5

I recently created a browser extension that allows you to pretty-format a web page and save it in various formats (Word, PDF, etc). I have made it publicly accessible through the browser extension gallery, so anyone can install and use it. The way this extension works is it uploads the content of the page you are viewing to my own server, the server processes it, and then lets you download the resulting file.

This all works fine, but I recently started getting questions from users concerned about the fact that their data (possibly private and sensitive) gets uploaded to the internet. They were asking me to provide a GDPR-compliant data processing agreement, so they can install it on their company's computers. I do not have any kind of agreements, and in fact I do not even own a company at all. This browser extension, and the server that it uploads the data to is all my personal effort, and I never bothered to do any legal work around it.

In this case, am I legally obliged to create a company and have any data processing agreements in place? (not sure if it matters, but I live in the UK, and I rent my server in the USA)

1 Answer 1

6

No, you're not required to sign any contracts. But since you're offering a service, you do have to manage some compliance tasks.

You are a data controller under the UK GDPR, regardless of whether you have a company. This brings with it various compliance requirements. For example, you MUST post a privacy notice in accordance with Art 13 GDPR that explains how you process user's information. You must sign data processing agreements with your data processors, such as your server providers. And you should reconsider transfers of data to the US, since such transfers are illegal or at least quite questionable in the wake of the 2020 Schrems II ruling.

You now have prospective users that are asking you for an Art 28 data processing agreement (DPA). These are likely other organizations that are data controllers of their own. For them to use your browser extension, they either need to find a legal basis that allows them to share their user's/employee's data with you (controller to controller transfer), or they need you to act as their data processor (controller to processor transfer). The third alternative is not to use your plugin at all. Of these, a C2P arrangement is most convenient for these other orgs, but involves a bit of paperwork to set up first.

If you want to act as their processor, this doesn't mean you'd have to create a company (though a corporation might be very desirable as a liability shield). Being a processor means that you're contractually bound to only use the personal data as instructed by the controller, and not for your own purposes. This restricts what you can do, and has some special compliance requirements. For example, you cannot engage new subprocessors without your controller's approval. However, processor status can also be convenient for you because you're not responsible for interacting with the controller's data subjects, e.g. you're not responsible for handling their data subject access requests.

Note that it's possible to simultaneously be a controller for some users, and a processor for others. E.g. Google Docs is offered directly to users as a B2C product so that Google is a controller, but also as a B2B product as Google Workspace, where Google acts as a data processor.

Personally, I'd rather not sign any contracts unless I'm doing it as a business, and adequately compensated for providing this service. GDPR is only one compliance aspect out of many, making it unwise to offer a SaaS product as a hobby. For example, copying other people's web content has copyright implications…

A potential alternative for some of the organizations asking you might be to make it possible for them to self-host your backend, so that they are not required to rely on you as a data processor. If you have no plans to commercialize your software, making it Open Source could be a solution. But you're in no way required to do that if you don't want to.

3
  • you should reconsider transfers of data to the US, since such transfers are illegal or at least quite questionable - so my software is not allowed to store users' data in the US just because I live in UK, even though most of my users are in the US themselves? Does this also mean that if I ask my friend who lives in the US to put his name as this extension's author instead of me, then this will stop being illegal? Commented Apr 25, 2021 at 19:22
  • 4
    It is clearly you and not your friend who is the data controller because you determine the purposes and means of processing. All your processing of personal data is clearly within scope of the GDPR per Art 3(1), regardless of where users are from. You cannot outsource your controller responsibilities. You can outsource processing tasks to foreign countries as long as you ensure an adequate level of data protection. In 2020, the ECJ found that the US do not offer an adequate level of protection, and this decision is binding for the UK as well.
    – amon
    Commented Apr 25, 2021 at 19:35
  • (But unless you're using a PaaS service or something like Firebase, migrating to an UK/EU-hosted server should be reasonable.)
    – amon
    Commented Apr 25, 2021 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .