Cryptographic requirements for GDPR

Question

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). E.g.

• User u email
• User u purchased product x
• User u questionnaire about experience of product x

I've read into how hashing the emails could allow for pseudonymized data, but I'm not sure if this is enough, for example.

"Although you no longer have the email addresses of all your users, you could easily compare your database to a list of known email addresses to identify which of those people use your service."

• https://www.reddit.com/r/gdpr/comments/8rpb0c/storing_email_hashes_only/

There will always be a situation in which people would be able to recover the anonymised data, so my question is, is hashing of emails enough for GDPR? If not then what is the minimum requirement from a cryptographic point of view?

Answer 1

The GDPR does not contain any technical details, or information regarding specific implementations.

Here's recital 26 of the GDPR about pseudonymous and anonymous data:

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Pseudonymous data is meant to be recovered and linked to other personal information, in some way, by the people who are authorized to do so.
Anonymous data is not meant to be useful to identify a person, in any reasonable way for anybody, and the GDPR does not apply to this kind of data.

So the question is: do you want to pseudonymize or anonymize the email addresses? Since you said that you want to "store users' emails linked to certain data like purchases or questionnaires", then it means you actually want to be able to recover the addresses, and therefore you want to pseudonymize them. But I'm not sure if a simple hash would work. First of all, if you want to recover it, what are you going to do? Bruteforce the hash every time you want to send an email to the user? And second of all, anybody else would be able to recover it by bruteforcing it. A more reasonable pseudonymization would be achieved by encrypting the emails and giving the key only to authorized staff. Or map every email to an ID, and keep the map somewhere safe (offline and encrypted, for example). This way the email addresses will be recoverable (and therefore pseudonymous), but only a few authorized people will be able to link them to other personal information.

As you can see, it all depends on the specific purpose of your processing. Why are you keeping the emails? Who should be able to see them? Once you have defined this, you can implement "appropriate technical and organizational measures" (citing article 32 of the GDPR) to achieve your goal.