Appcenter-sdk-react-native: GDPR

[jbrodriguez]

I understand that upon initialization, Analytics and Crashes collect some info from the mobile device to setup a session that can be monitored in AppCenter.

Due to the upcoming GDPR privacy laws, I'd like to (as a consumer of the library) :

• Know exactly what fields are being collected
• Anonymize fields, especially the device's unique id
• Ability to set which fields I actually want to collect

This is in order to establish a privacy policy, as a data controller, to the users of my app.

What are your thoughts about this and GDPR in general ?

[guperrot]

Hi,

We are working on GDPR for our backend too. However our SDK is not impacted as we don't collect personal information, not even a device identifier (we just use a random value that is valid only until you uninstall, called install identifier).

The easiest way to see data we collect is to turn on verbose logging as detailed in https://docs.microsoft.com/en-us/appcenter/sdk/other-apis/react-native#adjust-the-log-level and then look at the HTTP logs which contain headers and JSON payload. You might miss out the carrier country code if you test without a mobile network being registered on the device (typically when a sim card is used, though we don't read sim card).

We don't have a way to set which fields can be collected right now, please let us know if one the fields causes an issue.

[jbrodriguez]

Thanks for the reply @guperrot !

I'll follow your suggestion and adjust the log level to better understand the privacy scenario that's implicitly defined by using this library/service.

A device's unique id is arguably THE "personal data" that should be protected at all cost (in the context of a mobile device app with no user authentication) .

Your position is that you don't use it and for me, that's an acceptable answer, although I can't corroborate, since your code is private.

I'm just trying to be compliant, more so since this is a huge paradigm shift, and I guess we're all on the same boat.

I hope you make your GDPR related work, public in due time.

Thanks again!

[guperrot]

Hi, our code is not private. React-native uses bindings to our "native" SDKs for Android and iOS. So the collection sources is located in 2 other repositories:

• Android installId: https://github.com/Microsoft/AppCenter-SDK-Android/blob/develop/sdk/appcenter/src/main/java/com/microsoft/appcenter/utils/IdHelper.java
  
  
  
  • Android device properties: https://github.com/Microsoft/AppCenter-SDK-Android/blob/develop/sdk/appcenter/src/main/java/com/microsoft/appcenter/utils/DeviceInfoHelper.java
  
  
  • Apple SDK: https://github.com/Microsoft/AppCenter-SDK-Apple
  
  

[jbrodriguez]

Thanks a lot, that's very useful information !

I'll be checking the code and will do some tests in the next few days/weeks.

[guperrot]

I forgot to mention something important regarding GPDR and SDK. In the future, we will support PII (personally identifiable information) tagging for custom properties that the developer send (as Analytics events or Push segments). Once supported in App Center, you can specify if the custom data contains PII. SDK would pass this information to the backend where the data will be scrubbed. This will be reflected in SDK API changes wherever we would allow passing custom dictionaries. This feature is not supported yet, so we highly advise developers not to send PII in custom data - like a userid or an email.

[Katrin-R]

Hi, would you have specific information on how you handle the IP adress when CodePush is used? Understand that everything is compliant to GDPR from the above, but I guess you need the IP at some point for sending someting back to the device? Thanks for clarifying! Katrin

[patniko]

Hi @Katrin-R, devices check in for updates on their own so there is no need for us to store information about any users particular device. If devices do check in to our backend for a CodePush update their IP address will be in our logs temporarily for diagnosing issues, but purged automatically in under 30 days to remain GDPR compliant.

[Katrin-R]

Hi @pniko that war helpful and clear, thanks!

[giem]

@guperrot Are you sure that the random identifier doesn't fall under GDPR?
The regulation text mentions cookie identifiers

(30) | Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

And later in the definitions section:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The full text is here http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN

[patniko]

Hi @giem, I suggest you reach out to us through the App Center portal for an answer to your question instead of here so we can put you in touch with a proper representative. As an organization, Microsoft takes GDPR extremely seriously, but this isn't the forum for us to discuss legalese.

[giem]

@pniko Thanks, will do contact you. It would be nice though, if someone could have a look at what the SDK is collecting (preferably form the legal department) and you could state it clearly on your official website what kind of personal data is there. Have a look at https://docs.fabric.io/android/fabric/data-privacy.html they say for example that crash traces are personal data.

[iageoghe]

Hi @giem, thanks for your feedback; that makes a lot of sense. Later this week we will be updating our documentation to include more detail on what data is collected and on how you can control the data collected from the SDK in the context GDPR.

[spacesuitdiver]

This can probably be closed as GDPR info is now documented @iageoghe mentioned here https://docs.microsoft.com/en-us/appcenter/gdpr/install-id