Timeline for Is offline-only processing a "‘processing" as understood by GDPR?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 1, 2020 at 10:19 | comment | added | user9838 | That is actually wrong. Any data storage that happens on the users device is subject to the ePrivacy Directive (to be replaced by the ePrivacy Regulation). | |
| Jul 1, 2020 at 21:06 | comment | added | cubuspl42 | @wimh I believe that if the processed data is actually the user's own personal data, the user cannot be considered the controller, because the GDPR itself doesn't apply (I don't think you can have a controller-user relation with yourself). But I don't have a quote for that. | |
| Jul 1, 2020 at 21:03 | comment | added | cubuspl42 | @PaulJohnson I'm not located in the UK, unfortunately. | |
| Jul 1, 2020 at 18:24 | comment | added | wimh | The first question should be "who is the controller?". Based on Art. 4(7) the controller determines the means of the processing of personal data. I think that means the user who decides to use your software to process data is the controller. The controller is responsible to use only software which complies with the GDPR (see Art. 24(1)). There are situations where two parties are joint controllers. For example when creating a fan page on facebook, the creator and facebook are joint controllers. | |
| Jul 1, 2020 at 16:53 | comment | added | Paul Johnson | @cubuspl42 Its a good question. I can't find anything which specifically addresses this point either, and its not the first time the question has come up. I do see what you mean about Article 4, particularly given the fact that the Data Controller can have the processing done by someone else. What if that someone else is in fact the app user? One way forward would be to write to the ICO (assuming you are in the UK) and ask the question, adding that you plan to post their reply here. | |
| Jul 1, 2020 at 16:08 | comment | added | cubuspl42 | Well, that's was also my intuition, and I shared that in the question. But could you explain why? Does some other part of GDPR specify that? Like I said, the processing definition itself is so broad that it, ironically, does seem to include local processing. | |
| Jul 1, 2020 at 16:00 | history | answered | Paul Johnson | CC BY-SA 4.0 |