How is S.E. a processor of data according to GDPR? This states that S.E. is a data processor and customers are the data controller . However after we enter data it is S.E. which determines how it is shown and/or delivered (i) to their servers . So shouldn't S.E. be the data controller in this regard? And here for integration with M.S. Teams S.E. states it is a joint controller with the customers . Like how is this determined? Have posted several downvoted questions on GDPR.GOOGLE states that GOOGLE is the data controller and app developers are joint controllers. So again, Like how is this determined? On top of that does the responsibility according to GDPR for the data collected by one joint (b) controller also shared with controller (a) who is the other controller?. Then have seen several sites where it just seems one controller has just linked to the other controller ( who claims to be responsible under the GDPR ) and has basically left all responsibility to them . Obviously it is not possible to ensure compliance of third parties . However if one uses some uses GitHub Pages to host a website or use AdMob in one's app one must receive GDPR requests and probably forward them to GOOGLE or Github somehow but the developer cannot ensure they comply.Also how will the developer keep consent records? Everyone does not capital at beginning to host a server and if one does one mst obey more laws! **EVERYTHING JUST SEEMS TO CONTRADICT!!**So can one explain this confusion. Have tried to do make the wording of this question as good as possible .
StackExchange is a processor under GDPR because it processes the data you provide it when you sign up and input personal information. It's determined by an analysis of what function(s) the business is performing. If you are merely processing the data but don't have control over it (e.g. another business is using your software to do something with data that it is providing you) then you are likely to be a data processor. Conversely, if you control the data, you are likely to be a data controller. It is possible to be both a data controller and a data processor at the same time. That specific link in your post goes on to state: Our business customers may qualify as controllers when they purchase certain of our products and services. We act as processors on behalf of such Customers. This is referring to the Teams product that StackExchange offers or whatever the &quot;internal company-only question and answer site&quot; product they offer is called.
Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering. From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them: consent? No. necessary for performance of a contract involving the data subject? No. legal obligation? No. vital interests? No. public interest? No. legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails. It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do. In conclusion, your client's idea is a bad idea: They likely do not have a legal basis for this under the GDPR. They are likely violating more specific anti-spam laws in their jurisdiction. They are working hard to get their domain put on spam filter lists. Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis. Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.
The scope of the GDPR is entered when personal data is being processed in a structured manner. Personal data is any information relating to identifiable data subjects (definition in Art 4(1)). &quot;Peter attended the meeting on the 14th&quot; is personal data. &quot;That woman with the blue handbag said she wanted to return on the 25th&quot; is personal data. However, aggregate statistics do not relate to individuals, and are typically not personal data. &quot;On the 14th, we had 25 attendees&quot; is not personal data. Not all use of personal data is within the scope of the GDPR. For example, the GDPR would not apply if two organizers talk about who attended the meeting. However, Art 2(1) says the GDPR applies when personal data is processed wholly or partially with automated means (e.g. computers, smartphones), or forms a filing system or is intended for a filing system (e.g. keeping notes on attendees, keeping attendance lists) If GDPR applies, the organization would be responsible for ensuring compliance with its rules and principles, summarized in Art 5. Primarily, this means: having a clear purpose for processing selecting a suitable Art 6 legal basis for that purpose (e.g. consent or a legitimate interest) only processing the minimum data necessary for achieving that purpose determining and implementing appropriate technical and organizational measures to ensure compliance and security of the processing activities preparing for data subject rights, in particular by providing an Art 13 privacy notice when collecting data from the data subjects There are of course some complexities in the details. When the legal basis is &quot;consent&quot; (opt-in), the organization would have to ensure that this consent was freely given and sufficiently informed. Per Art 7(4), consent would not be freely given if that consent was a condition for access to the meeting. Using &quot;legitimate interest&quot; (opt-out) can be more flexible, but it requires performing a balancing test to show that the legitimate interest isn't outweighed by the data subjects' interests, rights, and freedoms. Roughly, relying on a legitimate interest is appropriate when the data subjects can reasonably expect the processing activity to occur. Regarding point 1, keeping general counts and aggregate statistics about attendees is probably OK since it wouldn't be personal data. If you are very conscientious about this, you could round all counts and use categories like &quot;0-4 attendees, 5-9 attendees&quot; for each facet, which makes it more difficult to make inferences about individuals. But the fundamental point is that all your data should relate to attendees as a whole, never to individuals. Regarding point 2 and 3, this is a question of legal basis. Since you gather names through informal conversations, I think that attendees would be weirded out if they learned that you kept detailed records on their attendance. So I think that you probably wouldn't have a legitimate interest here. However, being upfront with this and offering an opt-out could change this. On the aspect of keeping detailed notes on data from informal conversations, I'd like to point out H&amp;M's EUR 35 million fine back in 2020 (summary on GDPRHub.eu). In a callcenter, managers used to have conversations with employees. These conversations touched on anything from vacation experiences to health problems, marriage problems, and religious beliefs. All of that is fine. What was not fine is that the managers went full Stasi and kept detailed notes about all of this on a shared drive and used that information for management decisions. This went on until a configuration error made those files accessible to all employees. This violated all the points in the basic compliance process outlined above: the records had no clear purpose, no suitable legal basis, contained way more data than necessary (and even Art 9 special categories of data like information on health or religious beliefs which have extra protection), did not have appropriate measures to prevent unauthorized access, and did not fulfill data subject rights like the Art 13 right to be informed. In case this non-profit is a church or religious organization that had its own comprehensive data protection rules before the GDPR came into force in 2018, those can continue to apply per Art 91. This could probably address some issues of legal basis, but cannot circumvent the GDPR's general principles.
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post: If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can: Respond to requests to correct, amend or delete personal data. Detect and report personal data breaches. Demonstrate your compliance with the GDPR. Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections. Microsoft has set up an informational site on GDPR here. If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.
“From your perspective you should not worry about asking permission to use reCaptcha as it is not you who is processing the data it is google and any GDPR compliance falls on them.“ This is plain wrong. If a user visits your website you are the controller of data collected on your website. Regardless of what entity collects that data. However in my non-legal opinion reCAPTCHA falls under Article 6 section 1d and 1f. Also Recital 49. 1d: “processing is necessary in order to protect the vital interests of the data subject or of another natural person;” While you could argue in some cases (most probably) reCAPTCHA is used to reduce spam to a business entity thus not a “natural person”. 1f: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” Here is where the real ruling applies “Legitimate interests”. You as a business have a legitimate interest in reducing spam into your business. Not only does spam take up your time but it also takes up your resources. As to the extent in which spam takes up is dependent on the usage in question. But nearly everyone can safely assume reducing spam (one of the cornerstones of the GDPR) is a legitimate interest. Recital 49 (excerpt): The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.
Does GDPR apply if my web app stores personal data on the user's phone only? No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is what a web browser does when it asks to remember your username and password for this web site. You are providing a tool, the user is using that tool to process their own data. I do offer to back up the user's personal data At this point you are processing the users PII, and the GDPR does apply to you. Even though you do not have enough information to identify an individual, as it can be used with other information to identify an individual it is PII. From the ICO: Can we identify an individual indirectly from the information we have (together with other available information)? Even if you may need additional information to be able to identify someone, they may still be identifiable. That additional information may be information you already hold, or it may be information that you need to obtain from another source. When considering whether individuals can be identified, you may have to assess the means that could be used by an interested and sufficiently determined person.