Tjyylli

Whats the best way to handle refactoring a big file?

Apart from "berlinern", do any other German dialects have a corresponding verb?

Why Were Madagascar and New Zealand Discovered So Late?

Explicit solution of a Hamiltonian system

Is it okay to store user locations?

How do I go from 300 unfinished/half written blog posts, to published posts?

Return of the Riley Riddles in Reverse

What makes a siege story/plot interesting?

When airplanes disconnect from a tanker during air to air refueling, why do they bank so sharply to the right?

How to make a variable always equal to the result of some calculations?

I believe this to be a fraud - hired, then asked to cash check and send cash as Bitcoin

Why didn't Khan get resurrected in the Genesis Explosion?

Why doesn't a table tennis ball float on the surface? How do we calculate buoyancy here?

Is it a good idea to use COLUMN AS (left([Another_Column],(4)) instead of LEFT in the select?

MAZDA 3 2006 (UK) - poor acceleration then takes off at 3250 revs

Does the Brexit deal have to be agreed by both Houses?

How do spells that require an ability check vs. the caster's spell save DC work?

Why didn't Theresa May consult with Parliament before negotiating a deal with the EU?

The King's new dress

% symbol leads to superlong (forever?) compilations

Where to find order of arguments for default functions

Removing read access from a file

Can a caster that cast Polymorph on themselves stop concentrating at any point even if their Int is low?

How do I get the green key off the shelf in the Dobby level of Lego Harry Potter 2?

Is it okay to store user locations?

3

I know it might sound quite bad. But here I explain the whole situation.

I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).

I've been told to be really cautious with this because of recent GDPR law.

But to be honest I know barely nothing about law and its interpretation.

So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.

Thanks.

privacy gdpr data-storage

share|improve this question

edited 7 hours ago

Sergi Mascaró

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
  
  – immibis
  1 hour ago
  

  
  
  
  

add a comment | 

3

I know it might sound quite bad. But here I explain the whole situation.

I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).

I've been told to be really cautious with this because of recent GDPR law.

But to be honest I know barely nothing about law and its interpretation.

So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.

Thanks.

privacy gdpr data-storage

share|improve this question

edited 7 hours ago

Sergi Mascaró

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
  
  – immibis
  1 hour ago
  

  
  
  
  

add a comment | 

I know it might sound quite bad. But here I explain the whole situation.

I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).

I've been told to be really cautious with this because of recent GDPR law.

But to be honest I know barely nothing about law and its interpretation.

So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.

Thanks.

privacy gdpr data-storage

share|improve this question

edited 7 hours ago

Sergi Mascaró

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

edited 7 hours ago

Sergi Mascaró

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

edited 7 hours ago

Sergi Mascaró

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

New contributor

Sergi Mascaró is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 7 hours ago

Sergi MascaróSergi Mascaró

184

1 Answer
1

active

oldest

votes

7

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)

The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.

There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.

To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.

You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.

So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.

share|improve this answer

edited 6 hours ago

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
  
  – Sergi Mascaró
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  @Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
  
  – David Siegel
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean with "in a manner that complies with the GDPR"?
  
  – Sergi Mascaró
  11 mins ago
  
  
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "617"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

Sergi Mascaró is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2flaw.stackexchange.com%2fquestions%2f38533%2fis-it-okay-to-store-user-locations%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

7

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)

The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.

There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.

To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.

You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.

So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.

share|improve this answer

edited 6 hours ago

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
  
  – Sergi Mascaró
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  @Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
  
  – David Siegel
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean with "in a manner that complies with the GDPR"?
  
  – Sergi Mascaró
  11 mins ago
  
  
  

  
  
  
  

add a comment | 

7

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)

The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.

There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.

To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.

You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.

So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.

share|improve this answer

edited 6 hours ago

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
  
  – Sergi Mascaró
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  @Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
  
  – David Siegel
  6 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What do you mean with "in a manner that complies with the GDPR"?
  
  – Sergi Mascaró
  11 mins ago
  
  
  

  
  
  
  

add a comment | 

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)

The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.

There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.

To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.

You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.

So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.

share|improve this answer

edited 6 hours ago

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

share|improve this answer

edited 6 hours ago

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159

answered 7 hours ago

David SiegelDavid Siegel

15.2k3159