Hacker News new | ask | show | jobs
by perbu 1261 days ago
Unless you actually need to use gender for something useful I'm guessing it is a GDPR violation to ask for it.
3 comments

I'm not sure why this was voted down?

This is Personal Information and so the data processor must have a specific reason why they need it, and must take appropriate steps to secure it. They can't just capture it "In case we need it later" nor can they just store it haphazardly because it's not valuable to them, or refuse to update it because that's difficult.

Violates the principle of data minimization, but I'm not sure if its on its own a violation that can result in an enforcement action.
In german, grammatical genders matter a lot. And, well, that extends to people as well.
I might be wrong but I don't think GDPR limits what information you can request, it's more about how the information is handled and the need for consent to collect it.
From typical GDPR guidance:

"If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis".

The implication of your reasoning means that pronouns shouldn't be used and in a lot of cases names shouldn't be used because there are other ways to address the user.
GDPR requires a purpose for processing. The majority of other requirements GDPR imposes attach to the purpose, rather than the processing activity.

GDPR gives a lot of leeway in determining a purpose. But if you don't have a purpose, then the processing is unlawful regardless of literally anything else you've done or not done. Not even with valid consent of the data subject (because, guess what, consent attaches to the purpose).

So if you say "we need this data for addressing communications to the data subject," that's a purpose. On the other hand, if sex gets stored in a DB column and never used, that's a violation.

Separately, GDPR has a Data Minimization requirement: you collect data for a purpose, could you achieve that purpose with less data? This one has some flex to it. If the answer is "we could but not as well," then the data has a purpose. Maybe not a great purpose, but it's something.

I am not sure why you're explaining GDPR to me.