Hacker News new | ask | show | jobs
by torben-friis 1253 days ago
I might be wrong but I don't think GDPR limits what information you can request, it's more about how the information is handled and the need for consent to collect it.
1 comments

From typical GDPR guidance:

"If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis".

The implication of your reasoning means that pronouns shouldn't be used and in a lot of cases names shouldn't be used because there are other ways to address the user.
GDPR requires a purpose for processing. The majority of other requirements GDPR imposes attach to the purpose, rather than the processing activity.

GDPR gives a lot of leeway in determining a purpose. But if you don't have a purpose, then the processing is unlawful regardless of literally anything else you've done or not done. Not even with valid consent of the data subject (because, guess what, consent attaches to the purpose).

So if you say "we need this data for addressing communications to the data subject," that's a purpose. On the other hand, if sex gets stored in a DB column and never used, that's a violation.

Separately, GDPR has a Data Minimization requirement: you collect data for a purpose, could you achieve that purpose with less data? This one has some flex to it. If the answer is "we could but not as well," then the data has a purpose. Maybe not a great purpose, but it's something.

I am not sure why you're explaining GDPR to me.