Can I make a privacy policy on my own for free? I have the Problem that I want to start a web application which has access to the users files on dropbox and co. This involves saving some of the data local, e.g. the directory structure, access token, email addresses... I know that I have to provide detailed information which data I save and how I use it. But I am a poor student who don't want invest money into a lawyer to write me a privacy policy (this is just a simple project which I want to share, I do not plan to get paid for it) Is there any way I can do this privacy policy on my own? Is it possible to just create some “I save all your data“ policy which would of course be to much but it would include all data I save and so I would not miss anything in my policy? Does such a policy have to be in a specific form?
I know that I have to provide detailed information which data I save and how I use it. Yes, you should, if you are getting access to users' Dropbox accounts, which will contain all sorts of private data, copyrighted (and illegally copied copyrighted files), etc. You provide the detailed information to your users through a click-through Privacy Policy - TOS (Terms of Service) in your App, like any other App out there. Click wrap (Wikipedia) user agreements are legally binding in many jurisdictions. Even if you don't access files and information - such as personal information or files - you still need a clear TOS for your App, for both your users' and your own legal protection. But I am a poor student who don't want invest money into a lawyer to write me a privacy policy ... I do not plan to get paid for (this app)... Being a free or paid App doesn't make a difference when it comes to the TOS, if you need one, and if you need to pay for one to be drafted. But not investing money in a lawyer can be a critical mistake if your App will be distributed on the popular App directories like Google Play and iTunes and your TOS does not clearly and legally outline all possible usage and data polices. Lawyers have experience in covering all the bases. Is there any way I can do this privacy policy on my own? Sure, you can: https://www.google.com/search?q=privacy+policy+generator But you run considerable legal liability not having a TOS that correctly and legally addresses all users' privacy concerns and clearly outlines what you do to insure security. That's what lawyers are for. Is it possible to just create some “I save all your data“ policy which would of course be to much but it would include all data I save and so I would not miss anything in my policy? Sure, you can simply say I save all your data. But how can you be sure that you've haven't missed important policy details and scenarios that could result in legal action against you? Like how long do you save data? When will you delete it? How secure is it? Can the user ask for deletion? What happens if you get hacked? What about users in countries other than the US? Users under 18 years old? You must use arbitration for any disputes? And on and on. The considerable legal liability of using a non-professionally drafted TOS means you run the risk of getting sued. You have to decide if it is worth the risk.
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
First of all, in a GDPR contest, the process described is not strong anonymization. It may be hard for an outsider to go from the stored record to any PII, it is much easier for an outsider to &quot;single out&quot; an individual. This means that given a known individual, one can determine whether that person is among those listed in the records, or can determine this to a significant degree of probability. For this only the algorithm and the rotating salts are needed, one need not break the hash. Note also that the GDPR specifies that if a person can be singled out with the assistance of the site operator the data is not considered anonymized. Thus this data needs a lawful basis under the GDPR, and the various other GDPR requirement all apply. However, even if the data were totally anonymized, and say just added to a count of users with this or that User Agent, the process of reading local data (including but not limited to cookies) itself requires informed consent, and so a cookie banner or other interaction with similar info under the e-Privacy directive (EPD). The EPD, being a directive and not a regulation, must be implemented by national laws, and the exact provisions in those laws may differ somewhat from country to country. But I believe that all of them require consent before any local data is read.
This very much depends on where you are. Different jurisdictions have wildly different laws about this. Some places are very permissive. You can record a conversation that you aren't even a party to so long as nobody has any reasonable expectation of privacy. In others, affirmative consent is required from every party to a conversation before it's legal to record it. The laws run the entire spectrum. Some places allow you to record anything you're a party to without permission, but you can't record others' conversations. Some places require you to disclose, but not obtain explicit permission. Some allow you to record but restrict who you can disclose it to. Some allow you to record or ban recording only under certain circumstances. It's a really wide gamut of laws. Since you don't say where you are, who you're recording, or why, there's no way to really answer the question. Here's a good rundown on the United States. This Wikipedia article covers lots of different countries, but only with regard to phone calls.
In Germany, there is no concept that corresponds directly to public domain. You automatically hold the Urheberrecht (~ copyright) for all creative works that you make, and it can't be given up or transferred (§29 UrhG). The work only enters the Gemeinfreiheit (~public domain) 70 years after your death. You can however license Verwertungsrechte (economic usage rights). When you make creative works in the course of employment (see §43 UrhG), your employer automatically gets the Verwertungsrechte necessary in the context for the work, which is typically an exclusive right (no one else, not even you, can use the work). Your are not in an employment relationship with your school, so it has no rights to your works and cannot prevent you from publishing them on copyright grounds. When you see advice on the internet to check with your school first, that is U.S.-specific advice. Since you're still a minor (7–17), you only have limited capacity to enter contracts or legal transactions (bedingte Geschäftsfähigkeit). While you are able to make transactions involving your own means (e.g. buying something with your pocket money) or make transactions that are only to your benefit (such as accepting a gift), other transactions are schwebend unwirksam (~ pending ratification), until your parents agree. The relevant law is in §107 and §108 BGB. This is a problem with open source licenses. If you publish software under a license, this license is schwebend unwirksam. Someone might start using the software under the license. But then if your parents refuse ratification, the license would be invalid, and everyone would have to stop using your software and destroy any derivative works they made. This is a bit of a problem, especially since open source licenses are otherwise assumed to be irrevocable. So if you want to offer a license (including open source licenses), please give legal certainty to the recipients of the license and ask your parents for their consent first, possibly even in writing. Per §107 BGB, the license you offer with their consent will be valid.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
Simply use a cookie to store consent. First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie. You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website. Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate Art. 11(1) GDPR: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Notice it is possible to configure google analytics in a way so you don't need any consent. See my answer to this question. Just IP anonymization is not sufficient.
Of course, remote access tools and remote administration can be legitimate. But such tools also have substantial potential for abuse. You as the app provider might have a responsibility for ensuring security and safety of your system. In particular: consider whether other mechanisms are more appropriate for sharing pictures, e.g. a messenger app the user should always be aware when access is active, for example by requiring user interaction for starting a session during which access is allowed, and by showing a persistent notification while access is active the user should be able to withdraw access at any time before starting the session, the user should be informed about potential risks so that they can give informed consent the shared content should likely be protected via end-to-end encryption Scenarios that should be impossible, or at least prevented with reasonable safeguards: An attacker suspects their partner of cheating. The attacker installs a remote access tool on their partner's device and starts tracking it. Clearly, the partner being tracked will not have given consent here. A “tech support” scammer tricks the victim into installing the remote access tool and uses it to guide the victim into transferring money. Why you should care about such issues: If your app enables criminal acts, and you did not take reasonable precautions to prevent this, you might have some degree of liability. Apps that can be used as spy apps are likely to ran afoul of app store guidelines that you would like to distribute your app through. If you market your app in Europe, your app may only access information on the end user's device with the user's consent. Many of the safeguards suggested above (prior information, keeping the user fully aware of what is happening, making it easy to revoke access, no surreptitious tracking, no misleading users) are essential for obtaining valid consent. You as the app provider would need consent since you would act as the service provider / data controller.