gdpr
Will storing hashed phone numbers violate GDPR?
<p>I've read GDPR document from start to end, but I am still not sure about one thing.</p>

<p>Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt).</p>

<p>Will this violate GDPR if I have those stored in database without the owner consent, given there is no other data collected, no names, emails, nothing. They are not linked to any user (there are no users in the system actually). Just the phone number in a hashed form (same things as storing a hashed password).</p>

<p>From what I understand if the data is anonymised there is no problem, but I am still not sure, because if you have the salt you can still create hashes of phone numbers and compare them to the hashes that exists in the database. But this gives you nothing even if you succeed, except that the phone exists there.</p>

<p>But that a phone number exists in your collection <em>is</em> interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be considered to be a secret key.</p>

<p>If the information had been anonymized it wouldn't be personal information and the GDPR wouldn't apply. However, since the phone numbers are personal information (even hashed, they relate to an indirectly identifiable person), you should apply standard GDPR compliance processes to determine whether storing these phone numbers is legal:</p>

<ol>
<li>What is the purpose of processing?

<ul>
<li>Some purposes like national security or purely personal and household purposes are exempt from the GDPR</li>
</ul></li>
<li>What is the legal basis for this purpose?

<ul>
<li>E.g. consent, legitimate interest, legal obligations, …</li>
</ul></li>
<li>What is the minimum data necessary to fulfill the purpose?

<ul>
<li>If pseudonymized data is sufficient, pseudonymization is mandatory.</li>
</ul></li>
<li>What safety measures do you think are appropriate?

<ul>
<li>This could shift a legitimate interest balancing test in your favor.</li>
</ul></li>
<li>What compliance measures are you obliged to take?

<ul>
<li>E.g. information per Art 13–14, preparation for data subject requests, engaging data processors, further safety measures.</li>
</ul></li>
</ol>

<p>While your purposes are probably benign, it can be useful to recall that the presence of identifiers in data sets can be a matter of life and death. When accounts were leaked in the Ashley Madison data breach, that drove some users to suicide. In some countries, the existence of a Grindr account can be a death sentence. Those are examples involving special categories of data per GDPR Art 9, so likely far more sensitive than the context of this question. However, in the AM breach it would not have helped much to hash identifiers like emails: third parties would still be able to check whether the email of someone they know was part of the breach.</p>
