Data analytics on online services under GDPR: Legal basis for processing

Under the EU General Data Protection Regulation, organizations must have lawful grounds to process personal data, within limited legal bases outlined in Article 6.

It is common to come across privacy notices indicating personal data is being processed for analytics purposes. In such cases, a single legal basis is often pointed out. But can data analytics be considered only one purpose for processing, grounded in a single legal basis under the GDPR?

Analytics: What are we talking about?

Analytical data is used to support systematic analysis, such as inspecting, transforming and modeling data to extract useful information, draw conclusions and patterns, and support decision-making.

Data analytics can be divided into two layers: the raw data layer, comprising user events and actions, and the metadata layer, processed and analyzed information derived from the raw data that is transformed into meaningful insights through techniques or tools.

The raw data layer represents the granular and detailed information collected during user interactions with applications and systems, while the analytics metadata layer represents the higher level insights and conclusions drawn from analyzing such raw data.

User actions refer to the various activities and behaviors individuals perform while interacting with an application, like user authentication, button clicking, typing, data inputting, scrolling, downloading, uploading, sharing and liking.

User events are specific occurrences that are tracked or logged during a user’s interaction with a system or application and do not necessarily require affirmative actions. Events can be page or frame views, system errors, or transactional events.

As for the metadata layer, common events, in e-commerce apps for example, include the shopping cart abandonment rate, conversion rate and average order value — that is, the average amount spent by customers in a single transaction.

It is worth mentioning that some websites collect analytics through cookies, which then trigger application of the EU’s ePrivacy Directive.

Purposes of processing for data analytics

Determining the processing purpose for data analytics should delve into the intent of the data collection and its intended use. This is because the same user data can be used for multiple analyses and, therefore, collected for different purposes. As so, not all purposes of data processing can be based on the same legal basis and may require different privacy-by-design implementations to ensure lawfulness, such as:

• Monitoring application security and availability — like analyzing app crashes, debugging and troubleshooting, detecting anomalies, ensuring security traceability, and assuring app performance.
• Improving service, including by uncovering user patterns, trends, correlations and insights to improve existing and future features, as well as evaluating user engagement and creating user personas.
• Utilizing indirect funding models, where data is shared with third parties.
• Integrating business intelligence needs, such as supporting strategic decision-making and defining and monitoring key performance indicators.
• Utilizing service personalization, where the app itself contains an analytics board, or when specific user events and actions trigger specific app events, such as knowledge article recommendations.

This list is not exhaustive. Data analysts will likely find other interesting potential uses.

Anonymized processing of data analytics

Some organizations may have an option to process anonymized data for analytical purposes. Anonymized data is not identified or identifiable, and thus, it is not personal data and is out of the scope of privacy protection, as stated in GDPR Recital 26. The problems of defining a legal basis would not apply.

Application security, availability and service personalization

Monitoring application security, availability and service personalization may be considered parts of the service provision and, thus, able to rely on the performance of a contract — Article 6(1)(b) of the GDPR — as the legal basis for processing. It is generally in the user’s interest to have means to keep data secure and protected when contracting a service, and logging is a common feature of most security frameworks. When the service value is intrinsically connected to in-app analytics or content personalization, such processing also counts as part of the service.

In such cases, consent is not an available legal basis because users generally could not freely withdraw consent while continuing to use the service. The European Data Protection Board’s guidelines on consent state, “Generally, consent can only be an appropriate lawful basis if a data subject is offered control and is offered a genuine choice with regard to accepting or declining the terms offered or declining them without detriment.”

Conversely, when the in-app analytics or personalized features are optional or not essential for the service provision, consent or legitimate interest may serve as a legal basis.

Service improvement

EDPB guidelines emphasize that Article 6(1)(b) would generally not be an appropriate lawful basis for processing personal data to improve service. In the EDPB’s words, “while the possibility of improvements and modifications to a service may routinely be included in contractual terms, such processing usually cannot be regarded as being objectively necessary for the performance of the contract with the user.”

This is also in the EDPB’s binding decision on the dispute submitted by Ireland’s Data Protection Commission regarding WhatsApp Ireland, in which the EDPB decided the platform inappropriately relied on contract as a legal basis to process personal data for service improvement purposes.

Instead, legitimate interest or consent seems a more appropriate legal basis in this case.

Indirect funding model

There are cases where a software company has an agreement with a third party to create or maintain an application to be able to share valuable data. In such cases, it is recommended to assess whether the third party is not a controller instead, and as such to be displayed in the privacy policy.

Consent or legitimate interest might be an available legal basis. For example, when the relation with such a third party is expected, legitimate interest could apply when a user directs the business to intentionally disclose personal information to a third party.

Conclusion

While it can seem easy to rely on data analytics as a generic purpose of processing, this does not reflect the GDPR’s spirit or the purpose limitation principle, as confirmed by law enforcement and EDPB guidelines.

Data analytics must not always be seen as an umbrella for multiple personal data processing activities. Different legal bases can be available and applied for each purpose of processing.

Organizations should carefully assess their specific context and determine which legal basis would be most appropriate. The multiple possible uses of analytics data create a temptation to use such data points creatively. While some processing purposes allow for flexibility, they are not interchangeably substituted for the same purpose.