development  of  information  and communication  technology".</p>

<p>To answer the OP's question, tokenization is expressly referred to by WP29 as being a pseudonymisation technique (Section 4, page 21), and not an anonymisation technique.</p>
