Would storing the location of a worker be considered personal information? (GDPR)

Every request on a Worker includes at least the country.

If we stored that location for analytics purposes, would that be considered personal information and go against GDPR?

We really wouldn’t have a way to relate the country with a specific user since we wouldn’t be storing the IP address.

Also, we know the country because that’s where the CF data center receiving the request is located, not because we’re using an IP to location service.

Anyone here can comment on this?

Did I understand you correctly, you are not using the CF-IPCountry header but you are actually just using the location of the PoP?

In that case I’d really say this would not be remotely GDPR related. Even if it was CF-IPCountry I’d argue that you do not store any personal identifiable information but only the country of the request. In the case you described you are not even storing that but only the country where the code was invoked. That country may match the country of the user as well, but does not necessarily have to.

IMHO, there is nothing GDPR related involved here. Still, you should really consult a lawyer specialised in these topics if you want a legally binding answer. Neither I nor anybody else on the forum will give you definitive statement on that topic.

3 Likes

No, if you are just storing PoP location or user country.

This is what I disclose and do.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party services may collect files that record interaction with this Application (System logs) use other Personal Data (such as the IP Address) for this purpose.

2 Likes

That’s correct.

Thanks for your answer. Obviously I will consult a lawyer down the road, but wanted to get some input from other CF users first.

All right, yes, in that case you are not even storing the user’s country but only the PoP which “incidentally” might coincide with the user’s location. But the latter should already not be considered personal identifiable information, let alone the former.

But again, only a lawyer can give you a definitive statement of course :slight_smile:

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.