Is it still legal to include an invitation based service in a program after GDPR?
<p>I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not username) and email address (which are personal information).</p>

<p>I found another related question (<a href="https://law.stackexchange.com/questions/22793/gdpr-legislation-and-user-invites-by-email">GDPR Legislation and user invites by email</a>) but in that case it's enough to store the (irreversible!) hash of the given email address. In my case I must store the name of the new user that just can't be hashed, since I'd like to display it for the existing users.</p>

<p>If this is not legal, are there any other ways to do something similar to this approach?</p>

<p>This boils down to an interpretation of GDPR <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a>- Section (1) lists all 6 legal grounds for <em>lawfulness of processing</em> in subparagraphs a-f.</p>

<p>In your case, you cannot use use subparagraph a (consent). Subparagraphs c-e is also obviously out of scope, leaving subparagraph  b and f.</p>

<p>Subparagraph b says:</p>

<blockquote>
  <p>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>
</blockquote>

<p>Joining your app is "performance of a contract" and you do this "prior to entering into a contract". However, the processing is not done "at the request of the data subject". The request comes from a friend of the data subject &ndash; so: No &ndash; subparagraph b does <em>not</em> provide legal grounds for processing.</p>

<p>Subpragraph f says:</p>

<blockquote>
  <p>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>

<p><em>Marketing</em> is recognised as a legitimate interest by the EU, but having one's names publicly displayed to existing users on a website may <em>not</em> be in the legitimate interest of the data-subject.</p>

<p>To some extent I guess it depends on the website. If is a site dedicated to the appreciation of some sexual fetish, displaying names of invitees would clearly not be in the interest of the data-subject.  If the site was the local chapter of the high-IQ club "Mensa", the potential harm to the legitimate interests of the data subject is much lower (I think &ndash; but it may be that somebody thinks that being associated with such a snotty bunch as "Mensa" harms their reputation, and takes you to court if you do this).</p>

<p>As always. Providing specific advice is not possible. If you need to know whether this marketing strategy is legal under the GDPR, get specific legal advice from a lawyer.</p>

gdpr email