How can you tell if an application author or user is the one controlling or processing data?

Question

Say I produce a tool that a user can enter a bunch of personal data into to accomplish some task. Say I distribute it as an EXE file or a web site or an app, but the tool does all its thinking and storage on hardware the user provides, and doesn't actually send me any user data.

Am I a "data processor" or "data controller" or a similar concept in any jurisdiction on the basis of my having determined how the tool works or, my having the ability to publish updates to it (automatic or otherwise) that might make it work differently?

I want to parse this as the user doing things with the user's own data, but a non-sophisticated user, who does not have the expertise to do things like access the data an app has stored on a phone without the app's cooperation, might see things differently.

Is the analysis any different between, say, a free spreadsheet program that behaves reasonably, versus a free spreadsheet program that automatically stops working forever if you enter too big a value in a field you have labeled "Monthly Income" (or otherwise exhibits user-hostile, locally-controlled use of stored state)?

Answer 1

If this is more than just academic interest, your business plan should include hiring a lawyer.

But if the data never leaves the device of the user, and if you have no way to access that data unless the user installs an 'update' which totally changes your app, then you are neither processor not controller for that data. You can do absolutely nothing with the data.

Answer 2

If you look at the definitions in Article 4 GDPR:

(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

If the application author has no access to the data then the author isn't a 'processor'.

If the application author does not determine the purpose and means of processing then the author isn't a 'controller'.