Would GDPR affect my own personal website? I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to GDPR? What I want to do is make an administrator panel and track user IP address ONLY if they go to that page. I would then block their IP if there is suspicious activity. I would also need to store cookies to ensure that the person using the administrator page is authorised. As I understand GDPR make IP addresses personal information. Also, there is the EU cookie law too. Is the GDPR and Cookie Law applicable to me or not? Also, would I have to make Terms and Conditions?
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
You need a privacy notice for any website (if you're subject to GDPR). Having a PayPal button alone does not trigger such an requirement, since any website is already processing personal data such as IP addresses even if there's no third party content. But it's good that you think about issues for including third party content. As rulings such as the Fashion ID case and the more recent Google Fonts judgement have clarified, you are responsible having a suitable legal basis when you cause visitor's personal data to be disclosed to third parties. Even just embedding/loading a button or logo can cause personal data such as IP addresses to be disclosed to the recipients. You might have a legal basis if earlier, the user already opted in to payment with PayPal (could be consent per Art 6(1)(a) GDPR, or necessity for performing the contract per Art 6(1)(b)). Loading the embedded content just because the user might want to use it is probably not compliant though. For example, the common PayPal donation button is problematic. Thus, instead of linking a PayPal SDK, you might want to host the code + assets for the PayPal payment functionality on your own servers, or only load the PayPal content after the user unambiguously indicated that they want to use this content. I've discussed the PayPal donate button previously, as well as background on the Fashion ID case and click-to-consent wrappers for embedded content. What the Fashion ID case made very clear though is that you're only responsible for compliance for those data processing activity where you can actually influence the “purposes and means” of processing. You have no control over what PayPal does with the data on their servers, so they are solely responsible for that. And if the PayPal button navigates to a PayPal website, you're not responsible for what cookies PayPal sets on its own website. It is thus correct that the PayPal popup has its own cookie banner – you are not responsible for the contents of the popup. You also don't need to collect consent for cookies and similar technologies that are strictly necessary to provide a service that was explicitly requested by the user. For example, session cookies, XSRF protection cookies, and cookies containing a shopping cart are often such strictly necessary cookies. You must still be transparent about the use of such cookies, but you probably don't need a banner to announce this. So I think that you can probably go without a cookie banner, though you should probably get consent before loading PayPal content into your page, and you will likely want to be transparent about cookies as part of your privacy notice.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
the statute only applies to EU residents Wrong. GDPR applies to everyone in the EU (Art. 3). This means tourists are also covered. Residence status is completely irrelevant (Recital 14(1)): The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence There is no provision for data processors/controllers to demand proof from data subjects of them being located in the EU. You can challenge them, but if they refuse to provide proof you will still be liable to fulfill their GDPR request should they indeed be present in the EU.
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII. So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth). I hope your privacy policy says that you store all that PII on registration and that you have some good arguments why storing that information is a &quot;legitimate interest&quot; of your organization.
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
If you merely provide software for your client to use, you are not processing personal data on behalf of the client. But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor. Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution. Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.