Does my Personal Web App need to comply to GDPR? I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. I do know what needs to be done if the app was not a personal app, but I am not sure if I really need to do all the actions (consent, deletion, takeout data) in my case where this is just a personal website/app and nothing more.
An app(lication program) is software run on the end-users machine. That does not fall under the GDPR. Any processing (including storage) you do on user data has to be compliant with the GDPR. Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data. Providing this "basic data" as a JSON or CSV file should meet data portability requirements. Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission. Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent). Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data. Finally, make sure there is a "Close my account and delete all my data" option.
The GDPR roughly applies in the following scenarios: Art 3(1): you have an establishment in Europe Art 3(2): you do not have an european establishment, but Art 3(2)(a): offer goods or services to persons in Europe Art 3(2)(b): monitor the behaviour of people who are in Europe (where Europe means EU/EEA/UK as appropriate). Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US. Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US. For detailed guidelines on the territorial scope of the GDPR, consider reading EDPB guidelines 3/2018 (PDF). The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8: An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing. An Australian subscriber of the service travels to Germany on holiday and continues using the service. Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals in the Union, but targets only individuals in Australia, and so the processing of personal data by the Australian company does not fall within the scope of the GDPR. Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR: A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.
There doesn't seem to be any legal requirement to show banners to announce the use of strictly necessary cookies ("functional cookies"). However, the GDPR's transparency principle requires you to disclose the purpose and legal basis for all processing of personal data. This could be done via a banner, but more commonly via a site-wide privacy policy. The GDPR requires such information to be provided at the latest at the time when personal data is collected. A layered disclosure approach could use banners to alert visitors to the privacy policy, but I'd want to avoid this to prevent confusion with non-compliant consent banners. Of course, GDPR only applies when the cookies are used for processing of personal data. Cookies are handled more specifically by the EU's ePrivacy directive, for which each country has it's own implementation. You should therefore check with local laws and guidance from your local data protection agency.
Yes, phone numbers would generally qualify as Personal Data under GDPR. It would be so irrespective of whether you have also stored other information along with the phone numbers or not, since also information that indirectly could identify a natural person is Personal Data (provided that there are, somewhere else, public or not public, a register of who holds the specific phone number). See Article 4(1) GDPR. (One could possibly argue that the phone numbers would not be considered personal data if there is no actual register of who owns a specific phone number with any other party. Or if such register is in practice not available for anyone. It might be so in some cases, although I would not rely on it.) Whether you have the right to process the phone numbers must be assessed based on its lawfulness (see Article 6 GDPR). It could be based on consent, performance of contract, legitimate interest or any other ground set out therein.
It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (a) the data subject has given consent ... (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. If a person requests services from an online service provider, basis (b) will apply, at least to some information. If there is evidence of criminal activity, basis (c) may well apply, as it also will for much routine record keeping. Any in many such cases, basis (e) or (f) will also apply. In short, article 6 does not create a &quot;haven for online criminals/hackers&quot;. In a comment on another answer the OP writes: The offender has the right to not be identifiable and he can't be denied this right That is simply not correct. Nothing in the GDPR says anything of the sort. It is true that consent may not be forced, but if a user requests a service that service may require the user to identify him- or herself. For example, one cannot order physical goods without giving a name and a shipping address. And the provider may retain PI and even PII when it has a &quot;legitimate interest&quot; in doing so, although if challenged it must justify that legitimate interest.
To do so I used some images and Gifs which may be under copyright but since I don't earn money for myself and there is no company backing me I was hoping that there is some protection for private persons like me who just want to showcase the project. Sorry. If your website is public facing (i.e. not password protected and available only to family and close friends), you need to follow copyright law. There is no exception to copyright just because a project is run by an individual for non-commercial purposes. I am also insecure about the GDPR regulations since I give users the ability to create an account and try it out. Your profile says you're in the EU. Then you need to comply with the GDPR. Is there any way to protect me against greedy lawyers and companies? Could I write something like: "This website is a peace of art" and save myself with arguments like "artistic freedom" or "free speech"? Nope. A controversial website run by Peter Sunde had at one point a "free speech" disclaimer (similar to the one you propose) posted. However, Sunde did never use this defense in court: Finnish court slaps Peter Sunde with €350k fine. If he had shown up in court, I am pretty sure the court would have told him that such a disclaimer has no legal merit. The only protection that will make you completely safe is to adhere to the law.