6

In ensuring GDPR compliance determining which entities are data controllers and which data processors is a critical step. The UK government says:

The UK GDPR defines a controller as:

the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

My understanding of this is that if you are making decisions about what data is collected and what processing occurs on that data then you are a controller. If you are not making decisions, but only carrying out another's instructions on data that they have provided then you are likely a data processor, and you have more limited compliance responsibilities.

Many web sites load resources from third parties. For example this page has recived files from googleapis.com, googletagmanager.com, cookielaw.org and gravatar.com. My understanding is that LG München, Urteil vom 20.01.2022, Az. 3 O 17493/20 confirmed in relation to Google fonts this is a data transfer under the GDPR. From an English language news article:

"The unauthorized disclosure of the plaintiff's dynamic IP address by the defendant to Google constitutes a violation of the general right of personality in the form of the right to informational self-determination according to § 823 Para. 1 BGB," the ruling stated, as algorithmically translated. "The right to informational self-determination includes the right of the individual to disclose and determine the use of their personal data."

Does this mean that if you are making technical web site development/hosting decisions like "Where do we get our fonts from", or the apis or tags or whatever this site is getting from google and whoever else, then you are a data controller even if the main functionality of the site would only require you to be a data processor?

Improve this question
1
  • If you're making less than $1M in revenue I'd not worry about minor things like that, it will never be enforced.
    – JonathanReez
    Commented Jul 19 at 20:19

1 Answer 1

Reset to default
22

If the website collects personal data (for example an IP address) and decides to share that with a third party (for example Google) then it is by definition a data controller. The fact that the IP address was send to Google was solely a decision of the website, it is neither technically required, nor was there anybody else ordering them to do it on their behalf.

That does not rule out that the website can also be a data processor for other data. It is possible to be both, for different data sets respectively.

Please note that you can use Google fonts, you just have to host them yourself, as described for example in this Official Google Guide so you don't leak your user's personal data to Google.

Improve this answer
2
  • 2
    I fail to understand all such examples. The website, at no point in time, provided the IP address to Google. It was the website vistor's BROWSER that went on to contact Google to fetch the font, thus providing the IP address to Google. If the visitor is bothered by their browser contacting Google, they should fix that for themselves.
    – Marcel
    Commented Jul 20 at 21:21
  • 2
    @Marcel IANAL, but that argument seems without merit. The browser is executing code that comes from the website, and that code is part of the system constructed by the ower of the website; where the code actually executes is irrelevant.
    – Michael Kay
    Commented Jul 21 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .