I would like to ask you a questions that arose these days with GDPR new rules. What I have is a payments service which use BrainTree to make the payments. In my side I store some information including the ID of the user. The problem is that I should not send the original User ID to Braintree directly and I need an ID alias instead. What do you think that is the best way to do it? To encrypt is somehow or generate a second ID in my database?
1 Answer
Just generate a second ID, ideally based on an existing approach like UUIDs. Encryption or hashing is not suitable if the original IDs have any structure, such as being small sequential integers.
Note that generating a second ID might be irrelevant to any GDPR compliance effort. This ID is still personal data as long as it can be connected to an individual, e.g. because it is paired with credit card numbers or email addresses. However, pseudonymisation through additional IDs might be part of a compliance strategy (compare Art. 25(1)). In any case, it is more important to sign a processing agreement in which the data processor agrees to not use the data you provide in any way except as specifically instructed (compare Art. 28(3)(a) and Art. 29).
