Can my user agreement require end users to indemnify me for misuse of their data by third-party services embedded in my app? I have an Android App which is already in the Play Store. Now due to GDPR I am planning to improve my Privacy Policy and a Terms of service. I am planning to add certain terms in my Terms of service some of which are: I am not responsible for any damage/loss caused to your phone by using my app. I am using certain services such as X,Y and Z services. And any collection, use or misuse of the data collected by those service I am not responsible. I know that the above two points are not framed in an proper legal language but my question is that suppose the user is accepting those two points will it exempt me(My responsibility) from those two cases. Any help would be grateful.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
Corrections to your statements or quotations Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement. Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of Article 30. GDPR provisions relevant to your question The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in Article 2 (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;" The Recital 18 of the GDPR gives some insight as to what would be a purely personal or household activity as follows: (18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities. Interpretation To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority. There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter). If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case C-101/01 is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that: exception must (...) be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal. Actually, an interpretation of case law C-212/13 from the European Court of Justice also mentioned by Free Radical could support this reasoning. In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that: To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity (...) Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)". Conclusion As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.
If there is a trade mark and if Polaroid owns it and if you infringed it then yes they can force you to remove it. In addition, they could sue you for either damages (i.e. what they lost because of your infringement) or an account of profits (i.e. what you made because of your infringement). That is what trade mark law is for! If the trade mark is registered then this is trivially easy for them to demonstrate. If it is unregistered then it becomes a question of if the mark is clearly recognisable as Polaroid's; IMO they could probably show that it is - those particular border dimensions were distinctive of Polaroid instant cameras for many years. If you want to republish the app, you could probably avoid trade mark issues by allowing users to set the dimensions of the photograph and border, the colour of the border and the location of the caption.
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct? Yes, as far as I can see that is correct. The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another? What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple [...] But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Yes, and yes. In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you. That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc. I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you). As explained in a EU document, What is a data controller or a data processor?: The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...] So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.
NDA provisions in general are rather similar. In particular the ones covering the exceptions to the confidentiality obligations required to the receiving party. Such provisions normally have the following wording (more or less): Information shall not be treated as Confidential if: - at the time of disclosure is already in the public domain or becomes available to the public w/o breach by receiving party; - the receiving party receives it from a third party free to lawfully disclose such information; - was in the prior lawfull possession of the receiving party; - was independently developed by the receiving party; - is approved to be released by the disclosing party; or - the receiving party is required by law to disclose in response to a valid order of a court or by a government agency. Your particular case might not necessarily fall under any of this exceptions (i do not know the exact wording of the NDA you're referring to) but in any case, please note that simply telling a third party that you are discussing the development of "an app similar to x but with a better UX and simpler design", might already be considered as a breach of confidentiality. Surely the NDA is identified as being Confidential itself and it probably also contains a section saying something like: "This Agreement and its contents shall be treated as Confidential Information".
Yes, GDPR applies: you are a data controller established/living in the UK or are offering services to people in the UK you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public. You must consider GDPR compliance here. This is especially important as you are showing personal data to the public. Don't do that unless you have a very good reason, appropriate safeguards, and are clear to users how their information will be shown. On a high level, GDPR compliance involves working on the following questions: For what purpose are you processing personal data? Context: purpose limitation principle per GDPR Art 5(1)(b) What is the legal basis for processing? GDPR Art 6(1) lists the available legal bases. Here, consent, necessity for performance of a contract, or a legitimate interest could be a legal basis. They may have further obligations attached. A legitimate interest requires a balancing test that considers the data subject's rights and freedoms. Consent must fulfil the conditions per Art 7 in order to be valid. What is the minimal data necessary to achieve the purpose? Per the Art 5(1)(c) data minimisation principle, it is illegal to process personal data beyond what is necessary and adequate. You must provide data protection by design and by default per Art 25. Special categories of data per Art 9 such as health data are illegal to process outside of narrow exemptions. You must delete data once it is no longer necessary. What appropriate safeguards and security measures should you apply? Per Art 24 and 25, you are responsible for determining and implementing appropriate measures. This depends a lot on your specific context, so there's no checklist you can apply. Per Art 25(1) you must pseudonymize the processed information if that is compatible with the processing purpose. What further compliance measures do you have to consider? There are additional GDPR and non-GDPR compliance measures. From the GDPR side: Use the answers to these questions to write a privacy policy, including the information that you must provide to data subjects per Art 13. Consider whether you have to maintain a Records of Processing document per Art 30, or if you have to make a Data Protection Impact Assessment per Art 35. If you use third party services, figure out whether they are a joint controller or data processor and apply appropriate safeguards. If you have data processors, ensure that you have a contract in place that covers the items from Art 28(3). If you share data with other controllers (not processors) you need a legal basis for doing so. If you transfer data into a non-EU/EEA country (after 2020: non-UK country) you need a legal basis per Art 44 and have to cover additional items in your privacy policy. Ideally, the target country is covered by an EC adequacy decision per Art 45. For US-based companies, this is the case only when they have self-certified under the Privacy Shield framework. Non-GDPR compliance steps could include cookie consent banners, or showing a VAT ID. How can you prepare for data subject requests? Data subjects have various rights per Arts 15–23, subject to the modalities in Art 12. For example, a data subject could request that their information is erased from your website. The exact rights also depend on the legal basis you selected. You should figure out in advance how to deal with such requests.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.