Etydhv

I know it might sound quite bad. But here I explain the whole situation.

I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).

I've been told to be really cautious with this because of recent GDPR law.

But to be honest I know barely nothing about law and its interpretation.

So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.

Thanks.

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)

The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.

There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.

To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.

You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.

So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.

Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:

• User consent required under GDPR




• What provisions should I make regarding GDPR consent when users do not sign themselves up?




• GDPR - Withdrawn user consent




• Opt Out Consent under GDPR